release.yml

name: Build and Release

on:
  workflow_dispatch:
    inputs:
      version_bump:
        description: Version increment
        required: true
        default: patch
        type: choice
        options:
          - major
          - minor
          - patch
  push:
    branches: [main]

permissions:
  contents: write
  packages: write
  pull-requests: write
  id-token: write

concurrency:
  group: release
  cancel-in-progress: false

env:
  BUN_CACHE_PATH: ~/.bun/install/cache
  BUN_VERSION: 1.3.14
  CI: true
  NEXT_TELEMETRY_DISABLED: '1'

jobs:
  create-version-pr:
    if: ${{ github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with: { fetch-depth: 0 }
      - name: Prepare version branch
        id: version
        shell: bash
        run: |
          set -euo pipefail
          current_version="$(node -p "require('./package.json').version")"
          IFS='.' read -r major minor patch <<< "$current_version"
          case "${{ inputs.version_bump }}" in
            major)
              version="$((major + 1)).0.0"
              ;;
            minor)
              version="${major}.$((minor + 1)).0"
              ;;
            patch)
              version="${major}.${minor}.$((patch + 1))"
              ;;
            *)
              echo 'Unsupported version increment.' >&2
              exit 1
              ;;
          esac
          branch="release/v${version}"
          node -e "const fs=require('fs'); const p='package.json'; const x=JSON.parse(fs.readFileSync(p,'utf8')); x.version=process.argv[1]; fs.writeFileSync(p,JSON.stringify(x,null,2)+'\\n')" "$version"
          git switch -c "$branch"
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
          git add package.json
          git commit -m "chore: prepare release v${version}"
          git push --set-upstream origin "$branch"
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "branch=$branch" >> "$GITHUB_OUTPUT"
      - name: Open version pull request
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.version.outputs.version }}
          BRANCH: ${{ steps.version.outputs.branch }}
        run: |
          existing="$(gh pr list --head "$BRANCH" --base main --state open --json number --jq '.[0].number')"
          if [[ -n "$existing" ]]; then exit 0; fi
          gh pr create --base main --head "$BRANCH" --label release --title "chore: prepare release v${VERSION}" --body "Automated version bump for release v${VERSION}. Merge this PR to trigger the release workflow."

  detect-release:
    if: ${{ github.event_name == 'push' }}
    runs-on: ubuntu-latest
    outputs:
      should_release: ${{ steps.detect.outputs.should_release }}
      version: ${{ steps.detect.outputs.version }}
      release_tag: ${{ steps.detect.outputs.release_tag }}
      image: ghcr.io/${{ steps.owner.outputs.owner }}/codebuddy2api
    steps:
      - uses: actions/checkout@v7
        with: { fetch-depth: 0 }
      - id: detect
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          version="$(node -p "require('./package.json').version")"
          release_pr="$(gh api --paginate "/repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls" --jq '.[] | select(.base.ref == "main" and (.title | startswith("chore: prepare release v")) and (.head.ref | startswith("release/v"))) | .number' | head -n 1 || true)"
          if [[ -z "$release_pr" ]]; then
            echo 'should_release=false' >> "$GITHUB_OUTPUT"
            exit 0
          fi
          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || exit 1
          echo 'should_release=true' >> "$GITHUB_OUTPUT"
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "release_tag=v${version}" >> "$GITHUB_OUTPUT"
      - id: owner
        run: echo "owner=$(printf '%s' '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"

  verify:
    needs: detect-release
    if: ${{ needs.detect-release.outputs.should_release == 'true' }}
    name: Verify Bun / TypeScript / Coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}
      - uses: actions/cache@v6
        with:
          path: ${{ env.BUN_CACHE_PATH }}
          key: ${{ runner.os }}-bun-${{ env.BUN_VERSION }}-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-${{ env.BUN_VERSION }}-
            ${{ runner.os }}-bun-
      - run: bun install --frozen-lockfile
      - run: bun run lint
      - run: bun run format:check
      - run: bun run typecheck
      - run: bun run test:coverage
  publish-image:
    needs: [detect-release, verify]
    if: ${{ needs.detect-release.outputs.should_release == 'true' }}
    name: Publish ${{ matrix.arch }} image
    runs-on: ${{ matrix.runs_on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { arch: amd64, platform: linux/amd64, runs_on: ubuntu-24.04 }
          - { arch: arm64, platform: linux/arm64, runs_on: ubuntu-24.04-arm }
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
      - id: tags
        env:
          IMAGE: ${{ needs.detect-release.outputs.image }}
          VERSION: ${{ needs.detect-release.outputs.version }}
        run: |
          echo "tags<<EOF" >> "$GITHUB_OUTPUT"
          printf '%s\n' "${IMAGE}:${VERSION}-${{ matrix.arch }}" "${IMAGE}:latest-${{ matrix.arch }}" >> "$GITHUB_OUTPUT"
          echo EOF >> "$GITHUB_OUTPUT"
      - uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile
          platforms: ${{ matrix.platform }}
          push: true
          tags: ${{ steps.tags.outputs.tags }}

  merge-image-manifests:
    needs: [detect-release, publish-image]
    if: ${{ needs.detect-release.outputs.should_release == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
      - env:
          IMAGE: ${{ needs.detect-release.outputs.image }}
          VERSION: ${{ needs.detect-release.outputs.version }}
        run: docker buildx imagetools create -t "${IMAGE}:${VERSION}" -t "${IMAGE}:latest" "${IMAGE}:${VERSION}-amd64" "${IMAGE}:${VERSION}-arm64"

  release:
    needs: [detect-release, merge-image-manifests]
    if: ${{ needs.detect-release.outputs.should_release == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with: { fetch-depth: 0 }
      - env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.detect-release.outputs.release_tag }}
          IMAGE: ${{ needs.detect-release.outputs.image }}:${{ needs.detect-release.outputs.version }}
        run: |
          set -euo pipefail
          previous_tag="$(git tag --sort=-v:refname | grep '^v' | head -n 1 || true)"
          if [[ -n "$previous_tag" ]]; then
            commits="$(git log --pretty=format:'- %h %s' "${previous_tag}..${GITHUB_SHA}")"
          else
            commits="$(git log --pretty=format:'- %h %s' "${GITHUB_SHA}")"
          fi
          notes_file="$(mktemp)"
          {
            echo "Docker image: \`$IMAGE\`"
            echo
            echo '## Commits'
            echo
            if [[ -n "$commits" ]]; then
              printf '%s\n' "$commits"
            else
              echo '- No commits found.'
            fi
          } > "$notes_file"
          gh release create "$TAG" --target "$GITHUB_SHA" --title "$TAG" --latest --notes-file "$notes_file"