deploy.yaml

---
name: Deploy

# yamllint disable-line rule:truthy
on:
  release:
    types:
      - published
  workflow_run:
    workflows: [CI]
    branches: [main]
    types:
      - completed
concurrency:
  group: deploy

jobs:
  information:
    if: |
      github.event_name == 'release'
      || (
        github.event_name == 'workflow_run'
        && github.event.workflow_run.conclusion == 'success'
      )
    name: ℹ️ Gather add-on information
    runs-on: ubuntu-latest
    outputs:
      architectures: ${{ steps.information.outputs.architectures }}
      base_image_signer: ${{ steps.information.outputs.codenotary_base_image }}
      build: ${{ steps.information.outputs.build }}
      description: ${{ steps.information.outputs.description }}
      environment: ${{ steps.release.outputs.environment }}
      name: ${{ steps.information.outputs.name }}
      signer: ${{ steps.information.outputs.codenotary_signer }}
      slug: ${{ steps.override.outputs.slug }}
      target: ${{ steps.information.outputs.target }}
      version: ${{ steps.release.outputs.version }}
    steps:
      - name: ⤵️ Check out code from GitHub
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
      - name: 🚀 Run add-on information action
        id: information
        uses: frenck/action-addon-information@ce1377e9851cf569c29329e65fb2c57e67ca0f69 # v1.4.2
      - name: 🚀 Process possible slug override
        id: override
        run: |
          slug="${{ steps.information.outputs.slug }}"
          if [[ ! -z "${{ inputs.slug }}" ]]; then
            slug="${{ inputs.slug }}"
          fi
          echo "slug=$slug" >> $GITHUB_OUTPUT
      - name: ℹ️ Gather version and environment
        id: release
        run: |
          sha="${{ github.sha }}"
          environment="edge"
          version="${sha:0:7}"
          if [[ "${{ github.event_name }}" = "release" ]]; then
            version="${{ github.event.release.tag_name }}"
            version="${version,,}"
            version="${version#v}"
            environment="stable"
            if [[ "${{ github.event.release.prerelease }}" = "true" ]]; then
              environment="beta"
            fi
          fi

          echo "environment=$environment" >> $GITHUB_OUTPUT
          echo "version=$version" >> $GITHUB_OUTPUT

  deploy:
    name: 👷 Build & Deploy ${{ matrix.architecture }}
    needs: information
    runs-on: ubuntu-latest
    strategy:
      matrix:
        architecture: ${{ fromJson(needs.information.outputs.architectures) }}
    steps:
      - name: ⤵️ Check out code from GitHub
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
      - name: 🏗 Set up QEMU
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
      - name: 🏗 Set up Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
      - name: ℹ️ Compose build flags
        id: flags
        run: |
          echo "date=$(date +"%Y-%m-%dT%H:%M:%SZ")" >> $GITHUB_OUTPUT
          from=$(yq --no-colors eval ".build_from.${{ matrix.architecture }}" "${{ needs.information.outputs.build }}")
          echo "from=$from" >> $GITHUB_OUTPUT
          if [[ "${{ matrix.architecture}}" = "amd64" ]]; then
            echo "platform=linux/amd64" >> $GITHUB_OUTPUT
          elif [[ "${{ matrix.architecture }}" = "i386" ]]; then
            echo "platform=linux/386" >> $GITHUB_OUTPUT
          elif [[ "${{ matrix.architecture }}" = "armhf" ]]; then
            echo "platform=linux/arm/v6" >> $GITHUB_OUTPUT
          elif [[ "${{ matrix.architecture }}" = "armv7" ]]; then
            echo "platform=linux/arm/v7" >> $GITHUB_OUTPUT
          elif [[ "${{ matrix.architecture }}" = "aarch64" ]]; then
            echo "platform=linux/arm64/v8" >> $GITHUB_OUTPUT
          else
            echo "::error ::Could not determine platform for architecture ${{ matrix.architecture }}"
            exit 1
          fi
      - name: 🏗  Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: ⤵️ Download base image
        run: docker pull "${{ steps.flags.outputs.from }}"
      - name: 🚀 Build
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
        with:
          load: true
          # yamllint disable rule:line-length
          tags: |
            ghcr.io/${{ github.repository_owner }}/${{ needs.information.outputs.slug }}/${{ matrix.architecture }}:${{ needs.information.outputs.environment }}
            ghcr.io/${{ github.repository_owner }}/${{ needs.information.outputs.slug }}/${{ matrix.architecture }}:${{ needs.information.outputs.version }}
          # yamllint enable rule:line-length
          context: ${{ needs.information.outputs.target }}
          file: ${{ needs.information.outputs.target }}/Dockerfile
          cache-from: |
            type=local,src=/tmp/.docker-cache
            ghcr.io/${{ github.repository_owner }}/${{ needs.information.outputs.slug }}/${{ matrix.architecture }}:edge
          cache-to: type=local,mode=max,dest=/tmp/.docker-cache-new
          platforms: ${{ steps.flags.outputs.platform }}
          build-args: |
            BUILD_ARCH=${{ matrix.architecture }}
            BUILD_DATE=${{ steps.flags.outputs.date }}
            BUILD_DESCRIPTION=${{ needs.information.outputs.description }}
            BUILD_FROM=${{ steps.flags.outputs.from }}
            BUILD_NAME=${{ needs.information.outputs.name }}
            BUILD_REF=${{ github.sha }}
            BUILD_REPOSITORY=${{ github.repository }}
            BUILD_VERSION=${{ needs.information.outputs.version }}
      # yamllint disable rule:line-length
      # https://github.com/docker/build-push-action/issues/252
      # https://github.com/moby/buildkit/issues/1896
      - name: 🚚 Swap build cache
        run: |
          rm -rf /tmp/.docker-cache
          mv /tmp/.docker-cache-new /tmp/.docker-cache
      - name: 🚀 Push
        run: |
          docker push \
            "ghcr.io/${{ github.repository_owner }}/${{ needs.information.outputs.slug }}/${{ matrix.architecture }}:${{ needs.information.outputs.environment }}"
          docker push \
            "ghcr.io/${{ github.repository_owner }}/${{ needs.information.outputs.slug }}/${{ matrix.architecture }}:${{ needs.information.outputs.version }}"
      # yamllint enable rule:line-length
  publish-edge:
    name: 📢 Publish to edge repository
    if: needs.information.outputs.environment == 'edge'
    needs:
      - information
      - deploy
    environment:
      name: ${{ needs.information.outputs.environment }}
    runs-on: ubuntu-latest
    steps:
      - name: 🔐 Load 1Password secrets
        uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2.0.0
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          UPDATER_TOKEN: "op://CI/Github Token/Anmeldedaten"
      - name: 🚀 Dispatch repository updater update signal
        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3
        with:
          token: ${{ env.UPDATER_TOKEN }}
          repository: ${{ github.repository_owner }}/repository-edge
          event-type: update
          client-payload: >
            {
              "addon": "${{ needs.information.outputs.slug }}",
              "name": "${{ needs.information.outputs.name }}",
              "repository": "${{ github.repository }}",
              "version": "${{ needs.information.outputs.version }}"
            }
  publish-stable:
    name: 📢 Publish to stable repository
    if: needs.information.outputs.environment == 'stable'
    needs:
      - information
      - deploy
    environment:
      name: ${{ needs.information.outputs.environment }}
    runs-on: ubuntu-latest
    steps:
      - name: 🔐 Load 1Password secrets
        uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2.0.0
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          UPDATER_TOKEN: "op://CI/Github Token/Anmeldedaten"
      - name: 🚀 Dispatch repository updater update signal
        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3
        with:
          token: ${{ env.UPDATER_TOKEN }}
          repository: ${{ github.repository_owner }}/repository-stable
          event-type: update
          client-payload: >
            {
              "addon": "${{ needs.information.outputs.slug }}",
              "name": "${{ needs.information.outputs.name }}",
              "repository": "${{ github.repository }}",
              "version": "${{ github.event.release.tag_name }}"
            }