release.yml

name: Release

on:
  push:
    branches: [main]
    paths-ignore:
      - "**.md"
      - "docs/**"
      - ".claude/**"
      - "TODO.md"

concurrency:
  group: release-main
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  quality:
    uses: ./.github/workflows/quality.yml
    secrets: inherit

  version:
    needs: quality
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.compute.outputs.version }}
      tag: ${{ steps.compute.outputs.tag }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Compute next version (YYYY.MM.N, monthly reset at .0)
        id: compute
        run: |
          set -euo pipefail
          YEAR_MONTH=$(date -u +'%Y.%-m')
          HEAD_TAG=$(git tag --points-at HEAD --list "v${YEAR_MONTH}.*" | sort -V | tail -1)
          if [ -n "$HEAD_TAG" ]; then
            VERSION="${HEAD_TAG#v}"
            echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
            echo "tag=${HEAD_TAG}" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          LAST=$(git tag -l "v${YEAR_MONTH}.*" | sed "s/^v${YEAR_MONTH}\.//" | sort -n | tail -1)
          if [ -z "$LAST" ]; then
            NEXT=0
          else
            NEXT=$((LAST + 1))
          fi
          VERSION="${YEAR_MONTH}.${NEXT}"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT"

  build:
    needs: version
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: backend
            context: ./backend
            image: patrick339/jyzrox-backend
            pass_version: true
            build_contexts: dbinit=./db
          - name: pwa
            context: ./pwa
            image: patrick339/jyzrox-pwa
            pass_version: true
          - name: nginx
            context: ./nginx
            image: patrick339/jyzrox-nginx
            pass_version: false
    steps:
      - uses: actions/checkout@v5

      - uses: docker/setup-buildx-action@v4

      - uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      # Push only a run-scoped staging tag here. Public Docker tags are promoted
      # in `finalize`, with :latest kept until release metadata succeeds.
      - name: Build and push ${{ matrix.name }}
        uses: docker/build-push-action@v7
        with:
          context: ${{ matrix.context }}
          push: true
          build-args: ${{ matrix.pass_version && format('APP_VERSION={0}', needs.version.outputs.version) || '' }}
          build-contexts: ${{ matrix.build_contexts }}
          tags: ${{ matrix.image }}:ci-${{ github.run_id }}-${{ github.run_attempt }}
          cache-from: type=gha,scope=${{ matrix.name }}
          cache-to: type=gha,mode=max,scope=${{ matrix.name }}

  finalize:
    needs: [version, build]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Verify staged images
        run: |
          set -euo pipefail
          STAGED_TAG="ci-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          for image in \
            patrick339/jyzrox-backend \
            patrick339/jyzrox-pwa \
            patrick339/jyzrox-nginx; do
            docker buildx imagetools inspect "${image}:${STAGED_TAG}" >/dev/null
          done

      - name: Promote versioned Docker tags
        run: |
          set -euo pipefail
          VERSION="${{ needs.version.outputs.version }}"
          STAGED_TAG="ci-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          for image in \
            patrick339/jyzrox-backend \
            patrick339/jyzrox-pwa \
            patrick339/jyzrox-nginx; do
            docker buildx imagetools create \
              -t "${image}:${VERSION}" \
              "${image}:${STAGED_TAG}"
          done

      - name: Verify versioned Docker tags
        run: |
          set -euo pipefail
          VERSION="${{ needs.version.outputs.version }}"
          for image in \
            patrick339/jyzrox-backend \
            patrick339/jyzrox-pwa \
            patrick339/jyzrox-nginx; do
            docker buildx imagetools inspect "${image}:${VERSION}" >/dev/null
          done

      - name: Create and push tag (idempotent release marker)
        run: |
          set -euo pipefail
          TAG="${{ needs.version.outputs.tag }}"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null; then
            TAG_SHA=$(git rev-list -n 1 "${TAG}")
            HEAD_SHA=$(git rev-parse HEAD)
            if [ "${TAG_SHA}" != "${HEAD_SHA}" ]; then
              echo "Tag ${TAG} already exists at ${TAG_SHA}, not ${HEAD_SHA}" >&2
              exit 1
            fi
          else
            git tag "${TAG}"
            git push origin "${TAG}"
          fi

      # orhun/git-cliff-action must stay listed in the repo's Actions
      # allowed-actions patterns (Settings > Actions > selected-actions),
      # or every run on main fails as a startup_failure with 0 jobs.
      - name: Generate release notes (git-cliff)
        uses: orhun/git-cliff-action@v4
        with:
          config: cliff.toml
          args: --latest
        env:
          OUTPUT: RELEASE_NOTES.md

      - name: Publish GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          TAG="${{ needs.version.outputs.tag }}"
          if gh release view "${TAG}" >/dev/null 2>&1; then
            gh release edit "${TAG}" --title "${TAG}" --notes-file RELEASE_NOTES.md
          else
            gh release create "${TAG}" --title "${TAG}" --notes-file RELEASE_NOTES.md
          fi

      - name: Promote latest Docker tags
        run: |
          set -euo pipefail
          VERSION="${{ needs.version.outputs.version }}"
          for image in \
            patrick339/jyzrox-backend \
            patrick339/jyzrox-pwa \
            patrick339/jyzrox-nginx; do
            docker buildx imagetools create \
              -t "${image}:latest" \
              "${image}:${VERSION}"
          done