publish.yml

name: publish

on:
  push:
    branches: ['main']
    tags: ['v*.*.*']

concurrency: ${{ github.ref }}

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-amd64:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: qemu
        uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - name: login
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: meta
        uses: docker/metadata-action@v5
        with:
          flavor: |
            latest=false
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            # Semantic versioning from our tags
            type=semver,pattern={{version}}
            # tag the sha version unless we are a git tag
            type=sha,enable=${{ !startsWith(github.ref, 'refs/tags/v') }},priority=300,format=long,prefix=
      - id: meta-arch
        uses: docker/metadata-action@v5
        with:
          flavor: |
            latest=false
            suffix=-amd64
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            # Semantic versioning from our tags
            type=semver,pattern={{version}}
            # tag the sha version unless we are a git tag
            type=sha,enable=${{ !startsWith(github.ref, 'refs/tags/v') }},priority=300,format=long,prefix=
      - name: update version
        run: |
          echo "const version = \"${{ steps.meta.outputs.version }}\";" > client/src/version.ts
          echo "export default version;" >> client/src/version.ts
      - name: push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta-arch.outputs.tags }}
          labels: ${{ steps.meta-arch.outputs.labels }}
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
      # TEMP fix
      # https://github.com/docker/build-push-action/issues/252
      # https://github.com/moby/buildkit/issues/1896
      - name: cache
        run: |
          rm -rf /tmp/.buildx-cache
          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
      # TEMP fix
      # Something strange is happening with the manifests when we push which
      # breaks the downstream multi-arch-manifest, so pull and push to work
      # around this by resubmitting manifests
      - name: pull-and-push
        run: |
          for t in `echo '${{ steps.meta-arch.outputs.tags }}'`; do
            docker pull $t && docker push $t
          done

  build-arm64:
    runs-on: ["self-hosted", "ARM64"]
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: qemu
        uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - name: login
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: meta
        uses: docker/metadata-action@v5
        with:
          flavor: |
            latest=false
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            # Semantic versioning from our tags
            type=semver,pattern={{version}}
            # tag the sha version unless we are a git tag
            type=sha,enable=${{ !startsWith(github.ref, 'refs/tags/v') }},priority=300,format=long,prefix=
      - id: meta-arch
        uses: docker/metadata-action@v5
        with:
          flavor: |
            latest=false
            suffix=-arm64v8
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            # Semantic versioning from our tags
            type=semver,pattern={{version}}
            # tag the sha version unless we are a git tag
            type=sha,enable=${{ !startsWith(github.ref, 'refs/tags/v') }},priority=300,format=long,prefix=
      - name: update version
        run: |
          echo "const version = \"${{ steps.meta.outputs.version }}\";" > client/src/version.ts
          echo "export default version;" >> client/src/version.ts
      - name: push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta-arch.outputs.tags }}
          labels: ${{ steps.meta-arch.outputs.labels }}
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
      # TEMP fix
      # https://github.com/docker/build-push-action/issues/252
      # https://github.com/moby/buildkit/issues/1896
      - name: cache
        run: |
          rm -rf /tmp/.buildx-cache
          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
      # TEMP fix
      # Something strange is happening with the manifests when we push which
      # breaks the downstream multi-arch-manifest, so pull and push to work
      # around this by resubmitting manifests
      - name: pull-and-push
        run: |
          for t in `echo '${{ steps.meta-arch.outputs.tags }}'`; do
            docker pull $t && docker push $t
          done

  multi-arch-manifest:
    runs-on: ubuntu-latest
    needs: [build-amd64, build-arm64]
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - name: Login
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: meta
        uses: docker/metadata-action@v5
        with:
          flavor: |
            latest=false
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            # Semantic versioning from our tags
            type=semver,pattern={{version}}
            # tag the sha version unless we are a git tag
            type=sha,enable=${{ !startsWith(github.ref, 'refs/tags/v') }},priority=300,format=long,prefix=
      - name: manifest
        run: docker manifest create ${{ steps.meta.outputs.tags }} --amend ${{ steps.meta.outputs.tags }}-amd64 --amend ${{ steps.meta.outputs.tags }}-arm64v8
      - name: manifest-main
        run: docker manifest create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main --amend ${{ steps.meta.outputs.tags }}-amd64 --amend ${{ steps.meta.outputs.tags }}-arm64v8
        if: github.ref == 'refs/heads/main'
      - name: push
        run: docker manifest push ${{ steps.meta.outputs.tags }}
      - name: push-main
        run: docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main
        if: github.ref == 'refs/heads/main'

  github-release:
    runs-on: ubuntu-latest
    needs: [multi-arch-manifest]
    steps:
      - run: "echo \"RELEASE_TAG=${GITHUB_REF#refs/tags/}\" >> $GITHUB_ENV"
      - uses: actions/github-script@v7
        if: startsWith(github.ref, 'refs/tags/')
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            try {
              await github.rest.repos.createRelease({
                draft: false,
                generate_release_notes: true,
                name: process.env.RELEASE_TAG,
                owner: context.repo.owner,
                prerelease: false,
                repo: context.repo.repo,
                tag_name: process.env.RELEASE_TAG,
              });
            } catch (error) {
              core.setFailed(error.message);
            }