release-build.yml

# See LICENSE file in this repo for license details.

name: Release Build

on:
  push:
    tags:
      # Match any semver tag, rely on the workflow steps to apply necessary
      # logic to separate "stable" release builds from "prerelease" builds.
      - "v[0-9]+.[0-9]+.*"

jobs:
  git_describe_semver:
    name: Generate semantic release version using git-describe-semver
    runs-on: ubuntu-latest
    # Default: 360 minutes
    timeout-minutes: 5
    # https://docs.github.com/en/actions/using-jobs/defining-outputs-for-jobs
    outputs:
      version: ${{ steps.git-describe-semver.outputs.version }}

    steps:
      - name: Print Docker version
        run: docker --version

      - name: Clone repo with full history
        uses: actions/checkout@v4
        with:
          # Needed in order to retrieve tags for use with semver calculations
          fetch-depth: 0

      # Mark the current working directory as a safe directory in git to
      # resolve "dubious ownership" complaints.
      #
      # https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables
      # https://confluence.atlassian.com/bbkb/git-command-returns-fatal-error-about-the-repository-being-owned-by-someone-else-1167744132.html
      # https://github.com/actions/runner-images/issues/6775
      # https://github.com/actions/checkout/issues/766
      - name: Mark the current working directory as a safe directory in git
        # run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
        run: git config --global --add safe.directory "${PWD}"

      # NOTE: See build-images.yml for other potential approaches.
      #
      # https://github.com/choffmeister/git-describe-semver/pkgs/container/git-describe-semver
      # https://github.com/choffmeister/git-describe-semver/blob/v0.3.11/action.yaml
      # https://github.com/choffmeister/git-describe-semver/blob/v0.4.0/action.yaml
      # https://github.com/choffmeister/git-describe-semver/issues/8
      - name: Record semantic version using git-describe-semver
        uses: docker://ghcr.io/choffmeister/git-describe-semver:0.3.11
        id: git-describe-semver
        with:
          args: >-
            --fallback="v0.0.0"
            --drop-prefix=false
            --prerelease-prefix="dev"
            --prerelease-suffix=""
            --prerelease-timestamped="false"
            --format="version=<version>"
            $GITHUB_OUTPUT

      - name: Print semantic version generated by git-describe-semver
        run: |
          echo "${{ steps.git-describe-semver.outputs.version }}"

  build_and_upload_mirror_images:
    name: Build and upload mirror container images
    needs: git_describe_semver

    # https://docs.github.com/en/actions/security-guides/automatic-token-authentication
    permissions:
      contents: write
      discussions: write
      packages: write

    if: startsWith(github.ref, 'refs/tags')

    runs-on: ubuntu-latest
    # Default: 360 minutes
    timeout-minutes: 45

    steps:
      - name: Log tag info
        run: |
          echo "Ref type: ${{ github.ref_type }}"
          echo "Ref name: ${{ github.ref_name }}"
          echo "Ref full: ${{ github.ref }}"
          echo "Commit SHA: ${{ github.sha }}"

      - name: Check out code with default settings
        uses: actions/checkout@v4

      # Mark the current working directory as a safe directory in git to
      # resolve "dubious ownership" complaints.
      #
      # https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables
      # https://confluence.atlassian.com/bbkb/git-command-returns-fatal-error-about-the-repository-being-owned-by-someone-else-1167744132.html
      # https://github.com/actions/runner-images/issues/6775
      # https://github.com/actions/checkout/issues/766
      - name: Mark the current working directory as a safe directory in git
        # run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
        run: git config --global --add safe.directory "${PWD}"

      # bsdmainutils provides "column" which is used by the Makefile
      - name: Install Ubuntu packages
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends make gcc bsdmainutils

      - name: Build mirror images
        env:
            REPO_VERSION: ${{ needs.git_describe_semver.outputs.version }}
        run: |
          make build-mirror-images

      - name: List generated Docker images
        run: docker image ls --filter "label=atc0005.go-ci" --format "table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.Size}}"

      - name: Upload mirror images
        env:
            REPO_VERSION: ${{ needs.git_describe_semver.outputs.version }}

            # https://docs.github.com/en/actions/security-guides/encrypted-secrets#using-encrypted-secrets-in-a-workflow
            DH_TOKEN: ${{ secrets.DOCKERHUB }}
            GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          make upload-mirror-images

  build_and_upload_alpine_images:
    name: Build and upload Alpine container images
    needs: git_describe_semver

    # https://docs.github.com/en/actions/security-guides/automatic-token-authentication
    permissions:
      contents: write
      discussions: write
      packages: write

    if: startsWith(github.ref, 'refs/tags')

    runs-on: ubuntu-latest
    # Default: 360 minutes
    timeout-minutes: 45

    steps:
      - name: Log tag info
        run: |
          echo "Ref type: ${{ github.ref_type }}"
          echo "Ref name: ${{ github.ref_name }}"
          echo "Ref full: ${{ github.ref }}"
          echo "Commit SHA: ${{ github.sha }}"

      - name: Check out code with default settings
        uses: actions/checkout@v4

      # Mark the current working directory as a safe directory in git to
      # resolve "dubious ownership" complaints.
      #
      # https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables
      # https://confluence.atlassian.com/bbkb/git-command-returns-fatal-error-about-the-repository-being-owned-by-someone-else-1167744132.html
      # https://github.com/actions/runner-images/issues/6775
      # https://github.com/actions/checkout/issues/766
      - name: Mark the current working directory as a safe directory in git
        # run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
        run: git config --global --add safe.directory "${PWD}"

      # bsdmainutils provides "column" which is used by the Makefile
      - name: Install Ubuntu packages
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends make gcc bsdmainutils

      - name: Build Alpine images
        env:
            REPO_VERSION: ${{ needs.git_describe_semver.outputs.version }}
        run: |
          make build-alpine-images

      - name: List generated Docker images
        run: docker image ls --filter "label=atc0005.go-ci" --format "table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.Size}}"

      - name: Upload alpine images
        env:
            REPO_VERSION: ${{ needs.git_describe_semver.outputs.version }}

            # https://docs.github.com/en/actions/security-guides/encrypted-secrets#using-encrypted-secrets-in-a-workflow
            DH_TOKEN: ${{ secrets.DOCKERHUB }}
            GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          make upload-alpine-images

  build_and_upload_mingw_images:
    name: Build and upload mingw-w64 container images
    needs: git_describe_semver

    # https://docs.github.com/en/actions/security-guides/automatic-token-authentication
    permissions:
      contents: write
      discussions: write
      packages: write

    if: startsWith(github.ref, 'refs/tags')

    runs-on: ubuntu-latest
    # Default: 360 minutes
    timeout-minutes: 45

    steps:
      - name: Log tag info
        run: |
          echo "Ref type: ${{ github.ref_type }}"
          echo "Ref name: ${{ github.ref_name }}"
          echo "Ref full: ${{ github.ref }}"
          echo "Commit SHA: ${{ github.sha }}"

      - name: Check out code with default settings
        uses: actions/checkout@v4

      # Mark the current working directory as a safe directory in git to
      # resolve "dubious ownership" complaints.
      #
      # https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables
      # https://confluence.atlassian.com/bbkb/git-command-returns-fatal-error-about-the-repository-being-owned-by-someone-else-1167744132.html
      # https://github.com/actions/runner-images/issues/6775
      # https://github.com/actions/checkout/issues/766
      - name: Mark the current working directory as a safe directory in git
        # run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
        run: git config --global --add safe.directory "${PWD}"

      # bsdmainutils provides "column" which is used by the Makefile
      - name: Install Ubuntu packages
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends make gcc bsdmainutils

      - name: Build mingw-w64 images
        env:
            REPO_VERSION: ${{ needs.git_describe_semver.outputs.version }}
        run: |
          make build-mingw-images

      - name: List generated Docker images
        run: docker image ls --filter "label=atc0005.go-ci" --format "table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.Size}}"

      - name: Upload mingw images
        env:
            REPO_VERSION: ${{ needs.git_describe_semver.outputs.version }}

            # https://docs.github.com/en/actions/security-guides/encrypted-secrets#using-encrypted-secrets-in-a-workflow
            DH_TOKEN: ${{ secrets.DOCKERHUB }}
            GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          make upload-mingw-images

  build_and_upload_standard_images:
    name: Build and upload standard container images
    needs: git_describe_semver

    # https://docs.github.com/en/actions/security-guides/automatic-token-authentication
    permissions:
      contents: write
      discussions: write
      packages: write

    if: startsWith(github.ref, 'refs/tags')

    runs-on: ubuntu-latest
    # Default: 360 minutes
    timeout-minutes: 45

    steps:
      - name: Log tag info
        run: |
          echo "Ref type: ${{ github.ref_type }}"
          echo "Ref name: ${{ github.ref_name }}"
          echo "Ref full: ${{ github.ref }}"
          echo "Commit SHA: ${{ github.sha }}"

      - name: Check out code with default settings
        uses: actions/checkout@v4

      # Mark the current working directory as a safe directory in git to
      # resolve "dubious ownership" complaints.
      #
      # https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables
      # https://confluence.atlassian.com/bbkb/git-command-returns-fatal-error-about-the-repository-being-owned-by-someone-else-1167744132.html
      # https://github.com/actions/runner-images/issues/6775
      # https://github.com/actions/checkout/issues/766
      - name: Mark the current working directory as a safe directory in git
        # run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
        run: git config --global --add safe.directory "${PWD}"

      # bsdmainutils provides "column" which is used by the Makefile
      - name: Install Ubuntu packages
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends make gcc bsdmainutils

      - name: Build standard images
        env:
            REPO_VERSION: ${{ needs.git_describe_semver.outputs.version }}
        run: |
          make build-standard-images

      - name: List generated Docker images
        run: docker image ls --filter "label=atc0005.go-ci" --format "table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.Size}}"

      - name: Upload standard images
        env:
            REPO_VERSION: ${{ needs.git_describe_semver.outputs.version }}

            # https://docs.github.com/en/actions/security-guides/encrypted-secrets#using-encrypted-secrets-in-a-workflow
            DH_TOKEN: ${{ secrets.DOCKERHUB }}
            GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          make upload-standard-images

  create_release:
    name: Create GitHub Release
    needs:
      - git_describe_semver
      - build_and_upload_mirror_images
      - build_and_upload_alpine_images
      - build_and_upload_mingw_images
      - build_and_upload_standard_images

    # https://docs.github.com/en/actions/security-guides/automatic-token-authentication
    permissions:
      contents: write
      discussions: write
      packages: write

    if: startsWith(github.ref, 'refs/tags')

    runs-on: ubuntu-latest
    # Default: 360 minutes
    timeout-minutes: 45

    steps:
      - name: Log tag info
        run: |
          echo "Ref type: ${{ github.ref_type }}"
          echo "Ref name: ${{ github.ref_name }}"
          echo "Ref full: ${{ github.ref }}"
          echo "Commit SHA: ${{ github.sha }}"

      - name: Check out code with default settings
        uses: actions/checkout@v4

      # Mark the current working directory as a safe directory in git to
      # resolve "dubious ownership" complaints.
      #
      # https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables
      # https://confluence.atlassian.com/bbkb/git-command-returns-fatal-error-about-the-repository-being-owned-by-someone-else-1167744132.html
      # https://github.com/actions/runner-images/issues/6775
      # https://github.com/actions/checkout/issues/766
      - name: Mark the current working directory as a safe directory in git
        # run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
        run: git config --global --add safe.directory "${PWD}"

      - name: Generate pre-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

        if: contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') || contains(github.ref_name, 'rc')
        run: |
          echo Generating pre-release

          gh release create ${{ github.ref_name }} \
            --verify-tag \
            --prerelease \
            --discussion-category 'Dev/Release Candidate' \
            --generate-notes

      - name: Generate stable release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

        # https://github.com/orgs/community/discussions/26712
        if: ${{ !(contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') || contains(github.ref_name, 'rc')) }}
        run: |
          echo Generating stable release

          gh release create ${{ github.ref_name }} \
            --verify-tag \
            --latest \
            --discussion-category 'Stable Release' \
            --generate-notes