ci: build, release and clean up images with the shared org workflows

.github/workflows/actionlint.yml

@@ -0,0 +1,15 @@
+name: actionlint
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions: {}
+
+jobs:
+  # Check name: `actionlint / actionlint`
+  actionlint:
+    uses: Aam-Digital/.github/.github/workflows/actionlint.yml@v1
+    permissions:
+      contents: read

.github/workflows/on-push.yml

@@ -20,7 +20,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version-file: .node-version
+          node-version-file: .nvmrc
 
       - name: Install dependencies
         run: npm ci
@@ -39,25 +39,42 @@ jobs:
       - name: Run e2e tests
         run: npm run test:e2e
 
+  # Check name: `Create Release / release`. Auto release mode: every releasable push to main becomes a full release.
   release:
     name: Create Release
     if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
     needs:
       - test
+    uses: Aam-Digital/.github/.github/workflows/release.yml@v1
     permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
+      contents: read # everything that writes uses the GH_TOKEN PAT (its releases trigger the image build)
+    secrets:
+      token: ${{ secrets.GH_TOKEN }}
 
-      - uses: actions/setup-node@v7
-        with:
-          node-version-file: .node-version
+  # Edge build of every main push (see Aam-Digital/.github): version `X.Y.Z-edge.N` (the last release with the patch
+  # number bumped, plus the commits since), no tag and no GitHub release.
+  edge-version:
+    if: github.ref == 'refs/heads/main'
+    needs:
+      - test
+    uses: Aam-Digital/.github/.github/workflows/edge-version.yml@v1
+    permissions:
+      contents: read
 
-      - name: Semantic Release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
-        run: npx semantic-release
+  # Check names: `edge-build / build (<platform>)`, `edge-build / merge`. Image `X.Y.Z-edge.N`, plus `edge` if this is still the newest main commit.
+  # A newer push cancels an older edge build, so that `edge` never moves back.
+  edge-build:
+    needs: edge-version
+    concurrency:
+      group: edge-build
+      cancel-in-progress: true
+    uses: Aam-Digital/.github/.github/workflows/docker-image.yml@v1
+    permissions:
+      contents: read
+      packages: write
+    with:
+      images: ghcr.io/aam-digital/platform-admin-services
+      version: ${{ needs.edge-version.outputs.version }}
+      tags: ${{ needs.edge-version.outputs.is-head == 'true' && 'edge' || '' }}
+      # package.json's version is what the app reports to Sentry
+      prepare: npm version "$VERSION" --no-git-tag-version --allow-same-version

.github/workflows/on-release.yml

@@ -2,15 +2,34 @@ name: On Semantic Release (build & publish image)
 
 on:
   release:
-    types: [released]
+    types: [published] # created with the GH_TOKEN PAT, releases by the GITHUB_TOKEN trigger no workflows
+
+permissions: {}
 
 jobs:
+  # Check names: `build / build (linux/amd64)`, `build / build (linux/arm64)`, `build / merge`
   build:
-    uses: ./.github/workflows/_build.yml
-    with:
-      docker_tags: |
-        type=raw,value=${{ github.event.release.tag_name }}
-        type=raw,value=latest
+    uses: Aam-Digital/.github/.github/workflows/docker-image.yml@v1
     permissions:
       contents: read
       packages: write
+    with:
+      images: ghcr.io/aam-digital/platform-admin-services
+      # Tag `<version>` (e.g. `1.7.7`, also the `org.opencontainers.image.version` label);
+      # full releases also `stable` and `latest`
+      version: ${{ github.event.release.tag_name }}
+      stable: ${{ !github.event.release.prerelease }}
+      # package.json's version is what the app reports to Sentry
+      prepare: npm version "$VERSION" --no-git-tag-version --allow-same-version
+
+  # After a full release, the edge images (`*-edge.*`) of the finished cycle are no longer needed. The image `edge`
+  # points to is kept.
+  prune-edge-images:
+    if: ${{ !github.event.release.prerelease }}
+    needs: build
+    uses: Aam-Digital/.github/.github/workflows/image-cleanup.yml@v1
+    permissions:
+      actions: write
+      packages: write
+    with:
+      tags: "*-edge.*"

.github/workflows/pr-closed.yml

@@ -0,0 +1,19 @@
+name: On PR closed (delete pre-release image)
+
+on:
+  pull_request:
+    types: [closed]
+
+permissions: {}
+
+jobs:
+  # Check name: `cleanup-image / cleanup`
+  cleanup-image:
+    # PRs from forks have no image
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    uses: Aam-Digital/.github/.github/workflows/image-cleanup.yml@v1
+    permissions:
+      actions: write # cancel a still running PR image build, which would otherwise push pr-<n> after the cleanup
+      packages: write # the package is linked to this repository, so the job token can delete its versions
+    with:
+      build-workflows: pr-release.yml

.github/workflows/pr-release.yml

@@ -3,6 +3,9 @@ name: On PR (build & publish pre-release image)
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test
@@ -13,7 +16,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version-file: .node-version
+          node-version-file: .nvmrc
 
       - name: Install dependencies
         run: npm ci
@@ -27,12 +30,19 @@ jobs:
       - name: Run e2e tests
         run: npm run test:e2e
 
+  # Check names: `build / build (linux/amd64)`, `build / merge`
   build:
     needs: test
-    uses: ./.github/workflows/_build.yml
-    with:
-      docker_tags: |
-        type=raw,value=pr-${{ github.event.number }}
+    uses: Aam-Digital/.github/.github/workflows/docker-image.yml@v1
     permissions:
       contents: read
       packages: write
+    with:
+      images: ghcr.io/aam-digital/platform-admin-services
+      tags: pr-${{ github.event.number }}
+      platforms: linux/amd64
+      # PRs from forks cannot push; only check that the image builds
+      push: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+      # package.json's version is what the app reports to Sentry. npm only accepts semver, hence `0.0.0-pr.<n>`;
+      # the image's version label is its tag `pr-<n>`.
+      prepare: npm version "0.0.0-pr.${{ github.event.number }}" --no-git-tag-version --allow-same-version

.github/workflows/pr-title-lint.yml

@@ -0,0 +1,16 @@
+name: PR title lint
+
+on:
+  # pull_request_target so that it also runs for PRs from forks. Safe here: the shared workflow never checks out PR code
+  # and only reads the PR title from the event payload.
+  pull_request_target: # zizmor: ignore[dangerous-triggers] never checks out PR code, only reads the PR title from the event payload
+    types: [opened, edited, synchronize, reopened]
+
+permissions: {}
+
+jobs:
+  # Check name: `pr-title / Validate PR title`
+  pr-title:
+    uses: Aam-Digital/.github/.github/workflows/pr-title-lint.yml@v1
+    permissions:
+      pull-requests: read

.nvmrc

@@ -0,0 +1 @@
+24.22.0

.releaserc.json

@@ -0,0 +1,15 @@
+{
+  "tagFormat": "${version}",
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    [
+      "@semantic-release/github",
+      {
+        "successComment": false,
+        "failComment": false,
+        "labels": false
+      }
+    ]
+  ]
+}