107 lines
4.9 KiB
YAML
107 lines
4.9 KiB
YAML
name: Release
|
|
on:
|
|
push:
|
|
tags: ['v[0-9]+.[0-9]+.[0-9]+']
|
|
workflow_dispatch:
|
|
inputs:
|
|
overview_version:
|
|
description: 'Released version to republish the overview for, without the leading v (e.g. 0.1.0)'
|
|
required: true
|
|
|
|
jobs:
|
|
retag-image:
|
|
if: github.event_name == 'push'
|
|
runs-on: docker-host
|
|
steps:
|
|
- uses: actions/checkout@v7.0.1
|
|
# Before anything is published: the contract version IS the release version, so a tag that
|
|
# disagrees would ship a host misreporting itself to every plugin's compatibility check.
|
|
- name: Refuse a tag that disagrees with HOST_API_VERSION
|
|
env:
|
|
GIT_TAG: ${{ github.ref_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
docker run --rm -v "$PWD:/repo" -w /repo node:24.19.0-alpine3.24 \
|
|
node release-tooling/contract-version.ts "$GIT_TAG" src/plugin-host/plugin.ts
|
|
- name: Promote the commit-hash image to semver + latest
|
|
env:
|
|
GIT_TAG: ${{ github.ref_name }}
|
|
REGISTRY_TOKEN: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
|
|
REGISTRY_USER: ${{ vars.DOCKER_REGISTRY_USER }}
|
|
REPO: gitea.larvit.se/${{ github.repository }}
|
|
run: |
|
|
set -euo pipefail
|
|
COMMIT=$(git rev-parse 'HEAD^{commit}')
|
|
VERSION=${GIT_TAG#v}
|
|
printf '%s' "$REGISTRY_TOKEN" | docker login gitea.larvit.se -u "$REGISTRY_USER" --password-stdin
|
|
docker pull "$REPO:$COMMIT" \
|
|
|| { echo "No image $REPO:$COMMIT - release tags must point at a commit whose branch passed the CI gate"; exit 1; }
|
|
# No bare-major tag while major is 0: a 0.x minor is a contract break, so `:0` would move
|
|
# across one and abort boot for everything tracking it. `:0.1` only moves across patches.
|
|
TAGS="$VERSION ${VERSION%.*} latest"
|
|
if [ "${VERSION%%.*}" != "0" ]; then TAGS="$TAGS ${VERSION%%.*}"; fi
|
|
for TAG in $TAGS; do
|
|
docker tag "$REPO:$COMMIT" "$REPO:$TAG"
|
|
docker push "$REPO:$TAG"
|
|
done
|
|
- name: Sync the release tags to Docker Hub
|
|
env:
|
|
DOCKERHUB_IMAGE: docker.io/${{ github.repository }}
|
|
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
DOCKERHUB_USER: ${{ vars.DOCKERHUB_USER }}
|
|
GIT_TAG: ${{ github.ref_name }}
|
|
REPO: gitea.larvit.se/${{ github.repository }}
|
|
run: |
|
|
set -euo pipefail
|
|
COMMIT=$(git rev-parse 'HEAD^{commit}')
|
|
VERSION=${GIT_TAG#v}
|
|
[ -n "$DOCKERHUB_USER" ] && [ -n "$DOCKERHUB_TOKEN" ] \
|
|
|| { echo "Set the DOCKERHUB_USER variable + DOCKERHUB_TOKEN secret (README -> CI/CD)"; exit 1; }
|
|
printf '%s' "$DOCKERHUB_TOKEN" | docker login docker.io -u "$DOCKERHUB_USER" --password-stdin
|
|
TAGS="$VERSION ${VERSION%.*} latest"
|
|
if [ "${VERSION%%.*}" != "0" ]; then TAGS="$TAGS ${VERSION%%.*}"; fi
|
|
for TAG in $TAGS; do
|
|
docker tag "$REPO:$COMMIT" "$DOCKERHUB_IMAGE:$TAG"
|
|
docker push "$DOCKERHUB_IMAGE:$TAG"
|
|
done
|
|
- name: Log out of the registries
|
|
if: always()
|
|
run: |
|
|
set -uo pipefail
|
|
# Cleanup, and the runner's Docker config is shared (AGENTS.md) — a lost race here must not
|
|
# fail a release that published, nor skip the overview job that follows.
|
|
docker logout gitea.larvit.se || true
|
|
docker logout docker.io || true
|
|
|
|
publish-overview:
|
|
if: always() && (github.event_name == 'workflow_dispatch' || needs.retag-image.result == 'success')
|
|
needs: [retag-image]
|
|
runs-on: docker-host
|
|
steps:
|
|
- uses: actions/checkout@v7.0.1
|
|
if: github.event_name == 'push'
|
|
# Publish the named release's own tree, so the page never pairs one Plainpages tag with another
|
|
# release's sidecar pins. A version that was never released fails here.
|
|
- uses: actions/checkout@v7.0.1
|
|
if: github.event_name == 'workflow_dispatch'
|
|
with:
|
|
ref: refs/tags/v${{ inputs.overview_version }}
|
|
- name: Publish the Docker Hub overview
|
|
env:
|
|
DOCKERHUB_REPO: ${{ github.repository }}
|
|
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
DOCKERHUB_USER: ${{ vars.DOCKERHUB_USER }}
|
|
GIT_TAG: ${{ github.ref_name }}
|
|
INPUT_VERSION: ${{ inputs.overview_version }}
|
|
run: |
|
|
set -euo pipefail
|
|
VERSION=${INPUT_VERSION:-${GIT_TAG#v}}
|
|
VERSION=${VERSION#v}
|
|
# An empty dispatch input falls back to the branch name, so gate this like a tag.
|
|
docker run --rm -v "$PWD:/repo" -w /repo node:24.19.0-alpine3.24 \
|
|
node release-tooling/contract-version.ts "$VERSION" src/plugin-host/plugin.ts
|
|
docker run --rm -v "$PWD:/repo" -w /repo \
|
|
-e DOCKERHUB_REPO -e DOCKERHUB_TOKEN -e DOCKERHUB_USER \
|
|
node:24.19.0-alpine3.24 \
|
|
node release-tooling/dockerhub-overview.ts "$VERSION"
|