docker-build-deploy.yml

name: Docker Build and Deploy

on:
  push:
    branches:
      - main
      - github-actions  # For testing workflow changes

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: dohsimpson/tasktrove

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    outputs:
      EXISTS: ${{ steps.check-version.outputs.EXISTS }}
      VERSION: ${{ steps.package-version.outputs.VERSION }}
      IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
    
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Get version from package.json
        id: package-version
        run: echo "VERSION=$(node -p "require('./apps/web/package.json').version")" >> $GITHUB_OUTPUT

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Check if version exists
        id: check-version
        run: |
          if docker manifest inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:v${{ steps.package-version.outputs.VERSION }} >/dev/null 2>&1; then
            echo "EXISTS=true" >> $GITHUB_OUTPUT
            echo "Version v${{ steps.package-version.outputs.VERSION }} already exists"
          else
            echo "EXISTS=false" >> $GITHUB_OUTPUT
            echo "Version v${{ steps.package-version.outputs.VERSION }} is new"
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=dev
            type=raw,value=v${{ steps.package-version.outputs.VERSION }},enable=${{ steps.check-version.outputs.EXISTS == 'false' }}
            type=raw,value=latest,enable=${{ steps.check-version.outputs.EXISTS == 'false' }}
            type=raw,value=demo,enable=${{ steps.check-version.outputs.EXISTS == 'false' }}

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./apps/web/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

  deploy-demo:
    runs-on: ubuntu-latest
    needs: build-and-push
    if: needs.build-and-push.outputs.EXISTS == 'false'

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        
      - name: Deploy to demo instance
        uses: actions-hub/kubectl@master
        env:
          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
        with:
          args: rollout restart -n ${{ secrets.KUBE_NAMESPACE }} deployment/${{ secrets.KUBE_DEPLOYMENT }}

  create-release:
    runs-on: ubuntu-latest
    needs: build-and-push
    if: needs.build-and-push.outputs.EXISTS == 'false'

    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Extract changelog for version
        id: changelog
        env:
          VERSION: ${{ needs.build-and-push.outputs.VERSION }}
        run: |
          # Extract release notes from CHANGELOG.md using same approach as HabitTrove
          notes=$(awk -v version="$VERSION" '
            /^## / && $0 ~ version {flag=1;next}
            /^## / && flag {exit}
            flag' CHANGELOG.md)
          
          if [ -z "$notes" ]; then
            echo "No changelog found for version $VERSION, using auto-generated notes"
            echo "USE_AUTO_NOTES=true" >> $GITHUB_OUTPUT
          else
            # Save changelog section to output
            echo "RELEASE_NOTES<<EOF" >> $GITHUB_OUTPUT
            echo "$notes" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
            echo "USE_AUTO_NOTES=false" >> $GITHUB_OUTPUT
          fi

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.build-and-push.outputs.VERSION }}
          USE_AUTO_NOTES: ${{ steps.changelog.outputs.USE_AUTO_NOTES }}
          RELEASE_NOTES: ${{ steps.changelog.outputs.RELEASE_NOTES }}
        run: |
          if [ "$USE_AUTO_NOTES" = "true" ]; then
            # Fallback to auto-generated notes if no changelog found
            gh release create "v$VERSION" \
                --repo="$GITHUB_REPOSITORY" \
                --title="TaskTrove v$VERSION" \
                --generate-notes \
                --notes-start-tag=$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null || echo "")
          else
            # Use changelog content
            gh release create "v$VERSION" \
                --repo="$GITHUB_REPOSITORY" \
                --title="TaskTrove v$VERSION" \
                --notes="$RELEASE_NOTES"
          fi