release.yml

name: Release

# On every v* tag push:
#   1. Build and push a multi-arch container image to GHCR.
#   2. Package and push the Helm chart to GHCR (OCI).
#   3. Create a GitHub Release with the chart artifact.
#
# workflow_dispatch publishes image + chart without creating a GitHub Release.

on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release (without the leading v)"
        required: true
        default: "0.1.0"

permissions:
  contents: write
  packages: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: hyperbyte-cloud/hyperbytedb-dashboard
  CHART_OCI_REPO: oci://ghcr.io/hyperbyte-cloud/charts

jobs:
  versions:
    name: Compute versions
    runs-on: ubuntu-latest
    outputs:
      chart_version: ${{ steps.compute.outputs.chart_version }}
      image_tag: ${{ steps.compute.outputs.image_tag }}
      is_tag_release: ${{ steps.compute.outputs.is_tag_release }}
    steps:
      - name: Compute versions
        id: compute
        run: |
          set -eu
          if [ "${{ github.ref_type }}" = "tag" ]; then
            TAG="${{ github.ref_name }}"
            CHART_VERSION="${TAG#v}"
            IMAGE_TAG="$CHART_VERSION"
            IS_TAG_RELEASE=true
          else
            CHART_VERSION="${{ inputs.version }}"
            IMAGE_TAG="${{ inputs.version }}"
            IS_TAG_RELEASE=false
          fi
          echo "chart_version=$CHART_VERSION" >> "$GITHUB_OUTPUT"
          echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
          echo "is_tag_release=$IS_TAG_RELEASE" >> "$GITHUB_OUTPUT"

  image:
    name: Publish container image
    needs: versions
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry (PAT)
        if: vars.GHCR_AUTH == 'pat'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_PAT }}

      - name: Log in to GitHub Container Registry (GITHUB_TOKEN)
        if: vars.GHCR_AUTH != 'pat'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push multi-arch image
        uses: docker/build-push-action@v6
        env:
          IMAGE_TAG: ${{ needs.versions.outputs.image_tag }}
          IS_TAG_RELEASE: ${{ needs.versions.outputs.is_tag_release }}
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          provenance: false
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.versions.outputs.image_tag }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Tag latest
        if: needs.versions.outputs.is_tag_release == 'true'
        run: |
          set -eu
          IMAGE="${REGISTRY}/${IMAGE_NAME}"
          docker buildx imagetools create \
            -t "${IMAGE}:latest" \
            "${IMAGE}:${{ needs.versions.outputs.image_tag }}"

  chart:
    name: Package & push Helm chart
    needs: [versions, image]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: azure/setup-helm@v4

      - name: Install yq
        run: |
          curl -fsSL "https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_linux_amd64" -o /usr/local/bin/yq
          chmod +x /usr/local/bin/yq

      - name: Log in to GHCR
        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login "$REGISTRY" -u "${{ github.actor }}" --password-stdin

      - name: Stamp default image tag in values.yaml
        env:
          IMAGE_TAG: ${{ needs.versions.outputs.image_tag }}
        run: |
          yq -i '.image.tag = strenv(IMAGE_TAG)' deploy/chart/values.yaml
          echo "--- Stamped values.yaml ---"
          yq '.image' deploy/chart/values.yaml

      - name: Lint chart
        run: helm lint deploy/chart

      - name: Package chart
        env:
          CHART_VERSION: ${{ needs.versions.outputs.chart_version }}
        run: |
          helm package deploy/chart \
            --version     "$CHART_VERSION" \
            --app-version "$CHART_VERSION" \
            --destination .

      - name: Push chart to GHCR
        run: helm push hyperbytedb-dashboard-*.tgz "$CHART_OCI_REPO"

      - name: Upload chart artifact
        uses: actions/upload-artifact@v4
        with:
          name: hyperbytedb-dashboard-chart
          path: hyperbytedb-dashboard-*.tgz
          if-no-files-found: error
          retention-days: 30

  release:
    name: GitHub Release
    needs: [versions, chart]
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: hyperbytedb-dashboard-chart

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          generate_release_notes: true
          files: hyperbytedb-dashboard-*.tgz
          body: |
            ## Container image

            ```text
            ghcr.io/${{ env.IMAGE_NAME }}:${{ needs.versions.outputs.image_tag }}
            ghcr.io/${{ env.IMAGE_NAME }}:latest
            ```

            ## Helm install

            ```sh
            helm install hyperbytedb-dashboard \
              oci://ghcr.io/hyperbyte-cloud/charts/hyperbytedb-dashboard \
              --version ${{ needs.versions.outputs.chart_version }} \
              --namespace hyperbytedb --create-namespace \
              --set hyperbytedb.url=http://hyperbytedb-proxy:8086 \
              --set session.secret="$(openssl rand -base64 32)"
            ```