publish.yml

name: Release CSI image
on:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: publish-${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

env:
  CONTAINER_REGISTRY: ghcr.io
  VERSION: ${{ github.ref_name == 'main' && 'latest-edge' || github.ref_name }}

jobs:
  # Precheck job checks whether the CSI image (and Helm chart) publishing is required, and
  # whether a new GitHub release should be created.
  # The image/chart are published as "latest-edge" on each push to main branch.
  # If the GitHub release matching the version in "VERSION" file does not exist yet,
  # a new release is created.
  precheck:
    runs-on: ubuntu-24.04
    outputs:
      versions: ${{ steps.read.outputs.versions }}
      release: ${{ steps.read.outputs.release }}
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Determine versions to be published
        id: read
        shell: bash
        env:
          # Set GH_TOKEN to authenticate "gh" CLI.
          GH_TOKEN: ${{ github.token }}
        run: |
          set -e
          release=""   # GitHub release name.
          versions=""  # CSI image and chart tags.

          # Latest release only on the main branch.
          if [ "${{ github.ref_name }}" = "main" ]; then
            versions="${versions} latest-edge"
          fi

          # Read and validate current version.
          version=$(cat VERSION)
          if [[ ! "${version}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Error: Invalid version '${version}' in VERSION file. It must be a semantic version prefixed with 'v'."
            exit 1
          fi

          # Check if the version already exists.
          # If it does not exist, add versions that need to be published to the list.
          foundRelease=$(gh release list -R ${{ github.repository }} --json tagName --jq ".[] | select(.tagName == \"${version}\").tagName")
          if [ "${foundRelease}" = "" ]; then
            release="${version}"
            versions="${versions} ${version}"      # Example: v1.2.3
            versions="${versions} ${version%.*}"   # Example: v1.2
            versions="${versions} ${version%%.*}"  # Example: v1
          fi

          # Trim potential surrounding whitespace.
          versions=$(echo "$versions" | xargs)

          # Output versions for publishing.
          echo "versions=${versions}" >> "$GITHUB_OUTPUT"
          echo "release=${release}" >> "$GITHUB_OUTPUT"

      - name: Output versions
        run: |
          echo "Versions to be published: ${{ steps.read.outputs.versions }}"
          echo "Release version: ${{ steps.read.outputs.release }}"

  tests:
    needs:
      - precheck
    permissions:
      contents: read
    uses: ./.github/workflows/tests.yml

  e2e-tests:
    uses: ./.github/workflows/e2e-tests.yml
    needs:
      - precheck
      - tests

  # Publish container image to GHCR if tests passed and we are on main branch.
  publish:
    if: ${{ github.repository == 'canonical/lxd-csi-driver' && needs.precheck.outputs.versions != '' }}
    needs:
      - precheck
      - e2e-tests
    runs-on: ubuntu-24.04
    permissions:
      contents: write # Required for creating releases.
      packages: write # Required for publishing to GHCR.
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: 'go.mod'

      - name: Build image and create image tags
        id: image
        run: |
          set -e
          make build

          tags=""
          for version in ${{ needs.precheck.outputs.versions }}; do
            tags=${tags},${{ env.CONTAINER_REGISTRY }}/${{ github.repository }}:${version}
          done

          # Output tags with leading comma removed.
          echo "tags=${tags#,}" >> "$GITHUB_OUTPUT"

      - name: Log in to the container registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.CONTAINER_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Build and push Docker image
        id: push
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          push: true
          tags: ${{ steps.image.outputs.tags }}

      - name: Log in to the Helm registry
        run: |
          set -e
          echo "${{ github.token }}" \
            | helm registry login "${{ env.CONTAINER_REGISTRY }}" \
              --username "${{ github.actor }}" \
              --password-stdin

      - name: Publish new Chart
        run: |
          set -e
          for version in ${{ needs.precheck.outputs.versions }}; do
            chartVersion="${version}"

            # If the version does not start with an integer (prefix 'v' is optional),
            # we prefix Chart version with 'v0-' prefix to satisfy Helm chart version constraints.
            if [[ ! "${version}" =~ ^v?[0-9] ]]; then
              chartVersion="v0-${version}"
            fi

            helm package charts --version "${chartVersion}" --app-version "${version}"
            helm push "lxd-csi-driver-${chartVersion}.tgz" "oci://${{ env.CONTAINER_REGISTRY }}/${{ github.repository_owner }}/charts"
          done

      - name: Make a release
        uses: softprops/action-gh-release@v3
        if: ${{ needs.precheck.outputs.release != '' }}
        with:
          name: ${{ needs.precheck.outputs.release }}
          tag_name: ${{ needs.precheck.outputs.release }}
          generate_release_notes: true
          draft: false