ci: harden release automation metadata #101
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | ||
|
Check failure on line 1 in .github/workflows/release.yml
|
||
| on: | ||
| push: | ||
| tags: | ||
| - "v[0-9]+.[0-9]+.[0-9]+" | ||
| - "v[0-9]+.[0-9]+.[0-9]+-*" | ||
| jobs: | ||
| retag: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| packages: write | ||
| env: | ||
| REGISTRY: ghcr.io | ||
| IMAGE_NAMESPACE: ls1intum/hephaestus | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Determine release metadata | ||
| id: release | ||
| run: | | ||
| set -euo pipefail | ||
| COMMIT_SHA=$(git rev-list -n 1 "$GITHUB_REF") | ||
| SHORT_SHA=${COMMIT_SHA:0:12} | ||
| TAG_NAME=${GITHUB_REF_NAME} | ||
| IS_PRERELEASE=false | ||
| if [[ "$TAG_NAME" == *-* ]]; then | ||
| IS_PRERELEASE=true | ||
| fi | ||
| echo "commit=$COMMIT_SHA" >> "$GITHUB_OUTPUT" | ||
| echo "short=$SHORT_SHA" >> "$GITHUB_OUTPUT" | ||
| echo "tag=$TAG_NAME" >> "$GITHUB_OUTPUT" | ||
| echo "prerelease=$IS_PRERELEASE" >> "$GITHUB_OUTPUT" | ||
| - uses: imjasonh/setup-crane@v0.5 | ||
| - name: Authenticate with GHCR | ||
| run: echo "${{ secrets.GITHUB_TOKEN }}" | crane auth login ghcr.io -u "${{ github.actor }}" --password-stdin | ||
| - name: Retag images without rebuilds | ||
| run: | | ||
| set -euo pipefail | ||
| components=( | ||
| webapp | ||
| application-server | ||
| intelligence-service | ||
| webhook-ingest | ||
| ) | ||
| for component in "${components[@]}"; do | ||
| image="${REGISTRY}/${IMAGE_NAMESPACE}/${component}" | ||
| digest=$(crane digest "${image}:${{ steps.release.outputs.commit }}") | ||
| crane tag "${image}@${digest}" "${{ steps.release.outputs.tag }}" | ||
| if [[ "${{ steps.release.outputs.prerelease }}" != "true" ]]; then | ||
| crane tag "${image}@${digest}" prod | ||
| fi | ||
| done | ||
| - name: Create GitHub Release | ||
| uses: softprops/action-gh-release@v2 | ||
| with: | ||
| tag_name: ${{ steps.release.outputs.tag }} | ||
| target_commitish: ${{ steps.release.outputs.commit }} | ||
| generate_release_notes: true | ||
| prerelease: ${{ steps.release.outputs.prerelease }} | ||
| deploy-staging: | ||
| needs: retag | ||
| if: contains(github.ref_name, '-') | ||
| uses: ./.github/workflows/deploy-staging.yml | ||
| with: | ||
| image-tag: ${{ github.ref_name }} | ||
| app-version: ${{ github.ref_name }} | ||
| git-sha: ${{ steps.release.outputs.commit }} | ||
| deploy-app: true | ||
| secrets: inherit | ||
| deploy-production: | ||
| needs: retag | ||
| if: ${{ !contains(github.ref_name, '-') }} | ||
| uses: ./.github/workflows/deploy-prod.yml | ||
| with: | ||
| image-tag: ${{ github.ref_name }} | ||
| app-version: ${{ github.ref_name }} | ||
| git-sha: ${{ steps.release.outputs.commit }} | ||
| deploy-app: true | ||
| secrets: inherit | ||
