release.yml

name: Release

on:
  workflow_call:
    inputs:
      # jscpd:ignore-start
      runs-on:
        description: |
          JSON array of runner(s) to use.
          See https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job.
        type: string
        default: '["ubuntu-latest"]'
        required: false
      oci-registry:
        description: "OCI registry where to pull and push images."
        type: string
        default: "ghcr.io"
        required: false
      oci-registry-username:
        description: |
          Username used to log against the OCI registry.
          See https://github.com/docker/login-action#usage.
        type: string
        default: ${{ github.repository_owner }}
        required: false
      platforms:
        description: |
          JSON array of platforms to build images for.
          See https://docs.docker.com/buildx/working-with-buildx/#build-multi-platform-images.
        type: string
        default: '["linux/amd64","linux/arm64"]'
        required: false
      # jscpd:ignore-end
      prerelease:
        description: "Whether the release is a prerelease"
        type: boolean
        default: false
    secrets:
      github-token:
        description: |
          GitHub token with permissions `contents: read`.
        required: false
      oci-registry-password:
        description: |
          Password or GitHub token (packages:read and packages:write scopes) used to log against the OCI registry.
          Defaults to GITHUB_TOKEN if not provided.
        required: false
  workflow_dispatch:

permissions: {}

jobs:
  prepare-images:
    runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
    permissions:
      contents: read
      id-token: write # Needed for getting local workflow actions
    outputs:
      images-matrix: ${{ steps.get-images-matrix.outputs.images-matrix }}
    steps:
      - id: local-workflow-actions
        uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@4b53189212d5810f710bed89711002626977215b # 0.33.0
        with:
          actions-path: actions

      - id: get-available-images
        uses: ./self-workflow/actions/get-available-images

      - id: get-images-matrix
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          IMAGES: ${{ steps.get-available-images.outputs.images }}
        with:
          github-token: ${{ secrets.github-token || secrets.GITHUB_TOKEN || github.token }}
          script: |
            const images = JSON.parse(process.env.IMAGES);

            const tags = await github.paginate(github.rest.repos.listTags, {
              owner: context.repo.owner,
              repo: context.repo.repo,
            });

            function getImageLatestTagSha(image) {
              const tagFilter = `${image}-`;
              const imageTags = tags.filter(tag => tag.name.startsWith(tagFilter));

              // Sort tags regarding semver
              imageTags.sort((a, b) => {
                const aVersion = a.name.replace(tagFilter, '');
                const bVersion = b.name.replace(tagFilter, '');
                return bVersion.localeCompare(aVersion, undefined, { numeric: true });
              });

              return imageTags.length ? imageTags[0].commit.sha : null;
            }

            // Group images by their latest tag sha
            const noTagIdentifier = 'no-tag';
            const imagesGroupedByLatestTagSha = {};
            for (const image of images) {
              const latestTagSha = getImageLatestTagSha(image);
              if (latestTagSha) {
                if (!imagesGroupedByLatestTagSha[latestTagSha]) {
                  imagesGroupedByLatestTagSha[latestTagSha] = [];
                }
                imagesGroupedByLatestTagSha[latestTagSha].push(image);
              } else {
                // If no tag found, consider the image needs to be built
                if (!imagesGroupedByLatestTagSha[noTagIdentifier]) {
                  imagesGroupedByLatestTagSha[noTagIdentifier] = [];
                }
                imagesGroupedByLatestTagSha[noTagIdentifier].push(image);
              }
            }

            // Prepare a matrix-like output - images, base-sha
            const imagesMatrix = [];
            for (const [baseSha, images] of Object.entries(imagesGroupedByLatestTagSha)) {
              imagesMatrix.push({
                images,
                "base-sha": baseSha === noTagIdentifier ? null : baseSha,
              });
            }

            core.setOutput('images-matrix', JSON.stringify(imagesMatrix));
      # jscpd:ignore-start
      - uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@4b53189212d5810f710bed89711002626977215b # 0.33.0
        if: always() && steps.local-workflow-actions.outputs.repository
        with:
          actions-path: actions
          repository: ${{ steps.local-workflow-actions.outputs.repository }}
          ref: ${{ steps.local-workflow-actions.outputs.ref }}
      # jscpd:ignore-end

  prepare-images-to-release:
    runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
    permissions:
      contents: read
      id-token: write # Needed for getting local workflow actions
    needs: prepare-images
    strategy:
      matrix:
        images: ${{ fromJson(needs.prepare-images.outputs.images-matrix) }}
      fail-fast: false
    steps:
      - id: local-workflow-actions
        uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@4b53189212d5810f710bed89711002626977215b # 0.33.0
        with:
          actions-path: actions

      - id: should-build-images
        uses: ./self-workflow/actions/should-build-images
        with:
          base-sha: ${{ matrix.images.base-sha }}
          images: ${{ toJSON(matrix.images.images) }}

      - id: set-images-to-release
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          BASE_SHA: ${{ matrix.images.base-sha }}
          SHOULD_BUILD_IMAGES: ${{ steps.should-build-images.outputs.should-build-images }}
        with:
          script: |
            const shouldBuildImages = JSON.parse(process.env.SHOULD_BUILD_IMAGES);

            const forceBuild = process.env.BASE_SHA.length === 0;

            const imagesToRelease = Object.entries(shouldBuildImages)
              .filter(([image, shouldBuild]) => forceBuild || shouldBuild === true)
              .map(([image, shouldBuild]) => image);

            if (imagesToRelease.length > 0) {
              core.setOutput('images-to-release', JSON.stringify(imagesToRelease));
            }

      - if: steps.set-images-to-release.outputs.images-to-release
        uses: hoverkraft-tech/ci-github-common/actions/set-matrix-output@4b53189212d5810f710bed89711002626977215b # 0.33.0
        with:
          value: ${{ steps.set-images-to-release.outputs.images-to-release }}
          artifact-name: images-to-release

      # jscpd:ignore-start
      - uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@4b53189212d5810f710bed89711002626977215b # 0.33.0
        if: always() && steps.local-workflow-actions.outputs.repository
        with:
          actions-path: actions
          repository: ${{ steps.local-workflow-actions.outputs.repository }}
          ref: ${{ steps.local-workflow-actions.outputs.ref }}
      # jscpd:ignore-end

  get-images-to-release:
    needs: prepare-images-to-release
    runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
    outputs:
      images: ${{ steps.get-images-to-release.outputs.images }}
    steps:
      - id: get-matrix-outputs
        uses: hoverkraft-tech/ci-github-common/actions/get-matrix-outputs@4b53189212d5810f710bed89711002626977215b # 0.33.0
        with:
          artifact-name: "images-to-release"

      - id: get-images-to-release
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          IMAGES: ${{ steps.get-matrix-outputs.outputs.result }}
        with:
          script: |
            const images = JSON.parse(process.env.IMAGES);
            core.setOutput('images', JSON.stringify(images.flat()));

  release-images:
    name: Release Image ${{ matrix.image }}
    runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
    if: needs.get-images-to-release.outputs.images != '[]'
    permissions:
      contents: write
    needs: get-images-to-release
    strategy:
      matrix:
        image: ${{ fromJson(needs.get-images-to-release.outputs.images) }}
      fail-fast: false
    steps:
      - id: create-release
        uses: hoverkraft-tech/ci-github-publish/actions/release/create@b56be562f38e0e3e712f09691a8fe930aae9db1b # 0.22.0
        with:
          prerelease: ${{ inputs.prerelease }}
          working-directory: images/${{ matrix.image }}

      - id: set-images-to-build
        if: steps.create-release.outputs.tag != ''
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          TAG: ${{ steps.create-release.outputs.tag }}
          IMAGE: ${{ matrix.image }}
        with:
          script: |
            const buildTag = process.env.TAG.replace(new RegExp(`^${process.env.IMAGE}-`), '');
            core.setOutput('image', JSON.stringify({
              name: process.env.IMAGE,
              tag: buildTag,
            }));

      - if: steps.set-images-to-build.outputs.image
        uses: hoverkraft-tech/ci-github-common/actions/set-matrix-output@4b53189212d5810f710bed89711002626977215b # 0.33.0
        with:
          value: ${{ steps.set-images-to-build.outputs.image }}
          artifact-name: images-to-build

  # jscpd:ignore-start
  prepare-images-to-build:
    name: Prepare Images to Build
    needs: release-images
    runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
    outputs:
      images: ${{ steps.get-matrix-outputs.outputs.result }}
    steps:
      - id: get-matrix-outputs
        uses: hoverkraft-tech/ci-github-common/actions/get-matrix-outputs@4b53189212d5810f710bed89711002626977215b # 0.33.0
        with:
          artifact-name: "images-to-build"
  # jscpd:ignore-end

  build-images:
    needs: prepare-images-to-build
    if: needs.prepare-images-to-build.outputs.images != '[]'
    uses: ./.github/workflows/docker-build-images.yml
    permissions:
      contents: read
      issues: read
      packages: write
      pull-requests: write
      id-token: write
    with:
      runs-on: ${{ inputs.runs-on || '["ubuntu-latest"]' }}
      oci-registry: ${{ inputs.oci-registry || 'ghcr.io' }}
      oci-registry-username: ${{ inputs.oci-registry-username || github.repository_owner }}
      images: ${{ needs.prepare-images-to-build.outputs.images }}
      platforms: ${{ inputs.platforms || '["linux/amd64","linux/arm64"]' }}
    secrets:
      oci-registry-password: ${{ secrets.oci-registry-password || null }}