publish-version.yml

name: HAWKI Release Pipeline

on:
  push:
    branches: [ main ]

permissions:
  contents: write

jobs:
  # ========================================================
  # JOB 1: Detect version and create the release.
  # ========================================================
  release:
    name: Detect Version & Create Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      should_release: ${{ steps.should_release.outputs.should_release }}
      version: ${{ steps.version.outputs.version }}
      release_name: ${{ steps.create_release.outputs.release_name }}
      release_body: ${{ steps.create_release.outputs.release_body }}
      release_url: ${{ steps.create_release.outputs.release_url }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24'

      - name: Install dependencies
        working-directory: .github/.hawki-release
        run: npm install

      - name: Detect latest version from changelog
        id: version
        working-directory: .github/.hawki-release
        run: node detect-version.js

      - name: Check if new version should be released
        id: should_release
        if: steps.version.outputs.version != ''
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          if git tag --list | grep -q "^${VERSION}$"; then
            echo "Tag ${VERSION} already exists. No new release needed."
            echo "should_release=false" >> $GITHUB_OUTPUT
          else
            echo "New version ${VERSION} detected. Proceeding with release."
            echo "should_release=true" >> $GITHUB_OUTPUT
          fi

      - name: Update hawki_version.json
        if: steps.should_release.outputs.should_release == 'true'
        working-directory: .github/.hawki-release
        run: node update-version.js "${{ steps.version.outputs.version }}"

      - name: Commit and push version update
        if: steps.should_release.outputs.should_release == 'true'
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          git add config/hawki_version.json
          git commit -m "Update version to $VERSION"
          git push

      - name: Create git tag
        if: steps.should_release.outputs.should_release == 'true'
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          # This command tags the commit we just created, which is correct.
          git tag "$VERSION"
          git push origin "$VERSION"

      - name: Create GitHub release
        if: steps.should_release.outputs.should_release == 'true'
        working-directory: .github/.hawki-release
        run: node create-release.js "${{ steps.version.outputs.version }}"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


  # =================================================================
  # JOB 2: Build and push the Docker image.
  # =================================================================
  build-and-publish-docker:
    name: Build & Publish Docker Image
    runs-on: ubuntu-latest
    needs: release
    if: needs.release.outputs.should_release == 'true'
    permissions:
      packages: write
      contents: read
      attestations: write
      id-token: write
    steps:
      - name: Check out the code at the new release tag
        uses: actions/checkout@v4
        with:
          # This tells the checkout action to get the code from the tag
          # created in the previous job, not the original triggering commit.
          ref: ${{ needs.release.outputs.version }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push Docker image
        id: push
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          push: true
          target: app_prod
          tags: |
            digitalenvironments/hawki:latest
            digitalenvironments/hawki:${{ needs.release.outputs.version }}

      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v1
        with:
          subject-name: index.docker.io/digitalenvironments/hawki
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true


  # ================================================================
  # JOB 3: Notify Discord.
  # ================================================================
  notify-discord:
    name: Notify Discord
    runs-on: ubuntu-latest
    needs: [ release, build-and-publish-docker ]
    if: success() && needs.release.outputs.should_release == 'true'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24'

      - name: Install dependencies for notify script
        working-directory: .github/.hawki-release
        run: npm install

      - name: Send Discord Notification
        working-directory: .github/.hawki-release
        env:
          INPUT_WEBHOOK_URL: ${{ secrets.DISCORD_UPDATE_WEBHOOK_URL }}
          INPUT_RELEASE_NAME: ${{ needs.release.outputs.release_name }}
          INPUT_RELEASE_BODY: ${{ needs.release.outputs.release_body }}
          INPUT_RELEASE_URL: ${{ needs.release.outputs.release_url }}
          INPUT_CONTENT: "||@everyone|| Successfully released and published **HAWKI v${{ needs.release.outputs.version }}**!"
          INPUT_FOOTER_TITLE: "Changelog"
        run: node send-discord-notification.js


  # ================================================================
  # JOB 4: Synchronize main back to the development branch.
  # ================================================================
  back-merge-to-development:
    name: Back-merge to Development
    runs-on: ubuntu-latest
    needs: release # Only needs to know if a release happened. Can run in parallel with build/notify.
    if: needs.release.outputs.should_release == 'true'
    permissions:
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          # Fetch all history for all tags and branches
          fetch-depth: 0

      - name: Configure Git
        run: |
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"

      - name: Wait for main branch propagation
        run: sleep 10

      - name: Merge main into development
        run: |
          git fetch origin main
          git checkout development
          git pull origin development
          git merge origin/main --no-ff -m "chore: Merge main back to development after release ${{ needs.release.outputs.version }}"
          git push origin development