addon-publish-dev.yml

name: Home Assistant Add-on Publish (Dev)

on:
  push:
    branches: [master]
    paths:
      - 'src/**'
      - 'homeassistant-addon/**'
      - 'homeassistant-addon-dev/**'
      - 'pyproject.toml'
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_PREFIX: ghcr.io/${{ github.repository }}-addon-dev

# Restrict permissions by default
permissions:
  contents: read

# Serialize with every other workflow that pushes to master (this one pushes
# the dev add-on config bump via _update-addon-config.yml): a push landing
# while a release workflow's semantic-release is mid-run aborts that release
# un-retryably ("Upstream branch ... has changed").
concurrency:
  group: master-write
  cancel-in-progress: false
  # queue: max keeps every queued run waiting FIFO. The default single-slot
  # queue evicts the OLDER pending run when a new one queues, which could
  # silently drop a queued release behind a bot push.
  queue: max

jobs:
  # Skip if commit is from semantic-release
  check-skip:
    runs-on: ubuntu-latest
    outputs:
      should_skip: ${{ steps.check.outputs.should_skip }}
    steps:
      - name: Check if should skip
        id: check
        env:
          # Use env var to avoid shell interpretation of backticks in commit messages
          COMMIT_MSG: ${{ github.event.head_commit.message }}
        run: |
          if [[ "$COMMIT_MSG" =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]] || [[ "$COMMIT_MSG" =~ "chore(release)" ]]; then
            echo "should_skip=true" >> $GITHUB_OUTPUT
          else
            echo "should_skip=false" >> $GITHUB_OUTPUT
          fi

  prepare:
    needs: check-skip
    if: needs.check-skip.outputs.should_skip != 'true'
    runs-on: ubuntu-latest
    outputs:
      dev_version: ${{ steps.version.outputs.dev_version }}
      short_sha: ${{ steps.version.outputs.short_sha }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
          # Full history: the dev version number is the commit count.
          fetch-depth: 0

      - name: Generate dev version
        id: version
        run: |
          BASE_VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
          # dev N = commit count on master: the same commit produces the SAME
          # number in every workflow (PyPI/Docker in publish-dev, the dev
          # add-on here), so all surfaces report one dev version. run_number
          # was per-workflow, which is how the add-on drifted ~300 builds
          # behind the PyPI counter and made version reports incomparable.
          # Count origin/master (not HEAD): a workflow_dispatch on an older
          # ref would otherwise mint a LOWER number that collides with an
          # existing dev release and clobbers it.
          DEV_VERSION="${BASE_VERSION}.dev$(git rev-list --count origin/master)"

          echo "dev_version=$DEV_VERSION" >> $GITHUB_OUTPUT
          echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
          echo "Dev add-on version: $DEV_VERSION (sha: $SHORT_SHA)"

  build-addon-dev:
    name: Build Dev Add-on (${{ matrix.arch }})
    needs: prepare
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        arch:
          - amd64
          - aarch64
        include:
          - arch: amd64
            platform: linux/amd64
          - arch: aarch64
            platform: linux/arm64

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      with:
        persist-credentials: false
        submodules: true

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

    - name: Log in to GitHub Container Registry
      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Build and push Docker image
      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
      with:
        context: .
        file: ./homeassistant-addon-dev/Dockerfile
        push: true
        platforms: ${{ matrix.platform }}
        tags: |
          ${{ env.IMAGE_PREFIX }}-${{ matrix.arch }}:latest
          ${{ env.IMAGE_PREFIX }}-${{ matrix.arch }}:dev
          ${{ env.IMAGE_PREFIX }}-${{ matrix.arch }}:${{ needs.prepare.outputs.dev_version }}
        labels: |
          io.hass.name=Home Assistant MCP Server (Dev)
          io.hass.description=Development channel - AI assistant integration via MCP
          io.hass.version=${{ needs.prepare.outputs.dev_version }}
          io.hass.type=addon
          io.hass.arch=${{ matrix.arch }}
        cache-from: type=gha,scope=addon-dev-${{ matrix.arch }}
        cache-to: type=gha,mode=max,scope=addon-dev-${{ matrix.arch }}
        build-args: |
          BUILD_VERSION=${{ needs.prepare.outputs.dev_version }}
          BUILD_ARCH=${{ matrix.arch }}

  # Update dev addon config.yaml so HA Supervisor detects new versions
  update-addon-dev-config:
    needs: [prepare, build-addon-dev]
    uses: ./.github/workflows/_update-addon-config.yml
    with:
      version: ${{ needs.prepare.outputs.dev_version }}
      config_path: homeassistant-addon-dev/config.yaml
      commit_message_prefix: 'publish dev addon version'
    secrets:
      RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
      RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
    permissions:
      contents: write