promote.yml

name: promote

on:
  push:
    branches-ignore:
      - gh-readonly-queue/**
  merge_group:

  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  DRY_RUN: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'maint/')}}
  OWNER: ${{ github.repository_owner }}
  FILE: base-image
  BUILDKIT_PROGRESS: plain
  BUILDX_NO_DEFAULT_LOAD: 1
  BASE_IMAGE_VERSION: ${{ github.ref_name }}-${{ github.sha }}
  APT_HTTP_PROXY: http://172.17.0.1:8000

jobs:
  build:
    uses: ./.github/workflows/build.yml
    permissions:
      contents: read
      checks: write

  release:
    needs: [build]
    runs-on: ubuntu-latest
    timeout-minutes: 120
    permissions:
      contents: write
      packages: write
      issues: write
      id-token: write

    steps:
      - name: docker-config
        uses: containerbase/internal-tools@75d68da3c8cd3d622cf6d4b8d2dfe7e4dc33dfed # v3.0.78
        with:
          command: docker-config

      # full checkout for semantic-release
      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
        with:
          show-progress: false
          fetch-depth: 0
          filter: blob:none

      - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0

      - name: init
        run: |
          echo "OWNER=${OWNER,,}" >> ${GITHUB_ENV}

      - name: 📥 Setup Node.js
        uses: ./.github/actions/setup-node

      - name: Docker registry login
        if: github.ref_name == 'main' || startsWith(github.ref_name, 'maint/')
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

      - name: prepare apt proxy
        run: sudo pnpm prepare:proxy

      - name: semantic-release
        if: github.event_name == 'push'
        run: pnpm semantic-release --dry-run ${{env.DRY_RUN}} --ci ${{env.DRY_RUN != 'true'}}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}