release-docker.yml

name: Release with Docker image to GHCR

on:
  workflow_dispatch:
  push:
    branches:
      - main
    tags:
      - "v**"

permissions:
  contents: read

jobs:
  verify:
    name: Verify release should continue
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      continue: ${{ steps.verify_branch.outputs.continue }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Verify ref points to a commit on main branch
        id: verify_branch
        run: |
          REF_COMMIT=$(git rev-list -n 1 "$GITHUB_REF")
          echo "Ref commit: $REF_COMMIT"

          git fetch origin main
          MAIN_COMMIT=$(git rev-parse origin/main)
          echo "Main commit: $MAIN_COMMIT"

          if git merge-base --is-ancestor "$REF_COMMIT" "$MAIN_COMMIT"; then
            echo "continue=true" >> "$GITHUB_OUTPUT"
          else
            echo "continue=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Stop if ref is not on main branch
        if: steps.verify_branch.outputs.continue != 'true'
        run: |
          echo "Ref commit is not on main branch, skipping release."
          exit 0

  build-server-core:
    name: Build and push server-core
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: verify
    if: needs.verify.outputs.continue == 'true'

    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: ".node-version"

      - uses: ./.github/actions/setup-meteor

      - name: Prepare Environment
        run: |
          corepack enable
          yarn install
          yarn meteor lint

      - name: Build libs
        run: yarn build:packages

      - name: Build webui
        run: |
          cd packages/webui
          yarn build

      - name: Persist Built Version information
        run: |
          cd meteor
          yarn inject-git-hash

      - name: Prepare webui for meteor build
        run: |
          rm -Rf meteor/public
          cp -R packages/webui/dist meteor/public

      - name: Meteor Build
        run: |
          cd meteor
          NODE_OPTIONS="--max-old-space-size=4096" METEOR_DEBUG_BUILD=1 meteor build --allow-superuser --directory .
          mv bundle/programs/web.browser/assets/ bundle/programs/web.browser/app/assets/ || true

      - name: Meteor Bundle NPM Build
        run: |
          cd meteor/bundle/programs/server
          meteor npm install

      - name: Lowercase repository name for GHCR
        run: echo "REPO=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Get the Docker tag for GHCR
        id: ghcr-tag
        uses: docker/metadata-action@v6
        with:
          images: |
            ghcr.io/${{ env.REPO }}-server-core
          tags: |
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
            type=raw,value=build-${{ github.run_number }},enable=${{ github.ref == 'refs/heads/main' }}
            type=ref,event=tag

      - name: Note main build tags
        if: github.ref == 'refs/heads/main'
        run: |
          echo "**Main build published**" >> "$GITHUB_STEP_SUMMARY"
          echo "- \`ghcr.io/${{ env.REPO }}-server-core:latest\`" >> "$GITHUB_STEP_SUMMARY"
          echo "- \`ghcr.io/${{ env.REPO }}-server-core:build-${{ github.run_number }}\`" >> "$GITHUB_STEP_SUMMARY"

      - name: Log in to GitHub Container Registry
        if: steps.ghcr-tag.outputs.tags != ''
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image to GHCR
        if: steps.ghcr-tag.outputs.tags != ''
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./meteor/Dockerfile.circle
          push: true
          provenance: false
          labels: ${{ steps.ghcr-tag.outputs.labels }}
          tags: ${{ steps.ghcr-tag.outputs.tags }}
          github-token: ${{ github.token }}

  build-gateways:
    name: Build and push ${{ matrix.gateway-name }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: verify
    if: needs.verify.outputs.continue == 'true'

    strategy:
      fail-fast: false
      matrix:
        gateway-name: [playout-gateway, mos-gateway, live-status-gateway]

    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: ".node-version"

      - name: Build
        run: |
          corepack enable
          cd packages
          yarn install
          yarn build:single ${{ matrix.gateway-name }}/tsconfig.build.json
          yarn run pinst --disable
          yarn workspaces focus ${{ matrix.gateway-name }} --production

      - name: Lowercase repository name for GHCR
        run: echo "REPO=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Get the Docker tag for GHCR
        id: ghcr-tag
        uses: docker/metadata-action@v6
        with:
          images: |
            ghcr.io/${{ env.REPO }}-${{ matrix.gateway-name }}
          tags: |
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
            type=raw,value=build-${{ github.run_number }},enable=${{ github.ref == 'refs/heads/main' }}
            type=ref,event=tag

      - name: Log in to GitHub Container Registry
        if: steps.ghcr-tag.outputs.tags != ''
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image to GHCR
        if: steps.ghcr-tag.outputs.tags != ''
        uses: docker/build-push-action@v7
        with:
          context: ./packages
          file: ./packages/${{ matrix.gateway-name }}/Dockerfile.circle
          push: true
          provenance: false
          labels: ${{ steps.ghcr-tag.outputs.labels }}
          tags: ${{ steps.ghcr-tag.outputs.tags }}
          github-token: ${{ github.token }}

  release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs:
      - verify
      - build-server-core
      - build-gateways
    if: needs.verify.outputs.continue == 'true' && startsWith(github.ref, 'refs/tags/')

    permissions:
      contents: write

    steps:
      - name: Lowercase repository name for GHCR
        run: echo "REPO=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: Release ${{ github.ref_name }}
          body: |
            Docker images pushed to GHCR:

            ```bash
            docker pull ghcr.io/${{ env.REPO }}-server-core:${{ github.ref_name }}
            docker pull ghcr.io/${{ env.REPO }}-playout-gateway:${{ github.ref_name }}
            docker pull ghcr.io/${{ env.REPO }}-mos-gateway:${{ github.ref_name }}
            docker pull ghcr.io/${{ env.REPO }}-live-status-gateway:${{ github.ref_name }}
            ```

            `latest` continues to track the most recent `main` build.