CS-LinkStack/.github/workflows/docker-release.yml at main · bauer-group/CS-LinkStack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
name: 🚀 Release & Docker Build

on:
  push:
    branches: [main]
    paths-ignore:
      - '.github/**'
      - '*.md'
      - 'docs/**'
  pull_request:
    branches: [main]
    paths:
      - 'app/**'
      - 'docker-compose*.yml'
      - '.env.example'
  workflow_dispatch:
    inputs:
      force-release:
        description: 'force create release'
        type: boolean
        default: false

permissions:
  contents: write
  issues: write
  pull-requests: write
  packages: write
  security-events: write
  attestations: write
  id-token: write
  actions: read

jobs:
  # ============================================
  # Validation Jobs
  # ============================================

  validate-compose:
    name: 🔍 Validate Docker Compose
    uses: bauer-group/automation-templates/.github/workflows/modules-validate-compose.yml@main
    with:
      compose-files: '["docker-compose.coolify.yml", "docker-compose.traefik.yml", "docker-compose.development.yml"]'
      env-file: '.env.example'
      validate-services: '["linkstack"]'

  # ============================================
  # Release Job (only on main branch push)
  # ============================================

  release:
    name: 📦 Create Semantic Release
    needs: [validate-compose]
    if: |
      (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
      needs.validate-compose.result == 'success'
    uses: bauer-group/automation-templates/.github/workflows/modules-semantic-release.yml@main
    with:
      target-branch: 'main'
      dry-run: false
      force-release: ${{ inputs.force-release || false }}
    secrets: inherit

  # ============================================
  # Docker Build & Push (linkstack)
  # ============================================

  docker-build-linkstack-release:
    name: 🐳 Build & Push linkstack
    needs: release
    if: needs.release.outputs.release-created == 'true'
    uses: bauer-group/automation-templates/.github/workflows/docker-build.yml@main
    with:
      deploy-environment: 'production'
      publish-to: 'ghcr'
      ghcr-image-name: 'bauer-group/CS-LinkStack/linkstack'
      docker-image-name: 'bauergroup/cs-linkstack'

      release-version: ${{ needs.release.outputs.version }}
      image-tags: 'stable'

      update-dockerfile-version: true
      auto-tags: true
      latest-tag: true

      dockerfile-path: './app/linkstack/Dockerfile'
      docker-context: './app/linkstack'
      platforms: 'linux/amd64,linux/arm64'

      push: true

      security-scan: false
      security-fail-on: 'CRITICAL'
      generate-sbom: true
      sync-dockerhub-readme: true
    secrets: inherit

  docker-build-linkstack-pr:
    name: 🔨 Validate linkstack Build (PR)
    needs: [validate-compose]
    if: |
      github.event_name == 'pull_request' &&
      needs.validate-compose.result == 'success'
    uses: bauer-group/automation-templates/.github/workflows/docker-build.yml@main
    with:
      publish-to: 'ghcr'
      ghcr-image-name: 'bauer-group/CS-LinkStack/linkstack'

      auto-tags: true
      dockerfile-path: './app/linkstack/Dockerfile'
      docker-context: './app/linkstack'
      platforms: 'linux/amd64,linux/arm64'

      push: false

      security-scan: false
      security-fail-on: 'CRITICAL'
    secrets: inherit