feat: init sso (#90) #86
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Workflow | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| permissions: | |
| id-token: write | |
| contents: write | |
| packages: write | |
| jobs: | |
| docker: | |
| runs-on: ubuntu-latest | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GitHub Container Registry | |
| run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin | |
| - name: Build and push multi-platform Docker image | |
| run: | | |
| IMAGE_TAG="${GITHUB_REF#refs/tags/}" | |
| REPO="ghcr.io/${{ github.repository_owner }}/expo-open-ota" | |
| echo "Building Docker image with tag: $IMAGE_TAG" | |
| docker buildx build \ | |
| --platform linux/amd64,linux/arm64 \ | |
| --build-arg VERSION="$IMAGE_TAG" \ | |
| -t "$REPO:$IMAGE_TAG" \ | |
| --push . | |
| - name: Check latest version and update latest tag | |
| env: | |
| IMAGE_TAG: ${{ github.ref_name }} | |
| run: | | |
| REPO="ghcr.io/${{ github.repository_owner }}/expo-open-ota" | |
| echo "Fetching the latest version tag from GHCR..." | |
| LATEST_TAG=$(gh api "https://api.github.com/users/${{ github.repository_owner }}/packages/container/expo-open-ota/versions?per_page=100" \ | |
| --jq '[.[].metadata.container.tags[]] | map(select(test("^v[0-9]+\\.[0-9]+\\.[0-9]+$"))) | sort_by(ltrimstr("v") | split(".") | map(tonumber)) | last' | tr -d '"') | |
| echo "Latest found version: $LATEST_TAG" | |
| echo "Current version: $IMAGE_TAG" | |
| if [ "$LATEST_TAG" = "$IMAGE_TAG" ]; then | |
| echo "$IMAGE_TAG is the latest version. Updating latest tag..." | |
| docker buildx imagetools create -t "$REPO:latest" "$REPO:$IMAGE_TAG" | |
| else | |
| echo "$IMAGE_TAG is not the latest version. Skipping latest tag update." | |
| fi | |
| helm: | |
| runs-on: ubuntu-latest | |
| needs: docker | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Update Helm values.yaml | |
| run: | | |
| IMAGE_TAG="${GITHUB_REF#refs/tags/}" | |
| sed -i "s/tag: .*/tag: ${IMAGE_TAG}/" helm/values.yaml | |
| - name: Package Helm chart | |
| run: | | |
| IMAGE_TAG="${GITHUB_REF#refs/tags/}" | |
| CHART_VERSION="${IMAGE_TAG#v}" | |
| helm package ./helm -d ./charts --version "$CHART_VERSION" --app-version "$IMAGE_TAG" | |
| - name: Log in to GitHub Container Registry | |
| run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin | |
| - name: Push Helm chart to GHCR | |
| run: | | |
| IMAGE_TAG="${GITHUB_REF#refs/tags/}" | |
| CHART_VERSION="${IMAGE_TAG#v}" | |
| OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]') | |
| helm push "./charts/expo-open-ota-${CHART_VERSION}.tgz" "oci://ghcr.io/${OWNER}/charts" | |
| - name: Rename chart archive for release assets | |
| run: | | |
| IMAGE_TAG="${GITHUB_REF#refs/tags/}" | |
| CHART_VERSION="${IMAGE_TAG#v}" | |
| mv "./charts/expo-open-ota-${CHART_VERSION}.tgz" "./charts/expo-open-ota-helm-charts-${IMAGE_TAG}.tgz" | |
| - name: Upload chart artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: helm-chart | |
| path: ./charts/*.tgz | |
| npm: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "24.x" | |
| registry-url: "https://registry.npmjs.org" | |
| - name: Publish NPM package | |
| run: | | |
| cd apps/eoas | |
| VERSION=$(echo "${{ github.ref_name }}" | sed 's/^v//') | |
| npm ci | |
| npm run build | |
| npm version "$VERSION" --no-git-tag-version | |
| if echo "$VERSION" | grep -qE '\-(alpha|beta|rc)'; then | |
| NPM_TAG=$(echo "$VERSION" | grep -oE '(alpha|beta|rc)') | |
| echo "Pre-release detected, publishing with --tag $NPM_TAG" | |
| npm publish --access public --provenance --tag "$NPM_TAG" | |
| else | |
| npm publish --access public --provenance | |
| fi | |
| github-release: | |
| runs-on: ubuntu-latest | |
| needs: [helm, npm] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Download chart artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: helm-chart | |
| path: ./charts | |
| - name: Compute release metadata | |
| run: | | |
| IMAGE_TAG="${GITHUB_REF#refs/tags/}" | |
| OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]') | |
| echo "CHART_VERSION=${IMAGE_TAG#v}" >> "$GITHUB_ENV" | |
| echo "OWNER=$OWNER" >> "$GITHUB_ENV" | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: ./charts/*.tgz | |
| prerelease: ${{ contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-rc') }} | |
| body: | | |
| ## Changes | |
| - Docker image: `ghcr.io/${{ github.repository_owner }}/expo-open-ota:${{ github.ref_name }}` | |
| - Helm chart: `helm install expo-open-ota oci://ghcr.io/${{ env.OWNER }}/charts/expo-open-ota --version ${{ env.CHART_VERSION }}` | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |