teploy-arcade/.github/workflows/release.yml at main · useteploy/teploy-arcade · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
name: Release

on:
  push:
    tags: ['v*']

permissions:
  contents: write
  packages: write

jobs:
  # A tag must publish only a verified commit: the release and image jobs used
  # to run independently of every check main enforces, so a tagged commit that
  # failed vet, the race suite or the frontend test shipped anyway.
  verify:
    uses: ./.github/workflows/ci.yml
    permissions:
      contents: read

  release:
    needs: verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'
      - uses: goreleaser/goreleaser-action@v6
        with:
          version: latest
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # DEPLOY.md tells people to run ghcr.io/useteploy/teploy-arcade, and that
  # image has never existed. Either the doc was wrong or this job was missing;
  # this is the half that makes the doc true.
  image:
    needs: verify
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ghcr.io/useteploy/teploy-arcade
          # R69 (audit pass 7): `latest` moves only on stable releases. The
          # old raw rule `enable=!is_prerelease` passed a literal the action's
          # parser rejects (it requires exactly true/false after expression
          # expansion), which threw before ANY tag was produced - stable
          # included. flavor latest=auto is the action's own semver-driven
          # policy: semver tags get latest, prereleases do not.
          flavor: |
            latest=auto
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: VERSION=${{ github.ref_name }}