release.yml

name: Release

on:
  release:
    types:
      - published
  workflow_dispatch:

env:
  REGISTRY: ghcr.io

jobs:
  # TODO: DRY w/build.yml
  setup:
    runs-on: ubuntu-latest

    steps:
      # See https://github.com/docker/build-push-action/blob/v2.10.0/TROUBLESHOOTING.md#repository-name-must-be-lowercase
      - name: Sanitize image name
        uses: actions/github-script@v6
        id: image-name
        with:
          result-encoding: string
          script: return '${{ env.REGISTRY }}/${{ github.repository }}'.toLowerCase()

      - name: Get short SHA
        run: |
          echo SHORT_SHA="${GITHUB_SHA:0:7}" >> $GITHUB_ENV

    outputs:
      base_image_name: ${{ steps.image-name.outputs.result }}
      build_image: ${{ steps.image-name.outputs.result }}:${{ env.SHORT_SHA }}

  # TODO: DRY w/build.yml
  push-release:
    needs: setup
    env:
      BASE_IMAGE_NAME: ${{ needs.setup.outputs.base_image_name }}
      BUILD_IMAGE: ${{ needs.setup.outputs.build_image }}

    runs-on: ubuntu-latest

    permissions:
      packages: write

    steps:
      # TODO: Make this fail if tag is a bad semver (see https://github.com/docker/metadata-action/issues/200)
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.BASE_IMAGE_NAME }}
          tags:
            type=semver,pattern={{major}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{version}}

      - name: Log in to the Container registry
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Tag and push image
        uses: akhilerm/tag-push-action@v2
        with:
          src: ${{ env.BUILD_IMAGE }}
          dst: |
            ${{ steps.meta.outputs.tags }}