rhema-claw/.gitea/workflows/release.yaml

# The release channel: a v* tag ships the exact-version images (plus
# the sha pin the chart's appVersion resolves to) and the exact-version
# chart. Edge publishing on every main push lives in ci.yml. Release
# candidates (a v* tag with a prerelease suffix, v0.2.0-rc1) publish
# nothing. The daemon crate itself is `publish = false`, so no
# crates.io leg runs here: the crates the claw pulls live in the rhema
# repository's release channel.
name: release
on:
  push:
    tags:
      - "v*"

permissions:
  contents: read
  packages: write

env:
  REGISTRY: git.vhaudiquet.fr
  OWNER: vhaudiquet

jobs:
  verify-tag:
    # cargo build ships whatever the manifest declares, regardless of
    # the tag: a mismatch must fail loudly instead of shipping the
    # wrong version under the release tag.
    runs-on: ubuntu-latest
    steps:
      - name: Check the tag matches the workspace version
        run: |
          crate_version="$(grep -m1 '^version =' Cargo.toml | awk -F'"' '{print $2}')"
          tag_version="${GITHUB_REF_NAME#v}"
          if [ "$crate_version" != "$tag_version" ]; then
            echo "tag $GITHUB_REF_NAME does not match workspace version $crate_version" >&2
            exit 1
          fi

  build-and-push-release-images:
    # The same two deployable images as the edge channel, tagged for the
    # release: the exact version, the rolling stable pin, and the sha
    # the chart's appVersion resolves to.
    if: ${{ !contains(gitea.ref_name, '-') }}
    needs: verify-tag
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - dockerfile: deploy/docker/claw.Dockerfile
            image: rhema-claw
          - dockerfile: deploy/docker/ui.Dockerfile
            image: rhema-claw-ui
    steps:
      - name: Checkout repository
        uses: https://gitea.com/actions/checkout@v4

      - name: Log in to container registry
        uses: docker/login-action@v3
        with:
          registry: https://git.vhaudiquet.fr
          username: ${{ gitea.actor }}
          password: ${{ secrets.PACKAGES_TOKEN }}

      - name: Compute the release version (the tag strips the v)
        id: ver
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          push: true
          tags: |
            git.vhaudiquet.fr/${{ env.OWNER }}/${{ matrix.image }}:${{ steps.ver.outputs.version }}
            git.vhaudiquet.fr/${{ env.OWNER }}/${{ matrix.image }}:stable
            git.vhaudiquet.fr/${{ env.OWNER }}/${{ matrix.image }}:${{ gitea.sha }}

  release-chart:
    # The exact tag version ships as-is so deployments can pin
    # `--version 0.1.0`; appVersion pins the exact commit the image was
    # built from (the chart's default image tag is appVersion, so the
    # sha image above must exist before this runs).
    if: ${{ !contains(gitea.ref_name, '-') }}
    needs: build-and-push-release-images
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: https://gitea.com/actions/checkout@v4

      - name: Install Helm
        uses: azure/setup-helm@v5

      - name: Update Chart version and appVersion
        run: |
          sed -i "s/^version:.*/version: \"${GITHUB_REF_NAME#v}\"/" deploy/helm/rhema-claw/Chart.yaml
          sed -i "s/^appVersion:.*/appVersion: \"${{ gitea.sha }}\"/" deploy/helm/rhema-claw/Chart.yaml

      - name: Lint Helm chart
        run: helm lint deploy/helm/rhema-claw

      - name: Package Helm chart
        run: helm package deploy/helm/rhema-claw

      - name: Push Helm chart to Gitea registry
        run: |
          TOKEN=$(echo -n "${{ secrets.PACKAGES_TOKEN }}" | tr -d '\n')
          curl --fail --user "${{ gitea.actor }}:${TOKEN}" \
            -X POST \
            --upload-file rhema-claw-*.tgz \
            "https://git.vhaudiquet.fr/api/packages/${{ env.OWNER }}/helm/api/charts"