release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write
  packages: write
  issues: write
  pull-requests: write
  id-token: write
  attestations: write
  statuses: write

jobs:
  # Job 1: Run all CI checks first
  ci:
    name: CI Checks
    uses: ./.github/workflows/ci.yml

  # Job 2: Semantic Release
  release:
    name: Semantic Release
    needs: ci
    runs-on: ubuntu-latest
    outputs:
      new_release_published: ${{ steps.semantic.outputs.new_release_published }}
      new_release_version: ${{ steps.semantic.outputs.new_release_version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.tool-versions'

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Get pnpm store directory
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"

      - name: Setup pnpm cache
        uses: actions/cache@v4
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run semantic-release
        id: semantic
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HUSKY: 0
        run: |
          npx semantic-release

          # Check if a new release was published by looking for the tag
          if git describe --tags --exact-match HEAD 2>/dev/null; then
            VERSION=$(git describe --tags --exact-match HEAD | sed 's/^v//')
            echo "new_release_published=true" >> "$GITHUB_OUTPUT"
            echo "new_release_version=$VERSION" >> "$GITHUB_OUTPUT"
          else
            echo "new_release_published=false" >> "$GITHUB_OUTPUT"
          fi

  # Job 3: Build Docker images per platform
  # Uses native ARM runners for public repos, QEMU emulation for private repos
  docker-build:
    name: Build ${{ matrix.image }} (${{ matrix.arch }})
    needs: release
    if: needs.release.outputs.new_release_published == 'true'
    runs-on: ${{ matrix.arch == 'arm64' && github.event.repository.visibility == 'public' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # nginx - amd64
          - image: nginx
            dockerfile: docker/Dockerfile.nginx.prod
            platform: linux/amd64
            arch: amd64
          # nginx - arm64
          - image: nginx
            dockerfile: docker/Dockerfile.nginx.prod
            platform: linux/arm64
            arch: arm64
          # backend - amd64
          - image: backend
            dockerfile: docker/Dockerfile.backend.prod
            platform: linux/amd64
            arch: amd64
          # backend - arm64
          - image: backend
            dockerfile: docker/Dockerfile.backend.prod
            platform: linux/arm64
            arch: arm64
          # sabredav - amd64
          - image: sabredav
            dockerfile: docker/Dockerfile.sabredav.prod
            platform: linux/amd64
            arch: amd64
          # sabredav - arm64
          - image: sabredav
            dockerfile: docker/Dockerfile.sabredav.prod
            platform: linux/arm64
            arch: arm64
          # osm-import - amd64
          - image: osm-import
            dockerfile: docker/Dockerfile.osm-import
            platform: linux/amd64
            arch: amd64
          # osm-import - arm64
          - image: osm-import
            dockerfile: docker/Dockerfile.osm-import
            platform: linux/arm64
            arch: arm64
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: v${{ needs.release.outputs.new_release_version }}

      - name: Set up QEMU
        if: matrix.arch == 'arm64' && github.event.repository.visibility != 'public'
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}-${{ matrix.image }}
          tags: |
            type=raw,value=${{ needs.release.outputs.new_release_version }}-${{ matrix.arch }}

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: ${{ matrix.platform }}
          # Disable provenance/sbom for individual builds - they create manifest lists
          # which break docker manifest create. Attestation is done at manifest level.
          provenance: false
          sbom: false
          build-args: ${{ matrix.image == 'nginx' && format('VITE_SENTRY_DSN={0}', secrets.VITE_SENTRY_DSN) || '' }}
          # Multi-layer caching strategy for maximum cache hits
          cache-from: |
            type=gha,scope=${{ matrix.image }}-${{ matrix.arch }}
            type=registry,ref=ghcr.io/${{ github.repository }}-${{ matrix.image }}:buildcache-${{ matrix.arch }}
          cache-to: |
            type=gha,mode=max,scope=${{ matrix.image }}-${{ matrix.arch }}
            type=registry,ref=ghcr.io/${{ github.repository }}-${{ matrix.image }}:buildcache-${{ matrix.arch }},mode=max

  # Job 4: Create and push multi-arch manifests
  docker-manifest:
    name: Create ${{ matrix.image }} Manifest
    needs: [release, docker-build]
    if: needs.release.outputs.new_release_published == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        image:
          - nginx
          - backend
          - sabredav
          - osm-import
    steps:
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create and push manifest
        id: manifest
        env:
          VERSION: ${{ needs.release.outputs.new_release_version }}
          IMAGE: ghcr.io/${{ github.repository }}-${{ matrix.image }}
        run: |
          # Create manifest for version tag
          docker manifest create ${IMAGE}:${VERSION} \
            ${IMAGE}:${VERSION}-amd64 \
            ${IMAGE}:${VERSION}-arm64

          # Annotate with architecture info
          docker manifest annotate ${IMAGE}:${VERSION} ${IMAGE}:${VERSION}-amd64 --arch amd64
          docker manifest annotate ${IMAGE}:${VERSION} ${IMAGE}:${VERSION}-arm64 --arch arm64

          # Push version manifest and capture digest
          DIGEST=$(docker manifest push ${IMAGE}:${VERSION})
          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"

          # Create and push additional tags
          for TAG in "${VERSION%.*}" "${VERSION%%.*}" "latest"; do
            docker manifest create ${IMAGE}:${TAG} \
              ${IMAGE}:${VERSION}-amd64 \
              ${IMAGE}:${VERSION}-arm64
            docker manifest annotate ${IMAGE}:${TAG} ${IMAGE}:${VERSION}-amd64 --arch amd64
            docker manifest annotate ${IMAGE}:${TAG} ${IMAGE}:${VERSION}-arm64 --arch arm64
            docker manifest push ${IMAGE}:${TAG}
          done

      - name: Attest Docker image
        if: ${{ github.event.repository.visibility == 'public' }}
        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ghcr.io/${{ github.repository }}-${{ matrix.image }}
          subject-digest: ${{ steps.manifest.outputs.digest }}
          push-to-registry: true

  # Job 5: Build and attach frontend assets
  assets:
    name: Build Frontend Assets
    needs: release
    if: needs.release.outputs.new_release_published == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: v${{ needs.release.outputs.new_release_version }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.tool-versions'

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Get pnpm store directory
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"

      - name: Setup pnpm cache
        uses: actions/cache@v4
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build frontend
        env:
          VITE_API_URL: ""
          VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        run: |
          pnpm --filter @freundebuch/shared run build
          pnpm --filter @freundebuch/frontend run build

      - name: Create frontend tarball
        env:
          VERSION: ${{ needs.release.outputs.new_release_version }}
        run: |
          cd apps/frontend
          tar -czvf "../../frontend-${VERSION}.tar.gz" build/

      - name: Attest frontend assets
        if: ${{ github.event.repository.visibility == 'public' }}
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: frontend-${{ needs.release.outputs.new_release_version }}.tar.gz

      - name: Upload frontend assets to release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.release.outputs.new_release_version }}
          files: frontend-${{ needs.release.outputs.new_release_version }}.tar.gz

  # Job 6: Deploy to production server
  deploy:
    name: Deploy to Production
    needs: [release, docker-manifest]
    if: needs.release.outputs.new_release_published == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Setup SSH agent
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.DEPLOY_SSH_KEY }}

      - name: Add host key to known_hosts
        run: |
          mkdir -p ~/.ssh
          echo "[node4.datenknoten.me]:820 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILOtQWdKnvQYP0gA5tnyYrTt+uGJDek3YGWSHi2M6f35" >> ~/.ssh/known_hosts

      - name: Deploy via SSH
        env:
          DEPLOY_HOST: node4.datenknoten.me
          DEPLOY_PORT: 820
          DEPLOY_USER: ${{ secrets.DEPLOY_SSH_USER }}
          VERSION: ${{ needs.release.outputs.new_release_version }}
        run: |
          ssh -p "${DEPLOY_PORT}" "${DEPLOY_USER}@${DEPLOY_HOST}" /home/deploy-freundebuch/deploy.sh "${VERSION}"

      - name: Send deployment notification
        if: success()
        env:
          WEBHOOK_URL: ${{ secrets.DEPLOYMENT_NOTIFICATION }}
          VERSION: ${{ needs.release.outputs.new_release_version }}
          REPO: ${{ github.repository }}
        run: |
          curl -X POST "${WEBHOOK_URL}" \
            -H "Content-Type: application/json" \
            -d "{\"text\": \"✅ **Deployment successful**\n\n**Version:** v${VERSION}\n**Repository:** ${REPO}\n**Release:** https://github.com/${REPO}/releases/tag/v${VERSION}\"}"

  # Job 7: Notify on failure
  notify-failure:
    name: Notify Failure
    needs: [ci, release, docker-build, docker-manifest, assets, deploy]
    if: always() && contains(needs.*.result, 'failure')
    runs-on: ubuntu-latest
    steps:
      - name: Send failure notification
        env:
          WEBHOOK_URL: ${{ secrets.DEPLOYMENT_NOTIFICATION }}
          REPO: ${{ github.repository }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          curl -X POST "${WEBHOOK_URL}" \
            -H "Content-Type: application/json" \
            -d "{\"text\": \"❌ **Release workflow failed**\n\n**Repository:** ${REPO}\n**Run:** ${RUN_URL}\"}"