release.yml

name: Release

on:
  push:
    tags:
      - "v*" # Trigger on tags like v1.0.0, v2.1.3, etc.

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  docker:
    name: Build and push Docker image by digest
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up QEMU (for multi-platform builds)
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set build metadata
        id: build_meta
        shell: bash
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PROJECT_NAME: ${{ secrets.DOCKERHUB_PROJECT_NAME }}
        run: |
          image="${DOCKER_USERNAME}/${DOCKERHUB_PROJECT_NAME}"
          version="${GITHUB_REF_NAME#v}"
          {
            echo "image=${image}"
            echo "version=${version}"
            echo "commit=${GITHUB_SHA}"
            echo "date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
          } >> "$GITHUB_OUTPUT"

      - name: Extract Docker labels
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ steps.build_meta.outputs.image }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,name=${{ steps.build_meta.outputs.image }},push-by-digest=true,name-canonical=true,push=true,compression=zstd,compression-level=3,force-compression=true
          build-args: |
            VERSION=${{ steps.build_meta.outputs.version }}
            COMMIT=${{ steps.build_meta.outputs.commit }}
            DATE=${{ steps.build_meta.outputs.date }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  docker-promote:
    name: Promote Docker image tags
    runs-on: ubuntu-latest
    needs: docker
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set Docker image
        id: image_meta
        shell: bash
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PROJECT_NAME: ${{ secrets.DOCKERHUB_PROJECT_NAME }}
        run: echo "image=${DOCKER_USERNAME}/${DOCKERHUB_PROJECT_NAME}" >> "$GITHUB_OUTPUT"

      - name: Detect prerelease tag
        id: release_meta
        shell: bash
        run: |
          version="${GITHUB_REF_NAME#v}"
          if [[ "$version" == *-* ]]; then
            echo "prerelease=true" >> "$GITHUB_OUTPUT"
          else
            echo "prerelease=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Extract final Docker tags
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ steps.image_meta.outputs.image }}
          flavor: |
            latest=false
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ steps.release_meta.outputs.prerelease == 'false' }}

      - name: Promote Docker tags
        shell: bash
        env:
          IMAGE: ${{ steps.image_meta.outputs.image }}
          DIGEST: ${{ needs.docker.outputs.digest }}
          FINAL_TAGS: ${{ steps.meta.outputs.tags }}
        run: |
          if [[ -z "$DIGEST" ]]; then
            echo "Docker build did not produce an image digest" >&2
            exit 1
          fi

          tags=()
          while IFS= read -r tag; do
            [[ -n "$tag" ]] && tags+=("-t" "$tag")
          done <<< "$FINAL_TAGS"

          if [[ "${#tags[@]}" -eq 0 ]]; then
            echo "No Docker tags were generated for promotion" >&2
            exit 1
          fi

          docker buildx imagetools create "${tags[@]}" "${IMAGE}@${DIGEST}"

  goreleaser:
    name: Build draft GitHub release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0 # Required for git history/changelog

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: 1.26.4
          cache: true

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean --draft
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  github-release:
    name: Publish GitHub release
    runs-on: ubuntu-latest
    needs:
      - docker-promote
      - goreleaser
    permissions:
      contents: write
    steps:
      - name: Publish drafted release
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release edit "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --draft=false --verify-tag