glpi-neuroforge-mega/.gitea/workflows/release-tag.yml

name: release-tag

on:
  push:
    branches:
      - main
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: release-images-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: git.send.nrw
  DOCKER_ORG: sendnrw
  DOCKER_LATEST: latest

jobs:
  meta:
    name: Resolve release metadata
    runs-on: ubuntu-latest
    outputs:
      repo_name: ${{ steps.meta.outputs.repo_name }}
      version: ${{ steps.meta.outputs.version }}
      short_sha: ${{ steps.meta.outputs.short_sha }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Resolve repository version
        id: meta
        shell: bash
        run: |
          set -euo pipefail

          repo_name="${GITHUB_REPOSITORY#*/}"
          short_sha="${GITHUB_SHA::12}"

          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            version="${GITHUB_REF_NAME#v}"
          else
            version="$(git describe --tags --always --match 'v*' 2>/dev/null | sed 's/^v//')"
          fi

          # Docker tags may only contain a conservative character set.
          version="$(printf '%s' "$version" | sed -E 's/[^A-Za-z0-9_.-]+/-/g')"

          echo "repo_name=$repo_name" >> "$GITHUB_OUTPUT"
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "short_sha=$short_sha" >> "$GITHUB_OUTPUT"

          {
            echo '### Release metadata'
            echo "- Repository: \`$repo_name\`"
            echo "- Version: \`$version\`"
            echo "- Commit: \`$short_sha\`"
          } >> "$GITHUB_STEP_SUMMARY"

  release-image:
    name: Build ${{ matrix.image }}
    needs: meta
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      max-parallel: 3
      matrix:
        include:
          - image: neuroforge
            context: ./platform/neuroforge
            file: ./platform/neuroforge/Dockerfile
            target: server
          - image: neuroforge-worker
            context: ./platform/neuroforge
            file: ./platform/neuroforge/Dockerfile
            target: worker
          - image: agent
            context: ./services/agent
            file: ./services/agent/Dockerfile
            target: ''
          - image: agent-data-init
            context: ./services/agent
            file: ./services/agent/Dockerfile
            target: data-init
          - image: knowledge
            context: ./services/knowledge
            file: ./services/knowledge/Dockerfile
            target: ''
          - image: control
            context: ./services/control
            file: ./services/control/Dockerfile
            target: ''

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Configure insecure registry for Docker daemon
        shell: bash
        run: |
          set -euo pipefail
          sudo mkdir -p /etc/docker
          printf '{"insecure-registries":["%s"]}\n' "${REGISTRY}" | sudo tee /etc/docker/daemon.json >/dev/null
          sudo systemctl restart docker
          docker info

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
        with:
          platforms: amd64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          config-inline: |
            [registry."git.send.nrw"]
              http = true
              insecure = true

      - name: Login to registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Prepare image tags
        id: image-meta
        shell: bash
        env:
          REPO_NAME: ${{ needs.meta.outputs.repo_name }}
          VERSION: ${{ needs.meta.outputs.version }}
          SHORT_SHA: ${{ needs.meta.outputs.short_sha }}
          IMAGE_COMPONENT: ${{ matrix.image }}
        run: |
          set -euo pipefail

          image="${REGISTRY}/${DOCKER_ORG}/${REPO_NAME}-${IMAGE_COMPONENT}"

          {
            echo 'tags<<EOF'
            echo "${image}:${VERSION}"
            echo "${image}:sha-${SHORT_SHA}"
            if [[ "${GITHUB_REF}" == "refs/heads/main" ]]; then
              echo "${image}:${DOCKER_LATEST}"
            fi
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"

          echo "image=$image" >> "$GITHUB_OUTPUT"

      - name: Build and push
        id: build
        uses: docker/build-push-action@v7
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.file }}
          target: ${{ matrix.target }}
          platforms: linux/amd64
          push: true
          pull: true
          tags: ${{ steps.image-meta.outputs.tags }}
          labels: |
            org.opencontainers.image.title=${{ needs.meta.outputs.repo_name }}-${{ matrix.image }}
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ needs.meta.outputs.version }}
          cache-from: type=gha,scope=${{ matrix.image }}
          cache-to: type=gha,mode=max,scope=${{ matrix.image }}
          provenance: mode=max
          sbom: true

      - name: Publish build summary
        if: always()
        shell: bash
        env:
          IMAGE: ${{ steps.image-meta.outputs.image }}
          VERSION: ${{ needs.meta.outputs.version }}
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          {
            echo "### ${{ matrix.image }}"
            echo "- Image: \`$IMAGE\`"
            echo "- Version: \`$VERSION\`"
            if [[ -n "$DIGEST" ]]; then
              echo "- Digest: \`$DIGEST\`"
            fi
          } >> "$GITHUB_STEP_SUMMARY"