release.yaml

name: release

# release process:
#
# on main branch merge:
# 1. Calculate next semantic version tag (autotag)
# 2. Build and push Dockerfile.base (ghcr.io/planetscale/ghcommit-action)
# 3. Update image digest in Dockerfile, commit change
# 4. Create GitHub Release for the new version

on:
  push:
    branches:
      - main
    paths:
      - action.yaml
      - '**.sh'
      - Dockerfile
      - Dockerfile.base
  workflow_dispatch:

jobs:
  test:
    runs-on: ubuntu-latest
    if: >
      (github.event_name == 'push' && !contains(toJson(github.event.commits), '[ci skip]') && !contains(toJson(github.event.commits), '[skip ci]'))
      || github.event_name == 'workflow_dispatch'
    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
      - run: make lint
      - run: make test

  release:
    runs-on: ubuntu-latest
    needs: [test]

    permissions:
      contents: write
      packages: write

    steps:
      - name: checkout code with full history (unshallow)
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: install autotag
        # To bump: update AUTOTAG_VERSION and fetch the new SHA from the release's
        # checksums.txt (autotag_<version>_checksums.txt, line matching 'autotag_linux_amd64$').
        env:
          AUTOTAG_VERSION: 1.4.3
          AUTOTAG_SHA256: 85e7ec97d732800bb838085fd3f2e19b2aa2ee3a8da0db7fd0aaf4113a279f3a
        run: |
          set -euo pipefail
          mkdir -p "${RUNNER_TEMP}/bin"
          curl -fsSLo "${RUNNER_TEMP}/bin/autotag" \
            "https://github.com/autotag-dev/autotag/releases/download/v${AUTOTAG_VERSION}/autotag_linux_amd64"
          echo "${AUTOTAG_SHA256}  ${RUNNER_TEMP}/bin/autotag" | sha256sum -c -
          chmod +x "${RUNNER_TEMP}/bin/autotag"

      - name: Calculate new version with autotag
        run: |
          set -xeou pipefail
          new_version=$(${RUNNER_TEMP}/bin/autotag -n)
          echo "new_version=$new_version" >> $GITHUB_ENV

      - name: login to ghcr.io
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # setup qemu and buildx for cross-builds (arm64)
      - name: Set up QEMU (for arm64 builds)
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4

      - name: Build and push Dockerfile.base (ghcr.io/planetscale/ghcommit-action)
        run: |
          set -euo pipefail
          # build and push a multi-arch image, capturing the resulting digest:
          image="ghcr.io/planetscale/ghcommit-action:v${new_version}"
          docker buildx build \
            -f Dockerfile.base \
            --platform linux/amd64,linux/arm64 \
            --metadata-file "${RUNNER_TEMP}/metadata.json" \
            --output type=image,name=$image,oci-mediatypes=true,compression=zstd,push=true \
            .
          digest=$(jq -er '."containerimage.digest"' "${RUNNER_TEMP}/metadata.json")
          echo "image_digest=${digest}" >> "${GITHUB_ENV}"

      - name: Update image digest in Dockerfile
        run: |
          sed -i'' -Ee "s|ghcommit-action@sha256:[a-f0-9]+|ghcommit-action@${image_digest}|" Dockerfile

      - name: Commit changes
        uses: planetscale/ghcommit-action@343f41817a6a0f882f18bbc59fdd37f49452736f # v0.2.19
        with:
          commit_message: "🤖 Bump version in Dockerfile"
          repo: ${{ github.repository }}
          branch: ${{ github.head_ref || github.ref_name }}
        env:
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

      - name: Create GitHub Release
        run: |
            gh release create "v${new_version}" --target main --title "v${new_version}" --generate-notes
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}