publish.yaml

name: Publish
on:
  push:
    branches:
      - main
    tags:
      - "v*"

env:
  GO_VERSION: 1.22.2

jobs:
  version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.VERSION }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-tags: true
      - name: Fetch history for all tags
        run: git fetch --prune --unshallow
      - name: Calculate version
        id: version
        run: |
          VERSION="v0.0.0"
          if [ -z "$(git tag)" ]; then
            echo "No tags found"
            VERSION="$(echo "v0.0.0-$(git rev-list HEAD --count)-$(git describe --dirty --always)" | sed 's/-/./2' | sed 's/-/./2' | sed 's/-/./2')"
          else
            echo "Tags found:\n$(git tag)"
            VERSION="$(git describe --dirty --always --tags --match 'v*' | sed 's|.*/||' | sed 's/-/./2' | sed 's/-/./2' | sed 's/-/./2')"
          fi
          echo "Version is ${VERSION}"
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
  image:
    runs-on: ubuntu-latest
    needs:
      - version
    permissions:
      packages: write
      contents: read
      id-token: write
      attestations: write
    strategy:
      matrix:
        app: [crik, node-state-server]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: false
      - name: Find the Go Environment
        id: go
        run: |
          echo "cache=$(go env GOCACHE)" >> $GITHUB_OUTPUT
          echo "mod=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT

      - name: Cache Go Dependencies
        uses: actions/cache@v4
        with:
          path: ${{ steps.go.outputs.mod }}
          key: mod-cache-${{ hashFiles('**/go.sum') }}
          restore-keys: mod-cache-

      - name: Cache Go Build Cache
        uses: actions/cache@v4
        with:
          path: ${{ steps.go.outputs.cache }}
          key: build-cache-${{ matrix.app }}-${{ hashFiles('**/go.sum') }}
          restore-keys: build-cache-${{ matrix.app }}-

      - name: Check if code-gen changes anything
        run: |
          go generate ./...
          git diff --exit-code && echo "generated code is up to date" || (echo "go generate resulted in changes" && git diff && exit 1)

      - name: Build
        env:
          PLATFORMS: linux/amd64,linux/arm64
        run: |
          for platform in $(echo $PLATFORMS | tr "," "\n"); do
            export os=$(echo $platform | cut -d'/' -f1)
            export arch=$(echo $platform | cut -d'/' -f2)
            echo "Building for $os/$arch"
            CGO_ENABLED=0 GOOS=${os} GOARCH=${arch} go build -o .work/bin/${{ matrix.app }}-${os}-${arch} cmd/${{ matrix.app }}/main.go &
          done
          wait

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to Github Container Registry
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
      - name: Generate metadata for images
        uses: docker/metadata-action@v5
        id: metadata
        with:
          images: ghcr.io/qawolf/crik/${{ matrix.app }}
          tags: |
            type=ref,event=branch
            type=sha,format=short,prefix=
            ${{ needs.version.outputs.VERSION }}
      - name: Build and push
        id: push
        uses: docker/build-push-action@v5
        with:
          context: .
          file: cmd/${{ matrix.app }}/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.metadata.outputs.tags }}
          labels: ${{ steps.metadata.outputs.labels }}

      - name: Attest
        uses: actions/attest-build-provenance@v1
        with:
          subject-name: ghcr.io/qawolf/crik/${{ matrix.app }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true
  chart:
    permissions:
      packages: write
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    needs:
      - image
      - version
    strategy:
      matrix:
        chart: [node-state-server]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Helm
        uses: azure/setup-helm@v4
      - name: Log in to GitHub Container Registry
        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin
      - name: Install yq
        uses: dcarbone/install-yq-action@v1.1.1
      - name: Push the chart
        id: push
        env:
          VERSION: ${{ needs.version.outputs.VERSION }}
        run: |
          set -e
          # Helm doesn't accept v prefix in version.
          CHART_TAG=$(echo ${VERSION} | cut -d'v' -f2)
          if [ "${{ matrix.chart }}" == "node-state-server" ]; then
            yq -i ".nodeStateServer.image.tag = \"${VERSION}\"" cluster/charts/${{ matrix.chart }}/values.yaml
            echo "Final values.yaml"
            cat cluster/charts/${{ matrix.chart }}/values.yaml
          fi
          helm package cluster/charts/${{ matrix.chart }} --dependency-update --version=${CHART_TAG} --app-version=${CHART_TAG}
          helm push ${{ matrix.chart }}-${CHART_TAG}.tgz oci://ghcr.io/qawolf/crik/charts 2>&1 | tee push.log
          DIGEST=$(cat push.log | sed -n 's/.*sha256:\([^ ]*\).*/sha256:\1/p')
          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"

      # Attestation is not yet available for OCI images.
      #
      # - name: Attest
      #   uses: actions/attest-build-provenance@v1
      #   with:
      #     subject-name: ghcr.io/qawolf/crik/charts/${{ matrix.chart }}
      #     subject-digest: ${{ steps.push.outputs.digest }}
      #     push-to-registry: true