release.yml

# NOTE: backend-ci.yml is intentionally omitted in this fork.
# Keep only the release workflow here unless we explicitly decide to restore CI.
name: Publish GHCR

on:
  push:
    branches:
      - main
    tags:
      - 'v*'

permissions:
  contents: read
  packages: write

concurrency:
  group: publish-ghcr-${{ github.ref }}
  cancel-in-progress: true

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      image: ${{ steps.image.outputs.name }}
      version: ${{ steps.version.outputs.value }}
      build_date: ${{ steps.build_date.outputs.value }}
      tags: ${{ steps.meta.outputs.tags }}
      labels: ${{ steps.meta.outputs.labels }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Normalize image name
        id: image
        shell: bash
        run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"

      - name: Compute build version
        id: version
        shell: bash
        run: |
          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
            VERSION="${GITHUB_REF_NAME#v}"
          else
            BASE_VERSION="$(tr -d '\r\n' < backend/cmd/server/VERSION)"
            SHORT_SHA="${GITHUB_SHA::7}"
            VERSION="${BASE_VERSION}-dev-${SHORT_SHA}"
          fi
          echo "value=${VERSION}" >> "$GITHUB_OUTPUT"

      - name: Compute build date
        id: build_date
        shell: bash
        run: echo "value=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ steps.image.outputs.name }}
          flavor: |
            latest=false
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=ref,event=tag
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}

  build:
    needs: prepare
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-latest
            platform: linux/amd64
            arch: amd64
          - runner: ubuntu-24.04-arm
            platform: linux/arm64
            arch: arm64
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image by digest
        uses: docker/build-push-action@v6
        id: build
        with:
          context: .
          file: ./Dockerfile
          platforms: ${{ matrix.platform }}
          labels: ${{ needs.prepare.outputs.labels }}
          build-args: |
            VERSION=${{ needs.prepare.outputs.version }}
            COMMIT=${{ github.sha }}
            DATE=${{ needs.prepare.outputs.build_date }}
          outputs: type=image,name=${{ needs.prepare.outputs.image }},push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=release-${{ matrix.arch }}
          cache-to: type=gha,mode=max,scope=release-${{ matrix.arch }}

      - name: Export digest
        shell: bash
        run: |
          mkdir -p "${RUNNER_TEMP}/digests"
          digest="${{ steps.build.outputs.digest }}"
          touch "${RUNNER_TEMP}/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ matrix.arch }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    needs:
      - prepare
      - build
    runs-on: ubuntu-latest
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Download digests
        uses: actions/download-artifact@v8
        with:
          pattern: digests-*
          merge-multiple: true
          path: ${{ runner.temp }}/digests

      - name: Create multi-arch manifests
        shell: bash
        env:
          IMAGE_NAME: ${{ needs.prepare.outputs.image }}
          TAGS: ${{ needs.prepare.outputs.tags }}
        run: |
          mapfile -t tags <<< "$TAGS"

          refs=()
          for digest_file in "${RUNNER_TEMP}"/digests/*; do
            refs+=("${IMAGE_NAME}@sha256:$(basename "${digest_file}")")
          done

          tag_args=()
          for tag in "${tags[@]}"; do
            if [ -n "${tag}" ]; then
              tag_args+=("-t" "${tag}")
            fi
          done

          docker buildx imagetools create "${tag_args[@]}" "${refs[@]}"

      - name: Inspect published image
        shell: bash
        env:
          TAGS: ${{ needs.prepare.outputs.tags }}
        run: |
          first_tag="$(printf '%s\n' "$TAGS" | head -n 1)"
          docker buildx imagetools inspect "${first_tag}"