build-push.yml

name: build-push

on:
  push:
    branches-ignore:
      - gh-readonly-queue/**
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.ref_name || github.run_number }}
  cancel-in-progress: ${{ github.ref_name != 'main' && github.event_name == 'push' }}

permissions:
  contents: read

env:
  DRY_RUN: ${{ github.ref_name != github.event.repository.default_branch && !startsWith(github.ref_name, 'maint/') }}
  OWNER: ${{ github.repository_owner }}
  FILE: base
  BUILDKIT_PROGRESS: plain
  BUILDX_NO_DEFAULT_LOAD: 1
  CONTAINERBASE_VERSION: ${{ github.sha }}
  APT_HTTP_PROXY: http://172.17.0.1:8000

jobs:
  build:
    uses: ./.github/workflows/build.yml
    permissions:
      contents: read
      checks: write
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  release:
    needs: [build]
    runs-on: ubuntu-latest
    timeout-minutes: 15

    permissions:
      contents: write
      packages: write
      id-token: write

    steps:
      - name: docker-config
        uses: containerbase/internal-tools@b6d2b362cb282e8088211f792cc2211529936635 # v3.4.17
        with:
          command: docker-config

      # full checkout for semantic-release
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: 0
          show-progress: false
          filter: blob:none # we don't need all blobs

      - uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0

      - name: init
        run: |
          echo "OWNER=${OWNER,,}" >> ${GITHUB_ENV}
          echo "CACHE_WEEK=$(date +%U)" >> $GITHUB_ENV

      - name: 📥 Setup Node.js
        uses: ./.github/actions/setup-node

      - name: Docker registry login
        if: github.ref_name == github.event.repository.default_branch || startsWith(github.ref_name, 'maint/')
        run: |
          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u ${{ secrets.DOCKER_USERNAME }} --password-stdin
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

      - name: prepare apt proxy
        uses: ./.github/actions/prepare-proxy

      - name: semantic-release
        if: github.event_name == 'push'
        run: pnpm semantic-release --dry-run ${{env.DRY_RUN}} --ci ${{env.DRY_RUN != 'true'}}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}