github-release.yml

name: Release

# Conventional commits on main drive the version: semantic-release computes the
# tag and cuts the GitHub Release, then the binaries and the three component
# images are built from that exact tag. Nothing publishes when no commit since
# the last release warrants a version bump.
on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Version to release (e.g. 1.2.3), leave empty to let semantic-release decide"
        required: false
        type: string
  push:
    branches:
      - main

permissions: {}

env:
  DOCKERHUB_USER: devopsiaci

jobs:
  version:
    name: Resolve version
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
    outputs:
      published: ${{ steps.resolve.outputs.published }}
      version: ${{ steps.resolve.outputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Semantic Release
        id: semantic_release
        if: inputs.tag == ''
        uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
        with:
          branch: main
          tag_format: ${version}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # A manual run with an explicit tag skips semantic-release entirely. That
      # is also how a release whose build failed after the tag landed gets
      # rebuilt, without inventing a second version number for it.
      - name: Resolve the version to build
        id: resolve
        env:
          TAG_INPUT: ${{ inputs.tag }}
          SR_PUBLISHED: ${{ steps.semantic_release.outputs.new_release_published }}
          SR_VERSION: ${{ steps.semantic_release.outputs.new_release_version }}
        run: |
          if [ -n "${TAG_INPUT}" ]; then
            echo "published=true" >> "$GITHUB_OUTPUT"
            echo "version=${TAG_INPUT#v}" >> "$GITHUB_OUTPUT"
          elif [ "${SR_PUBLISHED}" = "true" ]; then
            echo "published=true" >> "$GITHUB_OUTPUT"
            echo "version=${SR_VERSION}" >> "$GITHUB_OUTPUT"
          else
            echo "published=false" >> "$GITHUB_OUTPUT"
            echo "No release warranted by the commits since the last tag."
          fi

  binaries:
    name: ${{ matrix.component }} ${{ matrix.goos }}/${{ matrix.goarch }}
    needs: version
    if: needs.version.outputs.published == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        component: [manager, gateway, ui]
        goos: [linux, darwin]
        goarch: [amd64, arm64]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.version.outputs.version }}
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Build
        env:
          CGO_ENABLED: "0"
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          VERSION: ${{ needs.version.outputs.version }}
          COMPONENT: ${{ matrix.component }}
        run: |
          out="dwpk-${COMPONENT}_${VERSION}_${GOOS}_${GOARCH}"
          mkdir -p "dist/${out}"
          go build -ldflags "-s -w -X main.version=${VERSION}" \
            -o "dist/${out}/dwpk-${COMPONENT}" "./cmd/${COMPONENT}"
          cp LICENSE README.md "dist/${out}/"
          tar -czf "dist/${out}.tar.gz" -C dist "${out}"
          ( cd dist && sha256sum "${out}.tar.gz" > "${out}.tar.gz.sha256" )

      - name: Attach to the release
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: ${{ needs.version.outputs.version }}
          files: |
            dist/*.tar.gz
            dist/*.tar.gz.sha256
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  images:
    name: Image ${{ matrix.component }}
    needs: version
    if: needs.version.outputs.published == 'true'
    runs-on: ubuntu-latest
    permissions:
      attestations: write
      contents: read
      id-token: write
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - component: manager
            dockerfile: Dockerfile
            repo: dwpk
            title: dwpk manager
            description: The dwpk operator - reconciles UserSpace, Workspace and WorkspaceImage
          - component: gateway
            dockerfile: cmd/gateway/Dockerfile
            repo: dwpk-gateway
            title: dwpk gateway
            description: The dwpk SSH gateway - public-key authentication into workspace pods
          - component: ui
            dockerfile: cmd/ui/Dockerfile
            repo: dwpk-ui
            title: dwpk UI
            description: The dwpk marketplace web UI
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.version.outputs.version }}
          persist-credentials: false

      - name: Set Docker metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ${{ env.DOCKERHUB_USER }}/${{ matrix.repo }}
            ghcr.io/${{ github.repository_owner }}/${{ matrix.repo }}
          labels: |
            org.opencontainers.image.authors=ialejandro
            org.opencontainers.image.description=${{ matrix.description }}
            org.opencontainers.image.maintainer=ialejandro
            org.opencontainers.image.title=${{ matrix.title }}
            org.opencontainers.image.vendor=DevOps IA
          tags: |
            type=raw,value=${{ needs.version.outputs.version }}
            type=raw,value=latest
            type=sha,enable=false

      - name: Set up QEMU
        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: "[DOCKERHUB] Log in to Docker Hub"
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: "[GHCR] Log in to the Container registry"
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        id: push
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          build-args: VERSION=${{ needs.version.outputs.version }}
          cache-from: type=gha,scope=${{ matrix.component }}
          cache-to: type=gha,mode=max,scope=${{ matrix.component }}
          context: .
          file: ${{ matrix.dockerfile }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64
          push: true
          sbom: true
          tags: ${{ steps.meta.outputs.tags }}

      - name: "[DOCKERHUB] Update the registry description"
        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}
          repository: ${{ env.DOCKERHUB_USER }}/${{ matrix.repo }}

      # GHCR only: DockerHub has no attestation endpoint, and it is the same
      # image digest either way.
      - name: "[GHCR] Generate artifact attestation"
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.repo }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

  docs:
    name: Publish versioned docs
    needs: version
    if: needs.version.outputs.published == 'true'
    runs-on: ubuntu-latest
    # Shared with github-pages.yml: both push gh-pages, and racing makes the second push fail.
    concurrency:
      group: gh-pages
      cancel-in-progress: false
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.version.outputs.version }}
          fetch-depth: 0

      - name: Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3"

      - name: Install mkdocs-material and mike
        run: pip install mkdocs-material mike mkdocs-llmstxt

      # mike's version identifier is major.minor, not the full patch version:
      # a patch release (1.4.0 -> 1.4.1) redeploys the same "1.4" entry in
      # place instead of adding a new one to the dropdown, which only a major
      # or minor bump does.
      - name: Deploy this version and move the "latest" alias
        env:
          VERSION: ${{ needs.version.outputs.version }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          # mike resolves the "gh-pages" ref literally (git show gh-pages:...)
          # and needs it fetched to see - and not clobber - versions already
          # deployed there. First-ever deploy: this fails harmlessly, and mike
          # creates gh-pages from scratch.
          git fetch origin gh-pages:gh-pages --depth=1 2>/dev/null || true
          minor="${VERSION%.*}"
          mike deploy --push --update-aliases "${minor}" latest
          mike set-default --push latest