release.yml

name: Release & Docker Build

on:
  push:
    branches:
      - main
      - develop
    tags:
      - 'v*'

# Prevent concurrent builds on the same branch
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository_owner }}/streamvault

jobs:
  # Run tests first as a gate
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
      
      - name: Set up Python 3.14
        uses: actions/setup-python@v6
        with:
          python-version: '3.14'
          cache: 'pip'
          
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install pytest pytest-asyncio httpx

      - name: Run pytest
        run: pytest tests/ -v --tb=short
          
      - name: Check migrations
        run: python -m app.migrations_init

  prepare:
    needs: [test]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    outputs:
      version: ${{ steps.version.outputs.version }}
      is_prerelease: ${{ steps.version.outputs.is_prerelease }}
      release_tag: ${{ steps.version.outputs.release_tag }}
      docker_tags: ${{ steps.docker_meta.outputs.tags }}
      docker_labels: ${{ steps.docker_meta.outputs.labels }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Determine version
        id: version
        run: |
          if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
            # Manual tag push - use the tag version directly
            VERSION=${GITHUB_REF#refs/tags/v}
            if [[ "$VERSION" == *-dev* ]] || [[ "$VERSION" == dev.* ]]; then
              IS_PRERELEASE=true
              RELEASE_TAG=${GITHUB_REF#refs/tags/}
            else
              IS_PRERELEASE=false
              RELEASE_TAG=${GITHUB_REF#refs/tags/}
            fi
          else
            # Auto-version: find highest version across ALL tags (dev + stable)
            HIGHEST_TAG=""
            HIGHEST_MAJOR=0
            HIGHEST_MINOR=0
            HIGHEST_PATCH=0
            
            for tag in $(git tag -l 'v*'); do
              ver="$tag"
              ver="${ver#v}"
              ver="${ver#dev.}"
              ver="${ver%%-dev*}"
              
              M=$(echo "$ver" | cut -d. -f1)
              m=$(echo "$ver" | cut -d. -f2)
              P=$(echo "$ver" | cut -d. -f3)
              
              [[ "$M" =~ ^[0-9]+$ ]] || continue
              [[ "$m" =~ ^[0-9]+$ ]] || continue
              [[ "$P" =~ ^[0-9]+$ ]] || continue
              
              if (( M > HIGHEST_MAJOR )) || \
                 (( M == HIGHEST_MAJOR && m > HIGHEST_MINOR )) || \
                 (( M == HIGHEST_MAJOR && m == HIGHEST_MINOR && P > HIGHEST_PATCH )); then
                HIGHEST_MAJOR=$M
                HIGHEST_MINOR=$m
                HIGHEST_PATCH=$P
                HIGHEST_TAG="$tag"
              fi
            done
            
            echo "Highest existing version: ${HIGHEST_MAJOR}.${HIGHEST_MINOR}.${HIGHEST_PATCH} (tag: ${HIGHEST_TAG:-none})"
            
            # Analyze commits since last tag for conventional commit bump type
            BUMP="patch"
            if [ -n "$HIGHEST_TAG" ]; then
              COMMITS=$(git log "${HIGHEST_TAG}..HEAD" --pretty=format:"%s%n%b" 2>/dev/null || echo "")
            else
              COMMITS=$(git log --pretty=format:"%s%n%b" 2>/dev/null || echo "")
            fi
            
            if echo "$COMMITS" | grep -qiE '(^[a-z]+!:|BREAKING CHANGE)'; then
              BUMP="major"
            elif echo "$COMMITS" | grep -qiE '^feat(\(|:)'; then
              BUMP="minor"
            fi
            
            echo "Bump type: $BUMP"
            
            case "$BUMP" in
              major)
                NEXT_MAJOR=$((HIGHEST_MAJOR + 1))
                NEXT_MINOR=0
                NEXT_PATCH=0
                ;;
              minor)
                NEXT_MAJOR=$HIGHEST_MAJOR
                NEXT_MINOR=$((HIGHEST_MINOR + 1))
                NEXT_PATCH=0
                ;;
              patch)
                NEXT_MAJOR=$HIGHEST_MAJOR
                NEXT_MINOR=$HIGHEST_MINOR
                NEXT_PATCH=$((HIGHEST_PATCH + 1))
                ;;
            esac
            
            VERSION="${NEXT_MAJOR}.${NEXT_MINOR}.${NEXT_PATCH}"
            
            if [[ "${{ github.ref }}" == refs/heads/main ]]; then
              IS_PRERELEASE=false
              RELEASE_TAG="v${VERSION}"
            else
              VERSION="${VERSION}-dev"
              IS_PRERELEASE=true
              RELEASE_TAG="v${VERSION}"
            fi
          fi
          
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          echo "is_prerelease=${IS_PRERELEASE}" >> $GITHUB_OUTPUT
          echo "release_tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
          echo "Version: ${VERSION}, Prerelease: ${IS_PRERELEASE}, Tag: ${RELEASE_TAG}"

      - name: Docker metadata
        id: docker_meta
        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
            frequency2098/streamvault
          tags: |
            # For tagged releases
            type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, 'dev') }}
            type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, 'dev') }}
            type=semver,pattern={{major}},enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, 'dev') }}
            # For main branch
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
            type=raw,value=stable,enable=${{ github.ref == 'refs/heads/main' }}
            type=raw,value=${{ steps.version.outputs.version }},enable=${{ github.ref == 'refs/heads/main' }}
            # For develop branch
            type=raw,value=dev,enable=${{ github.ref == 'refs/heads/develop' }}
            type=raw,value=develop,enable=${{ github.ref == 'refs/heads/develop' }}
            type=raw,value=${{ steps.version.outputs.version }},enable=${{ github.ref == 'refs/heads/develop' }}
            # SHA for all
            type=sha,prefix=sha-

  build-and-push:
    needs: prepare
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      # Setup Node.js with caching for frontend build
      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'npm'
          cache-dependency-path: 'app/frontend/package-lock.json'

      - name: Cache frontend build
        id: frontend-cache
        uses: actions/cache@v5
        with:
          path: |
            app/frontend/dist
            app/frontend/node_modules
          key: frontend-build-${{ hashFiles('app/frontend/package-lock.json', 'app/frontend/src/**') }}
          restore-keys: |
            frontend-build-

      - name: Build Frontend
        if: steps.frontend-cache.outputs.cache-hit != 'true'
        working-directory: app/frontend
        run: |
          npm ci
          rm -rf dist || true
          npm run build

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to DockerHub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/Dockerfile
          platforms: linux/amd64
          push: true
          tags: ${{ needs.prepare.outputs.docker_tags }}
          labels: ${{ needs.prepare.outputs.docker_labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=${{ needs.prepare.outputs.version }}
            COMMIT_SHA=${{ github.sha }}
            BRANCH=${{ github.ref_name }}

      # Security scanning
      - name: Set lowercase image name
        id: image_name
        run: |
          IMAGE_TAG="${{ github.ref == 'refs/heads/main' && 'latest' || 'dev' }}"
          echo "tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT
          echo "full_ref=${{ env.REGISTRY }}/${IMAGE_NAME,,}:${IMAGE_TAG}" >> $GITHUB_OUTPUT
        env:
          IMAGE_NAME: ${{ github.repository_owner }}/streamvault

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        env:
          TRIVY_DB_REPOSITORY: 'ghcr.io/aquasecurity/trivy-db:2'
          TRIVY_JAVA_DB_REPOSITORY: 'ghcr.io/aquasecurity/trivy-java-db:1'
        with:
          image-ref: ${{ steps.image_name.outputs.full_ref }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '0'
        continue-on-error: true

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v4
        if: always() && hashFiles('trivy-results.sarif') != ''
        with:
          sarif_file: 'trivy-results.sarif'
          category: 'trivy-container'

  create-release:
    needs: [prepare, build-and-push]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    # Create releases for tags, develop and main branch pushes
    if: startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Generate Changelog
        id: changelog
        run: |
          # Install git-cliff
          curl -sSL https://github.com/orhun/git-cliff/releases/download/v2.11.0/git-cliff-2.11.0-x86_64-unknown-linux-gnu.tar.gz | tar -xz
          chmod +x git-cliff-2.11.0/git-cliff
          
          # Get the previous tag for comparison
          CURRENT_VERSION="${{ needs.prepare.outputs.version }}"
          BRANCH="${{ github.ref_name }}"
          
          # Find the last tag for changelog comparison
          if [[ "$BRANCH" == "develop" ]]; then
            LAST_TAG=$(git tag -l --sort=-creatordate | grep -E '(^vdev\.|.*-dev$)' | head -n1 || echo "")
            echo "Looking for dev tags"
          else
            LAST_TAG=$(git tag -l 'v*' --sort=-version:refname | grep -vE '(^vdev\.|.*-dev$)' | head -n1 || echo "")
            echo "Looking for stable tags"
          fi
          
          echo "Branch: $BRANCH"
          echo "Current version: $CURRENT_VERSION"
          echo "Last tag found: $LAST_TAG"
          
          if [ -n "$LAST_TAG" ]; then
            echo "Generating changelog from $LAST_TAG to HEAD..."
            ./git-cliff-2.11.0/git-cliff "$LAST_TAG"..HEAD --strip header > CHANGELOG_CONTENT.md 2>/dev/null || true
          else
            echo "No previous tags found, generating from recent commits..."
            ./git-cliff-2.11.0/git-cliff --strip header > CHANGELOG_CONTENT.md 2>/dev/null || true
          fi
          
          # Check if changelog has content
          if [ -s CHANGELOG_CONTENT.md ]; then
            echo "Changelog generated successfully"
            CONTENT=$(cat CHANGELOG_CONTENT.md | sed '/^## \[/d' | sed '/^$/N;/^\n$/d')
            echo "content<<EOF" >> $GITHUB_OUTPUT
            echo "$CONTENT" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
          else
            echo "No changelog content, using git log..."
            if [ -n "$LAST_TAG" ]; then
              COMMITS=$(git log "$LAST_TAG"..HEAD --pretty=format:"- %s" --no-merges 2>/dev/null || echo "")
            else
              COMMITS=$(git log --pretty=format:"- %s" --no-merges -20 2>/dev/null || echo "")
            fi
            
            if [ -n "$COMMITS" ]; then
              echo "content<<EOF" >> $GITHUB_OUTPUT
              echo "### Changes" >> $GITHUB_OUTPUT
              echo "" >> $GITHUB_OUTPUT
              echo "$COMMITS" >> $GITHUB_OUTPUT
              echo "EOF" >> $GITHUB_OUTPUT
            else
              echo "content=No changes recorded for this release." >> $GITHUB_OUTPUT
            fi
          fi

      - name: Create release notes
        id: notes
        env:
          CHANGELOG_CONTENT: ${{ steps.changelog.outputs.content }}
          VERSION: ${{ needs.prepare.outputs.version }}
          REPO_OWNER: ${{ github.repository_owner }}
          REPO: ${{ github.repository }}
        run: |
          cat > release_notes.md << EOF
          ## What's Changed in ${VERSION}
          
          EOF
          
          if [ -n "$CHANGELOG_CONTENT" ]; then
            echo "$CHANGELOG_CONTENT" | sed '/^## \[/d' >> release_notes.md
          else
            echo "No changelog entries for this release." >> release_notes.md
          fi
          
          cat >> release_notes.md << EOF
          
          ---
          
          ## 🐳 Docker Images
          
          This release is available as multi-architecture Docker images (amd64, arm64):
          
          ### Pull the image:
          \`\`\`bash
          # Specific version
          docker pull ghcr.io/${REPO_OWNER}/streamvault:${VERSION}
          docker pull frequency2098/streamvault:${VERSION}
          
          # Or latest stable (main branch)
          docker pull ghcr.io/${REPO_OWNER}/streamvault:latest
          docker pull frequency2098/streamvault:latest
          
          # Or development (develop branch)
          docker pull ghcr.io/${REPO_OWNER}/streamvault:dev
          docker pull frequency2098/streamvault:dev
          \`\`\`
          
          ### Run with Docker Compose:
          \`\`\`bash
          # Download docker-compose.yml
          curl -O https://raw.githubusercontent.com/${REPO}/main/docker/docker-compose.yml
          
          # Start services
          docker compose up -d
          \`\`\`
          
          ## Registry Information
          
          | Property | Value |
          |----------|-------|
          | GitHub Registry | \`ghcr.io/${REPO_OWNER}/streamvault\` |
          | DockerHub | \`frequency2098/streamvault\` |
          | Version | \`${VERSION}\` |
          | Architectures | linux/amd64, linux/arm64 |
          
          ## Documentation
          
          See the [README.md](https://github.com/${REPO}/blob/main/README.md) for full configuration options.
          EOF
          
          echo "Release notes created"
          cat release_notes.md

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ needs.prepare.outputs.release_tag }}
          target_commitish: ${{ github.sha }}
          name: ${{ needs.prepare.outputs.is_prerelease == 'true' && format('Development Build {0}', needs.prepare.outputs.version) || format('StreamVault {0}', needs.prepare.outputs.version) }}
          body_path: release_notes.md
          draft: false
          prerelease: ${{ needs.prepare.outputs.is_prerelease }}
          make_latest: ${{ github.ref == 'refs/heads/main' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}