.release.yml

# reusable workflow
name: .release

on:
  workflow_call:
    inputs:
      name:
        required: true
        type: string
      envs:
        required: false
        type: string
      release:
        required: false
        type: boolean

env:
  REPO_SLUG: dockereng/packaging
  BUILD_CACHE_REGISTRY_SLUG: dockereng/packaging-cache

jobs:
  prepare:
    runs-on: ubuntu-20.04
    outputs:
      pkgs: ${{ steps.set.outputs.pkgs }}
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Set outputs
        id: set
        run: |
          pkgs=$(make gha-matrix GHA_MATRIX=all)
          echo "pkgs=$pkgs" >> $GITHUB_OUTPUT
      -
        name: Show outputs
        run: |
          echo pkgs=${{ steps.set.outputs.pkgs }}

  build:
    runs-on: ubuntu-20.04
    needs:
      - prepare
    strategy:
      fail-fast: true
      matrix:
        pkg: ${{ fromJson(needs.prepare.outputs.pkgs) }}
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Environment variables
        run: |
          for l in "${{ inputs.envs }}"; do
            echo "${l?}" >> $GITHUB_ENV
          done
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: latest
      -
        name: Set up remote builders
        if: matrix.pkg != 'static' # do not use remote builders for static builds (cross)
        uses: docker/setup-buildx-action@v3
        with:
          version: latest
          driver: remote
          endpoint: docker-container://buildx_buildkit_${{ steps.buildx.outputs.name }}0
          append: |
            - name: aws_graviton2
              endpoint: tcp://${{ secrets.AWS_ARM64_HOST }}:1234
              platforms: darwin/arm64,linux/arm64,linux/arm/v5,linux/arm/v6,linux/arm/v7,windows/arm64
#            - name: linuxone_s390x
#              endpoint: tcp://${{ secrets.LINUXONE_S390X_HOST }}:1234
#              platforms: linux/s390x
        env:
          BUILDER_NODE_1_AUTH_TLS_CACERT: ${{ secrets.AWS_ARM64_CACERT }}
          BUILDER_NODE_1_AUTH_TLS_CERT: ${{ secrets.AWS_ARM64_CERT }}
          BUILDER_NODE_1_AUTH_TLS_KEY: ${{ secrets.AWS_ARM64_KEY }}
#          BUILDER_NODE_2_AUTH_TLS_CACERT: ${{ secrets.LINUXONE_S390X_CACERT }}
#          BUILDER_NODE_2_AUTH_TLS_CERT: ${{ secrets.LINUXONE_S390X_CERT }}
#          BUILDER_NODE_2_AUTH_TLS_KEY: ${{ secrets.LINUXONE_S390X_KEY }}
      -
        name: Build
        run: |
          make -C pkg/${{ inputs.name }} run-pkg-${{ matrix.pkg }}
      -
        name: List artifacts
        run: |
          tree -nh ./pkg/${{ inputs.name }}/bin
      -
        name: Verify
        run: |
          make -C pkg/${{ inputs.name }} run-verify-${{ matrix.pkg }}
      -
        name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-pkg-${{ inputs.name }}-${{ matrix.pkg }}
          path: ./pkg/${{ inputs.name }}/bin/*
          if-no-files-found: ignore
          retention-days: 1

  release:
    runs-on: ubuntu-20.04
    needs:
      - build
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Environment variables
        run: |
          for l in "${{ inputs.envs }}"; do
            echo "${l?}" >> $GITHUB_ENV
          done
      -
        name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          path: ./pkg/${{ inputs.name }}/bin
          pattern: release-pkg-*
          merge-multiple: true
      -
        name: Resolve metadata
        run: |
          make -C pkg/${{ inputs.name }} metadata
          for l in $(cat ./pkg/${{ inputs.name }}/bin/metadata.env); do
            export "${l?}"
            echo "${l?}" >> $GITHUB_ENV
          done
          if [ "${{ github.event_name }}" = "schedule" ]; then
            echo "GIT_TAG=nightly/${{ inputs.name }}/$VERSION" >> $GITHUB_ENV
          else
            echo "GIT_TAG=${{ inputs.name }}/$VERSION" >> $GITHUB_ENV
          fi
      -
        name: List artifacts
        run: |
          tree -nh ./pkg/${{ inputs.name }}/bin | tee /tmp/packages.txt
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.REPO_SLUG }}
          tags: |
            type=ref,event=pr
            type=raw,value=${{ env.GIT_TAG }}
            type=raw,value=${{ env.GIT_TAG }}-${{ github.run_number }}
          labels: |
            com.github.docker.packaging.event_name=${{ github.event_name }}
            com.github.docker.packaging.run_id=${{ github.run_id }}
            com.github.docker.packaging.run_number=${{ github.run_number }}
          bake-target: meta-helper
      -
        name: Login to Docker Hub
        uses: docker/login-action@v3
        if: ${{ inputs.release || github.event_name == 'schedule' }}
        with:
          username: ${{ secrets.DOCKERPUBLICBOT_USERNAME }}
          password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: latest
      -
        name: Build image
        id: build
        uses: docker/bake-action@v4
        with:
          workdir: ./pkg/${{ inputs.name }}
          files: |
            ./docker-bake.hcl
            ${{ steps.meta.outputs.bake-file }}
          targets: release
          provenance: false
          set: |
            *.output=type=image,push=${{ inputs.release || github.event_name == 'schedule' }}
      -
        name: Prepare release
        run: |
          cat > "/tmp/release-metadata.json" <<-EOF
          ${{ steps.build.outputs.metadata }}
          EOF
          
          for tag in $(jq -r '.tags[]' <<< "$DOCKER_METADATA_OUTPUT_JSON"); do
            echo "* \`${tag}\`" >> /tmp/tags.txt
          done

          cat > "/tmp/summary.txt" <<-EOF
          * repo: ${REPO}
          * ref: \`${REF}\`
          * version: \`${VERSION}\`
          * commit: [\`${COMMIT}\`](${REPO}/commit/${COMMIT})
          EOF

          if [ "${{ inputs.name }}" = "containerd" ]; then
            cat >> "/tmp/summary.txt" <<-EOF
          * runc
            * repo: ${RUNC_REPO}
            * ref: \`${RUNC_REF}\`
            * version: \`${RUNC_VERSION}\`
            * commit: [\`${RUNC_COMMIT}\`](${RUNC_REPO}/commit/${RUNC_COMMIT})
          EOF
          fi

          cat >> "/tmp/summary.txt" <<-EOF
          * packages: \`$(find ./pkg/${{ inputs.name }}/bin -type f | wc -l)\` files
          * size: \`$(du -sh ./pkg/${{ inputs.name }}/bin | awk '{print $1}')\`
          EOF

          cat /tmp/summary.txt >> $GITHUB_STEP_SUMMARY
      -
        name: Set outputs
        uses: actions/github-script@v7
        id: release-metadata
        with:
          script: |
            const fs = require('fs');
            core.setOutput('tags', fs.readFileSync('/tmp/tags.txt', {encoding: 'utf8'}));
            core.setOutput('summary', fs.readFileSync('/tmp/summary.txt', {encoding: 'utf8'}));
      -
        name: Create release
        uses: crazy-max/ghaction-github-release@v2
        if: ${{ inputs.release }}
        with:
          name: ${{ env.GIT_TAG }}-${{ github.run_number }}
          draft: true
          tag_name: ${{ env.GIT_TAG }}-${{ github.run_number }}
          target_commitish: ${{ github.sha }}
          files: |
            /tmp/packages.txt
            ./pkg/${{ inputs.name }}/bin/metadata.env
            /tmp/release-metadata.json
          body: |
            Image available at [https://hub.docker.com/r/${{ env.REPO_SLUG }}](https://hub.docker.com/r/${{ env.REPO_SLUG }}).
            
            ## Tags
            ${{ steps.release-metadata.outputs.tags }}
            
            ## Summary
            ${{ steps.release-metadata.outputs.summary }}
            
            ## Usage
            Extract with [Undock](https://github.com/crazy-max/undock):
            ```console
            $ undock --wrap --rm-dist --all ${{ env.REPO_SLUG }}:${{ steps.meta.outputs.version }} ./${{ inputs.name }}/${{ env.VERSION }}
            ```
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}