release.yml

name: Release

concurrency:
  group: release-${{ github.workflow }}-${{ github.ref_name }}
  cancel-in-progress: true

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.*'

permissions:
  contents: read

jobs:
  tagList:
    runs-on: ubuntu-latest
    outputs:
      tags: ${{ steps.tags.outputs.OUTPUT_TAGS }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9ca718d3bf646d6534007c269a635b3e54cadf99 # v2.19.2
        with:
          egress-policy: audit
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - name: Get image tag list
        id: tags
        run: |
          set -eux -o pipefail

          # Remove leading "v" from tag name
          TRIMMED_REF_NAME="${REF_NAME#v}"

          OUTPUT_TAGS=(
            "type=raw,value=${TRIMMED_REF_NAME%.*}"
            "type=raw,value=${TRIMMED_REF_NAME}"
          )

          # Check if this tag is the latest release by fetching the latest release and comparing the tag to the tag being built.
          LATEST_TAG="$(gh release view --json tagName -q .tagName)"
          if [ "$REF_NAME" = "$LATEST_TAG" ]; then
            OUTPUT_TAGS=("type=raw,value=latest" "${OUTPUT_TAGS[@]}")
          fi

          {
            echo "OUTPUT_TAGS<<EOF"
            printf '%s\n' "${OUTPUT_TAGS[@]}"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"
          cat "$GITHUB_OUTPUT"
        env:
          REF_NAME: ${{ github.ref_name }}
          GH_TOKEN: ${{ github.token }}
        shell: bash

  build:
    permissions:
      contents: read
      packages: write
      id-token: write  # Required for cosign OIDC signing
      attestations: write  # Required for GitHub attestations

    needs: tagList
    uses: ./.github/workflows/frontend-image.yml
    with:
      tag: ${{needs.tagList.outputs.tags}}