publish-container.yml

name: Publish container

on:
  release:
    types:
      - published
  workflow_dispatch:
    inputs:
      version:
        description: Version without the v prefix; must match pyproject.toml
        required: true
        default: 0.1.0
        type: string
      publish:
        description: Push the tested image to GHCR
        required: true
        default: false
        type: boolean
      publish_latest:
        description: Also update the latest tag
        required: true
        default: false
        type: boolean

permissions:
  contents: read

concurrency:
  group: publish-container-${{ github.event.release.tag_name || inputs.version || github.run_id }}
  cancel-in-progress: false

jobs:
  prepare:
    name: Validate release metadata
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      version: ${{ steps.release.outputs.version }}
      series: ${{ steps.release.outputs.series }}
      publish: ${{ steps.release.outputs.publish }}
      publish_latest: ${{ steps.release.outputs.publish_latest }}
    steps:
      - name: Check out repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Validate version and trigger
        id: release
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          RELEASE_PRERELEASE: ${{ github.event.release.prerelease }}
          INPUT_VERSION: ${{ inputs.version }}
          INPUT_PUBLISH: ${{ inputs.publish }}
          INPUT_PUBLISH_LATEST: ${{ inputs.publish_latest }}
        run: |
          set -euo pipefail

          if [[ "${EVENT_NAME}" == "release" ]]; then
            version="${RELEASE_TAG#v}"
            publish=true
            if [[ "${RELEASE_PRERELEASE}" == "true" ]]; then
              publish_latest=false
            else
              publish_latest=true
            fi
          else
            version="${INPUT_VERSION#v}"
            publish="${INPUT_PUBLISH}"
            publish_latest="${INPUT_PUBLISH_LATEST}"
          fi

          if [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Version must use stable SemVer X.Y.Z: ${version}" >&2
            exit 1
          fi

          project_version=$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')
          if [[ "${version}" != "${project_version}" ]]; then
            echo "Release version ${version} does not match pyproject.toml ${project_version}" >&2
            exit 1
          fi

          if [[ "${publish_latest}" == "true" && "${publish}" != "true" ]]; then
            echo "publish_latest requires publish=true" >&2
            exit 1
          fi

          echo "version=${version}" >> "${GITHUB_OUTPUT}"
          echo "series=${version%.*}" >> "${GITHUB_OUTPUT}"
          echo "publish=${publish}" >> "${GITHUB_OUTPUT}"
          echo "publish_latest=${publish_latest}" >> "${GITHUB_OUTPUT}"

  tests:
    name: Python tests
    needs: prepare
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Check out repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
        with:
          version: 0.11.19
          enable-cache: true
          cache-dependency-glob: uv.lock

      - name: Install Python 3.13
        run: uv python install 3.13

      - name: Install locked dependencies
        run: uv sync --frozen --dev

      - name: Validate and test
        run: |
          uv lock --check
          uv run python -m compileall -q main.py src scripts
          uv run pytest -q

  smoke:
    name: Smoke test (${{ matrix.platform }})
    needs:
      - prepare
      - tests
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            arch: amd64
          - platform: linux/arm64
            arch: arm64
    steps:
      - name: Check out repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Build smoke-test image
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          load: true
          platforms: ${{ matrix.platform }}
          push: false
          tags: al1s:smoke-${{ matrix.arch }}
          build-args: AL1S_VERSION=${{ needs.prepare.outputs.version }}
          cache-from: type=gha,scope=smoke-${{ matrix.arch }}
          cache-to: type=gha,mode=max,scope=smoke-${{ matrix.arch }}

      - name: Run image smoke test
        run: docker run --rm --platform ${{ matrix.platform }} al1s:smoke-${{ matrix.arch }} python scripts/container_healthcheck.py --smoke

  publish:
    name: Publish multi-platform image
    needs:
      - prepare
      - smoke
    if: needs.prepare.outputs.publish == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    permissions:
      contents: read
      packages: write
    steps:
      - name: Check out repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Log in to GHCR
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate image metadata
        id: metadata
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        with:
          images: ghcr.io/scu-maker-org/al1s
          tags: |
            type=raw,value=${{ needs.prepare.outputs.version }}
            type=raw,value=${{ needs.prepare.outputs.series }}
            type=raw,value=latest,enable=${{ needs.prepare.outputs.publish_latest }}

      - name: Build and publish image
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.metadata.outputs.tags }}
          labels: ${{ steps.metadata.outputs.labels }}
          build-args: AL1S_VERSION=${{ needs.prepare.outputs.version }}
          cache-from: |
            type=gha,scope=smoke-amd64
            type=gha,scope=smoke-arm64
          cache-to: type=gha,mode=max,scope=publish-multiarch
          provenance: mode=max
          sbom: true