release.yml

# SPDX-License-Identifier: MIT
# Copyright (c) 2026 Netresearch DTT GmbH
#
# Release workflow.
#
# Triggered by pushing one of THIS repo's own release tags — bare semver, NO
# 'v' prefix (e.g. 11.0.8), matching the bundled GLPI version. It builds the
# multi-arch image through docker-bake.hcl, pushes + signs the canonical tag
# set, emits SBOM + provenance, and publishes a GitHub Release — all via the
# shared netresearch/.github reusables so no external action is pinned here.

name: Release

on:
  push:
    # Bare semver, no 'v' prefix (matches the bundled GLPI version).
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'

permissions: {}

jobs:
  # Resolve version facts for the release step (the build derives its own via
  # pre-build-command). No external actions — just the runner's gh CLI.
  version:
    name: Resolve version
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      version: ${{ steps.v.outputs.version }}
      is_newest: ${{ steps.v.outputs.is_newest }}
    steps:
      - id: v
        env:
          REF_NAME: ${{ github.ref_name }}
          REPO: ${{ github.repository }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          V="$REF_NAME"
          # An out-of-order / backport release must NOT move the "Latest" badge
          # onto an older version.
          NEWEST=$(gh api "repos/${REPO}/git/refs/tags" \
                     --jq '.[].ref | ltrimstr("refs/tags/")' 2>/dev/null \
                   | sed 's/^v//' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \
                   | sort -V | tail -1)
          IS_NEWEST=true
          if [ -n "$NEWEST" ] && [ "$V" != "$NEWEST" ]; then
            IS_NEWEST=false
          fi
          {
            echo "version=$V"
            echo "is_newest=$IS_NEWEST"
          } >> "$GITHUB_OUTPUT"

  # Multi-arch build (QEMU) + push + sign every produced tag + SBOM + provenance.
  # The GLPI tarball sha256 is resolved in pre-build-command and pins the build.
  build:
    needs: version
    uses: netresearch/.github/.github/workflows/build-container-bake.yml@main
    permissions:
      contents: read
      packages: write
      security-events: write
      id-token: write
    with:
      bake-file: docker-bake.hcl
      targets: glpi
      push: true
      sign: true
      sbom: true
      attest: true
      scan: false
      pre-build-command: |
        set -euo pipefail
        V="$GITHUB_REF_NAME"
        # The release tag IS the bundled GLPI version — hash that exact upstream
        # asset and pin the build to it (a swapped artifact cannot be signed).
        URL="https://github.com/glpi-project/glpi/releases/download/${V}/glpi-${V}.tgz"
        GLPI_SHA256=$(curl -fsSL "$URL" | sha256sum | cut -d' ' -f1)
        [ -n "$GLPI_SHA256" ] || { echo "could not hash $URL" >&2; exit 1; }
        {
          echo "GLPI_VERSION=$V"
          echo "GLPI_SHA256=$GLPI_SHA256"
          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
          echo "GIT_SHA=$(git rev-parse --short HEAD)"
        } >> "$GITHUB_ENV"

  release:
    needs: [version, build]
    uses: netresearch/.github/.github/workflows/gh-release-image.yml@main
    permissions:
      contents: write
    with:
      # Only the newest semver release gets the "Latest" badge.
      make-latest: ${{ needs.version.outputs.is_newest }}
      body: |
        ## Container image

        ```bash
        docker pull ghcr.io/netresearch/glpi-php-fpm:${{ needs.version.outputs.version }}
        ```

        Tags published: `${{ needs.version.outputs.version }}`, `<major.minor>`,
        `<major>`, `latest` (linux/amd64 + linux/arm64).

        ## Verify the signature

        ```bash
        cosign verify ghcr.io/netresearch/glpi-php-fpm:${{ needs.version.outputs.version }} \
          --certificate-identity-regexp "https://github.com/netresearch/glpi-docker-compose-stack" \
          --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
        ```

        ## SBOM

        ```bash
        cosign download sbom ghcr.io/netresearch/glpi-php-fpm:${{ needs.version.outputs.version }}
        ```

        ---

        This image bundles **GLPI ${{ needs.version.outputs.version }}**
        (GPL-3.0-or-later). The Docker packaging in this repository is MIT.