Merge pull request #24 from nixopus/feat/staging-image-pipeline

ci: add staging image pipeline

Author: raghavyuva

.github/workflows/build-and-push.yml

@@ -7,8 +7,10 @@ name: Build and Push Container
 
 on:
   push:
-    branches:
-      - main
+    tags:
+      - 'v*'
+  release:
+    types: [published]
   workflow_dispatch:
 
 concurrency:
@@ -145,7 +147,9 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=raw,value=latest
-            type=sha,prefix={{branch}}-
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
 
       - name: Create manifest list and push
         if: steps.check.outputs.has_digests == 'true'

.github/workflows/build_staging.yml

@@ -0,0 +1,73 @@
+# Workflow: Build and Push Staging Docker Container
+# Description: Builds and pushes amd64-only staging image for Auth on every main merge.
+# Why: Provides a :staging floating tag and immutable :sha-* tags for pre-release validation,
+#      completely separate from the :latest production tags pushed by build-and-push.yml.
+
+name: Staging Package Manager
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-auth:
+    # Skip commits pushed by the release bot (chore(release): vX.Y.Z commits from release.yml)
+    if: github.actor != 'github-actions[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Create .env file
+        run: cp .env.sample .env
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver-opts: |
+            image=moby/buildkit:latest
+            network=host
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata for Auth
+        id: meta-auth
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=staging
+            type=sha,prefix=sha-,format=short
+
+      - name: Build and push Auth image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.meta-auth.outputs.tags }}
+          labels: ${{ steps.meta-auth.outputs.labels }}
+          cache-from: type=gha,scope=staging-auth
+          cache-to: type=gha,mode=max,scope=staging-auth
+          provenance: false

.github/workflows/release.yml

@@ -0,0 +1,60 @@
+# Workflow: Release
+# Description: Generates a release tag and GitHub release
+# Why: Provides versioned releases for production deployments
+
+name: Create Release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  create-release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    outputs:
+      released: ${{ steps.changelog.outputs.skipped == 'false' }}
+      tag: ${{ steps.changelog.outputs.tag }}
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Conventional Changelog Action
+        id: changelog
+        uses: TriPSs/conventional-changelog-action@v5
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          git-user-name: 'github-actions[bot]'
+          git-user-email: 'github-actions[bot]@users.noreply.github.com'
+          git-message: 'chore(release): {version}'
+          preset: 'angular'
+          tag-prefix: 'v'
+          version-file: 'package.json'
+          skip-on-empty: 'false'
+          skip-ci: 'true'
+          create-summary: 'true'
+          git-push: 'false'
+          release-count: 0
+
+      - name: Commit release artifacts
+        if: ${{ steps.changelog.outputs.skipped == 'false' }}
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email 'github-actions[bot]@users.noreply.github.com'
+          git add package.json
+          git tag -d "${{ steps.changelog.outputs.tag }}" 2>/dev/null || true
+          git commit -m "chore(release): ${{ steps.changelog.outputs.tag }}"
+          git tag "${{ steps.changelog.outputs.tag }}"
+          git push origin HEAD:main --tags
+
+      - name: Create GitHub Release
+        if: ${{ steps.changelog.outputs.skipped == 'false' }}
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.changelog.outputs.tag }}
+          name: ${{ steps.changelog.outputs.tag }}
+          body: ${{ steps.changelog.outputs.clean_changelog }}
+          prerelease: false

commitlint.config.cjs

@@ -0,0 +1,3 @@
+module.exports = {
+  extends: ['@commitlint/config-conventional'],
+};