stream-sprout/.github/workflows/publish-release.yml

name: Publish Release 🏷️

on:
  push:
    tags:
      - "v?[0-9]+.[0-9]+.[0-9]+*"
  workflow_dispatch:
    inputs:
      tag:
        description: "The existing tag to publish"
        type: "string"
        required: true

jobs:
  version-check:
    name: "Check versions ⚖️"
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: "Compare App and Git versions 🟰"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          APP_VERSION=$(grep "^readonly VERSION" stream-sprout | cut -d'"' -f2)
          GIT_VERSION=$(git describe --tags | cut -d'-' -f1)
          echo "App version: ${APP_VERSION}"
          echo "Git version: ${GIT_VERSION}"
          if [ "${APP_VERSION}" != "${GIT_VERSION}" ]; then
              echo "ERROR! Version mismatch.";
              exit 1
          fi

  build-release:
    needs: [version-check]
    name: "Build Release 👨‍🔧"
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v6
    - name: "Build .deb 🍥"
      env:
        DEBFULLNAME: "Martin Wimpress"
        DEBEMAIL: "code@wimpress.io"
      run: |
        sudo apt-get -y update
        sudo apt-get -y install debhelper devscripts
        REL_VER=$(grep "^readonly VERSION" stream-sprout | cut -d'"' -f2)
        rm debian/changelog
        dch --package stream-sprout --newversion="${REL_VER}-1" --distribution=unstable "New upstream release." --create
        dpkg-buildpackage --build=binary --no-check-builddeps --compression=gzip
    - name: "Publish release 📤️"
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        REL_VER=$(grep "^readonly VERSION" stream-sprout | cut -d'"' -f2)
        gh release create "${{ github.ref }}" --draft --generate-notes
        gh release upload "${{ github.ref }}" "../stream-sprout_${REL_VER}-1_all.deb" --clobber
        if [ "$(gh release view "${{ github.ref }}" --json assets --template '{{len .assets}}')" -lt 0 ]; then
          exit 1
        fi
        gh release edit "${{ github.ref }}" --draft=false

  publish-flakehub:
    needs: [version-check]
    name: "Publish FlakeHub ❄️"
    runs-on: "ubuntu-24.04"
    permissions:
      id-token: "write"
      contents: "read"
    steps:
      - uses: "actions/checkout@v6"
        with:
          ref: "${{ (inputs.tag != null) && format('refs/tags/{0}', inputs.tag) || '' }}"
      - uses: "DeterminateSystems/nix-installer-action@main"
      - uses: "DeterminateSystems/magic-nix-cache-action@main"
      - uses: "DeterminateSystems/flakehub-push@main"
        with:
          visibility: "public"
          name: "wimpysworld/stream-sprout"
          tag: "${{ inputs.tag }}"

  publish-container:
    needs: [version-check]
    name: "Publish Container 🐋"
    runs-on: ubuntu-24.04
    steps:
      - name: "Checkout 🥡"
        uses: actions/checkout@v6
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Container Buildx
        uses: docker/setup-buildx-action@v4
      - name: Login to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Get stream-sprout version 🔢
        id: get_version
        run: |
          STREAM_SPROUT_VER=$(grep "^readonly VERSION" stream-sprout | cut -d'"' -f2)
          echo "STREAM_SPROUT_VER=$STREAM_SPROUT_VER" >> $GITHUB_ENV
      - name: "Build Container 🐋"
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Containerfile
          push: true
          tags: |
            ghcr.io/${{ github.repository }}:latest-alpine
            ghcr.io/${{ github.repository }}:${{ env.STREAM_SPROUT_VER }}-alpine
            ghcr.io/${{ github.repository }}:${{ github.sha }}-alpine
          platforms: linux/amd64, linux/arm64
      - name: "Generate SBOM"
        uses: anchore/sbom-action@v0
        with:
          image: ghcr.io/${{ github.repository }}:latest-alpine
          registry-username: ${{ github.actor }}
          registry-password: ${{ secrets.GITHUB_TOKEN }}
      - name: Logout from Container Registry
        run: docker logout ghcr.io