EvoFirewall/.gitea/workflows/cd.yaml

name: CD

on:
  push:
    branches: [main, master]

permissions:
  contents: read

jobs:
  quality:
    uses: ./.gitea/workflows/quality.yaml
    with:
      is_pull_request: false
      before_sha: ${{ github.event.before }}
      head_sha: ${{ github.sha }}
      allow_registry_login: false
    secrets:
      ACTIONS_PAT: ${{ secrets.ACTIONS_PAT }}

  publish:
    needs: [quality]
    if: >-
      always() &&
      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master') &&
      needs.quality.result == 'success'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      releases: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          fetch-tags: true
          token: ${{ secrets.ACTIONS_PAT || gitea.token }}
          persist-credentials: true
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "22"
      - name: Export cache paths
        run: sh scripts/ci/export-cache-env.sh
      - id: pnpm-hash
        run: echo "key=$(sha256sum pnpm-lock.yaml | awk '{print $1}')" >> "$GITHUB_OUTPUT"
      - id: pnpm-cache
        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ${{ env.PNPM_STORE_DIR }}
            ${{ env.COREPACK_HOME }}
            node_modules
            apps/web/node_modules
            apps/api/node_modules
            packages/ui/node_modules
            packages/shared/node_modules
            packages/db/node_modules
          key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
          restore-keys: |
            pnpm-${{ runner.os }}-
      - name: Install release tooling
        env:
          PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
        run: sh scripts/ci/pnpm-ci.sh
      - name: Verify releasable commit messages
        run: pnpm exec node scripts/commit/verify-release-commits.mjs
      - name: Semantic release
        run: pnpm exec semantic-release
        env:
          GITEA_URL: https://git.shx.one
          GITEA_TOKEN: ${{ secrets.ACTIONS_PAT || gitea.token }}
      - name: Detect new release
        id: rel
        run: |
          set -euo pipefail
          version=""
          if [ -f .release-version ]; then
            version="$(tr -d '[:space:]' < .release-version)"
            echo "New release from semantic-release: $version"
          else
            git fetch --tags --force origin || true
            tag="$(git tag --points-at HEAD --list 'v*.*.*' | sort -V | tail -n1 || true)"
            if [ -n "${tag:-}" ]; then
              version="${tag#v}"
              echo "Reuse existing tag $tag on HEAD (release retry)"
            fi
          fi
          if [ -n "${version:-}" ]; then
            echo "version=$version" >> "$GITHUB_OUTPUT"
            echo "released=true" >> "$GITHUB_OUTPUT"
          else
            echo "released=false" >> "$GITHUB_OUTPUT"
            echo "No releasable commits — skipping image publish"
          fi
      - name: Set up Docker Buildx
        if: steps.rel.outputs.released == 'true'
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
        with:
          name: evofw
          driver: docker-container
          cleanup: false
      - name: Prepare image metadata
        if: steps.rel.outputs.released == 'true'
        id: meta
        run: |
          set -euo pipefail
          echo "version=${{ steps.rel.outputs.version }}" >> "$GITHUB_OUTPUT"
          owner_lc="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
          echo "owner_lc=$owner_lc" >> "$GITHUB_OUTPUT"
          short_sha="$(echo '${{ github.sha }}' | cut -c1-7)"
          echo "short_sha=$short_sha" >> "$GITHUB_OUTPUT"
          echo "build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
      - name: Log in to Gitea Registry
        if: steps.rel.outputs.released == 'true'
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: git.shx.one
          username: ${{ gitea.actor }}
          password: ${{ secrets.ACTIONS_PAT }}
      - name: Mirror base images into buildcache
        if: steps.rel.outputs.released == 'true'
        env:
          REGISTRY: git.shx.one/${{ steps.meta.outputs.owner_lc }}
          MIRROR_ENV_FILE: ${{ runner.temp }}/mirror-base.env
        run: sh deploy/docker/mirror-base-images.sh
      - name: Build and push images (bake)
        if: steps.rel.outputs.released == 'true'
        env:
          REGISTRY: git.shx.one/${{ steps.meta.outputs.owner_lc }}
          IMAGE_TAG: latest
          VERSION: ${{ steps.meta.outputs.version }}
          SHORT_SHA: ${{ steps.meta.outputs.short_sha }}
          SHA_FULL: ${{ github.sha }}
          BUILD_TIME: ${{ steps.meta.outputs.build_time }}
          CACHE_REF_NODE: git.shx.one/${{ steps.meta.outputs.owner_lc }}/evofw-buildcache:node-buildcache
          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
          BUILDX_BAKE_FILE_RELATIVE_PATHS: "1"
          MIRROR_ENV_FILE: ${{ runner.temp }}/mirror-base.env
        working-directory: deploy/docker
        run: |
          set -euxo pipefail
          if [ -f "${MIRROR_ENV_FILE}" ]; then
            set -a
            # shellcheck disable=SC1090
            . "${MIRROR_ENV_FILE}"
            set +a
          fi
          docker buildx bake --allow=fs.read="${{ github.workspace }}" \
            -f docker-bake.hcl default --push