release.yml

name: "Release"
on:
  workflow_call:
  workflow_dispatch:
defaults:
  run:
    shell: bash
permissions:
  contents: write
  packages: write


jobs:

  release-guard:
    name: "Check release condition"
    runs-on: ubuntu-latest
    outputs:
      RELEASE_VERSION: ${{ steps.set-version.outputs.RELEASE_VERSION }}
      EXECUTE_RELEASE: ${{ steps.execute-release.outputs.EXECUTE_RELEASE }}

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0 # Required to fetch version
          persist-credentials: false

      # Node.js setup is needed to run Semantic Release
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: 'npm'

      # Required for short-lived token provided to Semantic Release
      - name: "Obtain Github App token"
        id: app-token
        uses: getsentry/action-github-app-token@v3
        with:
          app_id: ${{ secrets.BOT_APP_ID }}
          private_key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      - name: "Install Semantic Release dependencies"
        run: npm ci

      - name: "Execute Semantic Release"
        run: npx semantic-release
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

      # If there is tag inserting starting with 'v', prevent release-binary & release-docker from running
      - name: Check whether to execute release
        id: execute-release
        run: |
          tag=$(git describe --tags --exact-match) || exit 0
          if [[ $tag =~ ^v ]]; then
            echo "EXECUTE_RELEASE=true" >> "$GITHUB_OUTPUT"
          else
            echo "EXECUTE_RELEASE=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

      # Set release version number
      - name: Set release version number
        id: set-version
        if: steps.execute-release.outputs.EXECUTE_RELEASE == 'true'
        run: |
          RELEASE_VERSION=$( git describe --tags "${{ github.sha }}")
          echo "RELEASE_VERSION=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"

  release-binary:
    name: "Release Binary"
    needs: release-guard
    runs-on: ubuntu-latest
    # Only run if release-guard outputs EXECUTE_RELEASE=true
    if: needs.release-guard.outputs.EXECUTE_RELEASE == 'true'

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: actions/setup-go@v6
        with:
          go-version-file: ./go.mod
          cache: true

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: latest
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-docker:
    name: Build Docker image
    needs: release-guard
    runs-on: ${{ matrix.runs-on }}
    if: ${{ github.ref_name == 'main' }}
    env:
      IMAGE_NAME: ${{ github.repository }}
    environment:
      name: production
      url: https://resolver.cheqd.net

    strategy:
      matrix:
        arch: [amd64, arm64]
        include:
          - arch: amd64
            runs-on: ubuntu-24.04
          - arch: arm64
            runs-on: ubuntu-24.04-arm

    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        id: buildx
        with:
          version: latest

      - name: Build and cache image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: false
          file: docker/Dockerfile
          platforms: linux/${{ matrix.arch }}
          cache-from: type=gha,scope=docker-release-${{ matrix.arch }}
          cache-to: type=gha,scope=docker-release-${{ matrix.arch }},mode=max

  release-docker:
    name: Release Docker image
    needs:
      - release-guard
      - build-docker
    runs-on: ubuntu-latest
    if: ${{ github.ref_name == 'main' }}
    env:
      IMAGE_NAME: ${{ github.repository }}
    environment:
      name: production
      url: https://resolver.cheqd.net

    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        id: buildx
        with:
          version: latest

      - name: Install DigitalOcean CLI
        uses: digitalocean/action-doctl@v2
        with:
          token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to DigitalOcean Container Registry
        run: doctl registry login --expiry-seconds 600

      - name: Configure Docker image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/${{ env.IMAGE_NAME }}
            registry.digitalocean.com/${{ env.IMAGE_NAME }}
          flavor: |
            latest=auto
          tags: |
            type=semver,pattern={{version}},value=${{ needs.release-guard.outputs.RELEASE_VERSION }}
            type=raw,value=production-latest
            type=sha,format=long
          labels: |
            org.opencontainers.image.title="cheqd DID Resolver"
            org.opencontainers.image.description="DID Resolver for the did:cheqd method"
            org.opencontainers.image.source="https://github.com/cheqd/did-resolver"
            org.opencontainers.image.vendor="Cheqd Foundation Limited"
            org.opencontainers.image.created={{date 'dddd, MMMM Do YYYY, h:mm:ss a'}}
            org.opencontainers.image.documentation="https://docs.cheqd.io/identity"

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          file: docker/Dockerfile
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: |
            type=gha,scope=docker-release-amd64
            type=gha,scope=docker-release-arm64