release-and-publish-images.yml

name: Auto Version + Release

on:
  pull_request_target:
    branches: [main]
    types: [closed]
  workflow_dispatch:

concurrency:
  group: release-main
  cancel-in-progress: false

jobs:
  detect-release-changes:
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true }}
    runs-on: ubuntu-latest
    outputs:
      should_release: ${{ steps.changes.outputs.should_release }}

    steps:
      - name: Detect release-relevant file changes
        id: changes
        uses: actions/github-script@v9
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            if (context.eventName === 'workflow_dispatch') {
              core.setOutput('should_release', 'true')
              return
            }

            const owner = context.repo.owner
            const repo = context.repo.repo
            const pull_number = context.payload.pull_request.number

            const files = await github.paginate(github.rest.pulls.listFiles, {
              owner,
              repo,
              pull_number,
              per_page: 100,
            })

            const ignored = [
              /^\.github\/workflows\//,
              /^docs\//,
              /^README\.md$/,
              /^LICENSE$/,
              /^.*\.md$/,
              /^\.pre-commit-config\.ya?ml$/,
              /^.*\.(ya?ml)$/,
            ]

            const changed = files.map(file => file.filename)
            const releasable = changed.filter(file => !ignored.some(rule => rule.test(file)))

            core.info(`Changed files: ${changed.length}`)
            core.info(`Release-relevant files: ${releasable.length}`)

            core.setOutput('should_release', releasable.length > 0 ? 'true' : 'false')

  manual-approval:
    needs: detect-release-changes
    if: ${{ needs.detect-release-changes.outputs.should_release == 'true' }}
    runs-on: ubuntu-latest
    environment:
      name: release-approval

    steps:
      - name: Await admin approval
        run: echo "Release approved. Continuing to publish steps."

  release:
    needs: [detect-release-changes, manual-approval]
    if: ${{ needs.detect-release-changes.outputs.should_release == 'true' }}
    runs-on: ubuntu-latest
    env:
      IMAGE_NAME: actualtap-py

    steps:
      - name: Check Out Repo
        uses: actions/checkout@v6
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0
          ref: main

      - name: Calculate next version
        id: version
        run: |
          CURRENT_VERSION=$(tr -d '[:space:]' < VERSION)

          if [[ ! "$CURRENT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "VERSION file must be semver (e.g. 1.2.3). Current value: $CURRENT_VERSION"
            exit 1
          fi

          IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT_VERSION"
          NEXT_VERSION="$MAJOR.$MINOR.$((PATCH + 1))"
          NEXT_TAG="v$NEXT_VERSION"

          echo "$NEXT_VERSION" > VERSION

          echo "current_version=$CURRENT_VERSION" >> "$GITHUB_OUTPUT"
          echo "next_version=$NEXT_VERSION" >> "$GITHUB_OUTPUT"
          echo "next_tag=$NEXT_TAG" >> "$GITHUB_OUTPUT"

      - name: Commit version bump
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add VERSION
          git commit -m "chore: bump version to ${{ steps.version.outputs.next_version }}"
          git push origin HEAD:main

      - name: Create and push tag
        run: |
          git tag "${{ steps.version.outputs.next_tag }}"
          git push origin "${{ steps.version.outputs.next_tag }}"

      - name: Check Out tagged commit
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ steps.version.outputs.next_tag }}

      - name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

      - name: Login to ghcr.io
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
        with:
          platforms: all

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and push latest + version
        uses: docker/build-push-action@v7
        with:
          context: ./
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/${{ env.IMAGE_NAME }}:latest
            ${{ secrets.DOCKER_HUB_USERNAME }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.next_tag }}
            ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest
            ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.next_tag }}

      - name: Create GitHub release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ steps.version.outputs.next_tag }}
          target_commitish: main
          generate_release_notes: true
          token: ${{ secrets.GITHUB_TOKEN }}

permissions:
  contents: write
  pull-requests: read
  packages: write