release.yml

name: Release

on:
  push:
    tags:
      - "v*" # Trigger on tags like v1.0.0, v2.1.3, etc.

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  docker:
    name: Build and push Docker image by digest
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up QEMU (for multi-platform builds)
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set build metadata
        id: build_meta
        shell: bash
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PROJECT_NAME: ${{ secrets.DOCKERHUB_PROJECT_NAME }}
        run: |
          image="${DOCKER_USERNAME}/${DOCKERHUB_PROJECT_NAME}"
          version="${GITHUB_REF_NAME#v}"
          {
            echo "image=${image}"
            echo "version=${version}"
            echo "commit=${GITHUB_SHA}"
            echo "date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
          } >> "$GITHUB_OUTPUT"

      - name: Extract Docker labels
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ steps.build_meta.outputs.image }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,name=${{ steps.build_meta.outputs.image }},push-by-digest=true,name-canonical=true,push=true,compression=zstd,compression-level=3
          build-args: |
            VERSION=${{ steps.build_meta.outputs.version }}
            COMMIT=${{ steps.build_meta.outputs.commit }}
            DATE=${{ steps.build_meta.outputs.date }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  docker-promote:
    name: Promote Docker image tags
    runs-on: ubuntu-latest
    needs: docker
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set Docker image
        id: image_meta
        shell: bash
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PROJECT_NAME: ${{ secrets.DOCKERHUB_PROJECT_NAME }}
        run: echo "image=${DOCKER_USERNAME}/${DOCKERHUB_PROJECT_NAME}" >> "$GITHUB_OUTPUT"

      - name: Detect prerelease tag
        id: release_meta
        shell: bash
        run: |
          version="${GITHUB_REF_NAME#v}"
          if [[ "$version" == *-* ]]; then
            echo "prerelease=true" >> "$GITHUB_OUTPUT"
          else
            echo "prerelease=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Extract final Docker tags
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ steps.image_meta.outputs.image }}
          flavor: |
            latest=false
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ steps.release_meta.outputs.prerelease == 'false' }}

      - name: Promote Docker tags
        shell: bash
        env:
          IMAGE: ${{ steps.image_meta.outputs.image }}
          DIGEST: ${{ needs.docker.outputs.digest }}
          FINAL_TAGS: ${{ steps.meta.outputs.tags }}
        run: |
          if [[ -z "$DIGEST" ]]; then
            echo "Docker build did not produce an image digest" >&2
            exit 1
          fi

          tags=()
          while IFS= read -r tag; do
            [[ -n "$tag" ]] && tags+=("-t" "$tag")
          done <<< "$FINAL_TAGS"

          if [[ "${#tags[@]}" -eq 0 ]]; then
            echo "No Docker tags were generated for promotion" >&2
            exit 1
          fi

          docker buildx imagetools create "${tags[@]}" "${IMAGE}@${DIGEST}"

  goreleaser:
    name: Build draft GitHub release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0 # Required for git history/changelog

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version: 1.26.6
          cache: true

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean --draft
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  github-release:
    name: Publish GitHub release
    runs-on: ubuntu-latest
    needs:
      - docker-promote
      - goreleaser
    permissions:
      contents: write
    steps:
      - name: Publish drafted release
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release edit "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --draft=false --verify-tag

  deploy-demo:
    name: Update demo.enterpilot.io
    runs-on: ubuntu-latest
    # Must run after tag promotion: the demo pulls :latest, which is what
    # docker-promote pushes.
    needs: docker-promote
    # :latest is only promoted for stable releases (see "Detect prerelease
    # tag"), so skip prereleases like v1.2.3-rc1 — the demo wouldn't change.
    if: ${{ !contains(github.ref_name, '-') }}
    # Best-effort: a demo host outage must not fail the release
    continue-on-error: true
    steps:
      - name: Trigger demo deploy webhook
        env:
          DEMO_HOOK_TOKEN: ${{ secrets.DEMO_HOOK_TOKEN }}
        run: |
          curl -fsS --connect-timeout 10 --max-time 20 --retry-max-time 40 \
            --retry 3 --retry-delay 5 -X PUT \
            -H "X-Hook-Token: ${DEMO_HOOK_TOKEN}" \
            -d "deploy ${GITHUB_REF_NAME}" \
            https://demo.enterpilot.io/hooks/update-demo

  publish-mcp:
    name: Publish to MCP Registry
    runs-on: ubuntu-latest
    # Registry verification pulls the versioned Docker Hub image, so the tag must exist first
    needs: docker-promote
    # Best-effort: a registry outage must not fail the release
    continue-on-error: true
    permissions:
      id-token: write # GitHub OIDC grants the io.github.enterpilot/* namespace
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Install mcp-publisher
        env:
          PUBLISHER_VERSION: v1.8.0
          PUBLISHER_SHA256: 1370446bbe74d562608e8005a6ccce02d146a661fbd78674e11cc70b9618d6cf
        run: |
          curl -fsSL -o mcp-publisher.tar.gz "https://github.com/modelcontextprotocol/registry/releases/download/${PUBLISHER_VERSION}/mcp-publisher_linux_amd64.tar.gz"
          echo "${PUBLISHER_SHA256}  mcp-publisher.tar.gz" | sha256sum -c -
          tar xzf mcp-publisher.tar.gz mcp-publisher

      - name: Set release version in server.json
        shell: bash
        run: |
          version="${GITHUB_REF_NAME#v}"
          jq --arg v "$version" \
            '.version = $v | .packages[0].identifier = "docker.io/enterpilot/gomodel:" + $v' \
            docs/server.json > server.json.tmp && mv server.json.tmp docs/server.json

      - name: Authenticate to MCP Registry
        run: ./mcp-publisher login github-oidc

      - name: Publish server to MCP Registry
        run: ./mcp-publisher publish docs/server.json