main.yaml

# RedKubes default Workflow
#
# Given facts:
# * We don't allow manual tagging, but let the workflow create them after tests have passed.
# * We don't let workflows be triggered by events coming from tags
# * We use `npm run release` (without automated tagging) which only bumps version and creates changelog and commit message with title 'chore(release): v${semverVersion}'
# * Pipeline detects the release title and after tests pass, creates artifacts (images) and makes full tag copies (and github release) to allow release patching.
name: Build test push release
on:
  push:
    branches:
      - '**'
    tags-ignore:
      - '*'
env:
  COMMIT_MSG: ${{ github.event.head_commit.message }}
  CACHE_REGISTRY: ghcr.io
  CACHE_REPO: linode/apl-tasks
  REPO: otomi/tasks
  GIT_USER: linode-gh-bot
  GIT_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
  DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_OTOMI_TOKEN }}
jobs:
  build-test-push-release:
    if: "((contains(github.event.head_commit.message, 'chore(release)') && github.ref == 'refs/heads/main') || !contains(github.event.head_commit.message, 'chore(release)')) && !contains(github.event.head_commit.message, 'ci skip') && !startsWith(github.ref, 'refs/tags/')"
    runs-on: ubuntu-latest
    steps:
      - name: Set env
        run: |
          tag=$(echo $(basename $GITHUB_REF))
          echo "Creating tag: $tag"
          echo "TAG=$tag" >> $GITHUB_ENV
      - name: Checkout
        uses: actions/checkout@v3
      - name: CI tests, image build and push tag to cache for main or branch
        uses: whoan/docker-build-with-cache-action@v6
        with:
          username: linode-gh-bot
          password: '${{ secrets.GITHUB_TOKEN }}'
          registry: ${{ env.CACHE_REGISTRY }}
          image_name: ${{ env.CACHE_REPO }}
          image_tag: ${{ env.TAG }}
          build_extra_args: '--build-arg=NPM_TOKEN=${{ secrets.GITHUB_TOKEN }}'
      - name: Retag from cache and push
        run: |
          docker login -u otomi -p $DOCKER_PASSWORD
          docker tag $CACHE_REGISTRY/$CACHE_REPO:$TAG $REPO:$TAG
          docker push $REPO:$TAG
      - if: "contains(github.event.head_commit.message, 'chore(release)')"
        name: Create latest and push git tag
        id: git_tag
        run: |
          docker login -u otomi -p $DOCKER_PASSWORD
          docker tag $REPO:$TAG $REPO:latest
          docker push $REPO:latest
          release_tag=v${COMMIT_MSG#* }
          echo tag=$release_tag >> $GITHUB_OUTPUT
          echo "Releasing $REPO:$release_tag"
          docker tag $REPO:$TAG $REPO:$release_tag
          docker push $REPO:$release_tag
          git config --global user.email $GIT_USER@users.noreply.github.com
          git config --global user.name $GIT_USER
          echo "machine github.com login $GIT_USER password $GIT_PASSWORD" > ~/.netrc
          git tag -am "$COMMIT_MSG" $release_tag && git push --follow-tags origin main
          changelog=$(cat CHANGELOG.md | awk -v n=2 '/### \[[0-9]*/&&!--n{exit}{print}')
          # now do some escaping because github does not help us here:
          changelog="${changelog//'%'/'%25'}"
          changelog="${changelog//$'\n'/'%0A'}"
          changelog="${changelog//$'\r'/'%0D'}"
          echo changes=$changelog >> $GITHUB_OUTPUT
      - if: "contains(github.event.head_commit.message, 'chore(release)')"
        name: Create GitHub release
        uses: ncipollo/release-action@v1.12.0
        env:
          token: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag: ${{ steps.git_tag.outputs.tag }}
          name: Release ${{ steps.git_tag.outputs.tag }}
          body: ${{ steps.git_tag.outputs.changes }}