Merge pull request #170 from bocan/dependabot/npm_and_yarn/minor-and-… #83
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Automated Release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths-ignore: | |
| - 'CHANGELOG.md' | |
| - 'package.json' | |
| - 'package-lock.json' | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| id-token: write # Required for cosign keyless signing | |
| packages: write # Required for GHCR (optional, but good to have) | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '25' | |
| cache: 'npm' | |
| - name: Configure Git | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run release | |
| run: npm run release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Push changes | |
| run: | | |
| git push --follow-tags origin main | |
| - name: Extract version from package.json | |
| id: extract_version | |
| run: | | |
| VERSION=$(node -p "require('./package.json').version") | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: v${{ steps.extract_version.outputs.version }} | |
| name: Release v${{ steps.extract_version.outputs.version }} | |
| generate_release_notes: true | |
| draft: false | |
| prerelease: false | |
| outputs: | |
| version: ${{ steps.extract_version.outputs.version }} | |
| docker: | |
| runs-on: ubuntu-latest | |
| needs: release | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: v${{ needs.release.outputs.version }} | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to Docker Hub | |
| uses: docker/login-action@v4 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: docker.io/bocan/codex | |
| tags: | | |
| type=semver,pattern={{version}},value=${{ needs.release.outputs.version }} | |
| type=semver,pattern={{major}}.{{minor}},value=${{ needs.release.outputs.version }} | |
| type=semver,pattern={{major}},value=${{ needs.release.outputs.version }} | |
| type=raw,value=latest | |
| - name: Build and push Docker image | |
| id: build-push | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| sbom: true | |
| provenance: mode=max | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Sign image with cosign | |
| run: | | |
| cosign sign --yes \ | |
| docker.io/bocan/codex@${{ steps.build-push.outputs.digest }} |