release.yml

# SPDX-FileCopyrightText: 2025-2026 Arcangelo Massari <arcangelo.massari@unibo.it>
#
# SPDX-License-Identifier: ISC

name: Release

on:
  workflow_run:
    workflows: ["Run tests"]
    branches: [main]
    types: [completed]

jobs:
  checks:
    name: Verify ${{ matrix.workflow }}
    if: ${{ github.event.workflow_run.conclusion == 'success' && contains(github.event.workflow_run.head_commit.message, '[release]') }}
    runs-on: ubuntu-latest
    permissions:
      actions: read
    strategy:
      fail-fast: false
      matrix:
        workflow: [pyright.yml, ruff.yml, reuse.yml]

    steps:
      - name: Wait for workflow result
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
          WORKFLOW: ${{ matrix.workflow }}
        run: |
          run_id=$(gh run list \
            --workflow "$WORKFLOW" \
            --event push \
            --commit "$HEAD_SHA" \
            --limit 1 \
            --json databaseId \
            --jq '.[0].databaseId')
          if [[ -z "$run_id" ]]; then
            echo "No push run found for $WORKFLOW at $HEAD_SHA"
            exit 1
          fi
          gh run watch "$run_id" --exit-status

  release:
    name: Release
    needs: checks
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.workflow_run.head_branch }}
          fetch-depth: 0

      - name: Verify tested revision
        env:
          TESTED_SHA: ${{ github.event.workflow_run.head_sha }}
        run: |
          checked_out_sha=$(git rev-parse HEAD)
          if [[ "$checked_out_sha" != "$TESTED_SHA" ]]; then
            echo "Checked out $checked_out_sha, but Run tests verified $TESTED_SHA"
            exit 1
          fi

      - name: Install uv
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          enable-cache: true
          python-version: "3.10"

      - name: Install Python
        run: uv python install

      - name: Install dependencies
        run: uv sync --locked

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"

      - name: Install semantic-release
        run: |
          npm install --global \
            semantic-release@25.0.8 \
            @semantic-release/commit-analyzer@13.0.1 \
            @semantic-release/release-notes-generator@14.1.1 \
            @semantic-release/changelog@7.0.0 \
            @semantic-release/exec@7.1.0 \
            @semantic-release/git@11.0.0 \
            @semantic-release/github@12.0.9

      - name: Create Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: semantic-release

      - name: Get latest version tag
        id: version
        run: |
          VERSION=$(git describe --tags --match 'v[0-9]*' --abbrev=0 2>/dev/null || echo "latest")
          # Remove 'v' prefix for Docker image tagging
          VERSION_CLEAN=${VERSION#v}
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
          echo "VERSION_CLEAN=${VERSION_CLEAN}" >> $GITHUB_OUTPUT
          echo "Latest version: ${VERSION} (clean: ${VERSION_CLEAN})"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to Docker Hub
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/heritrace
            ghcr.io/${{ github.repository }}
          tags: |
            type=raw,value=${{ steps.version.outputs.VERSION_CLEAN }},enable=${{ steps.version.outputs.VERSION != 'latest' }}
            type=raw,value=latest,enable={{is_default_branch}}
          flavor: |
            latest=false

      - name: Build and push Docker image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            DOCKER_METADATA_AUTHOR=Arcangelo Massari
            DOCKER_METADATA_DESCRIPTION=HERITRACE - Heritage Enhanced Repository Interface for Tracing, Research, Archival Curation, and Engagement. A semantic data editor for galleries, libraries, archives, and museums (GLAM) professionals.
            DOCKER_METADATA_VERSION=${{ github.ref_name }}

      - name: Update docker-compose.yml with latest version
        run: |
          # Extract the latest version tag from semantic-release output
          VERSION=$(git describe --tags --match 'v[0-9]*' --abbrev=0)
          # Remove 'v' prefix for Docker image tagging
          VERSION_CLEAN=${VERSION#v}

          # Update docker-compose.yml with the new version
          sed -i "s|image: ${{ secrets.DOCKER_HUB_USERNAME }}/heritrace:.*|image: ${{ secrets.DOCKER_HUB_USERNAME }}/heritrace:${VERSION_CLEAN}|g" docker-compose.yml

      - name: Commit updated docker-compose file
        run: |
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          git add docker-compose.yml
          if git diff --staged --quiet; then
            echo "No changes to commit"
          else
            git commit -m "ci: update docker-compose.yml with latest release version"
            git push
          fi