release.yml

name: Release

on:
  push:
    branches: [main]

permissions:
  contents: write
  packages: write
  security-events: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  release:
    name: Build & Release
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Check for unreleased version
        id: tag
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION=$(node -p "require('./package.json').version")
          TAG="v${VERSION}"
          # Check if a GitHub Release (not just a tag) exists for this version.
          # Tags are now created on the development branch before merging to main,
          # so we check for the Release object instead.
          if gh release view "$TAG" >/dev/null 2>&1; then
            echo "GitHub Release $TAG already exists — nothing to release."
            echo "should_release=false" >> "$GITHUB_OUTPUT"
          else
            echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
            echo "should_release=true" >> "$GITHUB_OUTPUT"
            echo "New version ${VERSION} detected — will create release."
          fi

      - name: Ensure version tag points to this commit
        if: steps.tag.outputs.should_release == 'true'
        env:
          TAG_VERSION: ${{ steps.tag.outputs.version }}
        run: |
          TAG="v${TAG_VERSION}"
          if git rev-parse "$TAG" >/dev/null 2>&1; then
            TAG_SHA="$(git rev-list -n 1 "$TAG")"
            if [ "$TAG_SHA" != "$GITHUB_SHA" ]; then
              echo "Tag $TAG points to $TAG_SHA, retagging to $GITHUB_SHA (main merge commit)."
              git tag -f "$TAG" "$GITHUB_SHA"
              git push origin "$TAG" --force
            fi
          else
            git tag "$TAG"
            git push origin "$TAG"
          fi

      - name: Log in to GHCR
        if: steps.tag.outputs.should_release == 'true'
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # FORK: upstream's "Log in to Docker Hub" step removed. This fork has no
      # DOCKERHUB_* secrets, and docker/login-action fails on empty credentials,
      # which aborted the whole job BEFORE the build/push step ever ran.

      # FORK: upstream's "Set up QEMU (for arm64 cross-compilation)" step
      # removed along with the arm64 platform below — nothing left to emulate.

      - name: Set up Docker Buildx
        if: steps.tag.outputs.should_release == 'true'
        uses: docker/setup-buildx-action@v4

      - name: Build and push Docker image
        if: steps.tag.outputs.should_release == 'true'
        uses: docker/build-push-action@v7
        with:
          context: .
          push: true
          # FORK: amd64 only. The single deploy target (the yams VM) is x86_64,
          # so arm64 was being emulated under QEMU for an image nothing pulls —
          # and emulated builds are several times slower than native. Re-add
          # linux/arm64 (and the QEMU setup step above) if an ARM host ever
          # needs to run this.
          platforms: linux/amd64
          # FORK: docker.io/jordyjordy/* tags removed — that is upstream's
          # Docker Hub namespace, which this fork has no rights to push to.
          # GHCR only, which IMAGE_NAME resolves to our own repo path.
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.version }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          # FORK / BUG FIX: these scopes did not match. cache-to wrote to
          # `buildx-<version>` while cache-from read `buildx-amd64` and
          # `buildx-arm64`, so no release ever read a cache entry another
          # release had written — every build was cold, and each one left
          # behind a version-scoped entry nothing would ever read again.
          # Read and write the same scope so layers actually carry over.
          cache-from: type=gha,scope=buildx-amd64
          cache-to: type=gha,mode=max,scope=buildx-amd64

      - name: Run Trivy vulnerability scanner
        if: steps.tag.outputs.should_release == 'true'
        uses: aquasecurity/trivy-action@0.35.0
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.version }}
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          ignore-unfixed: true
          trivyignores: .trivyignore
          # FORK: report findings without failing the release. The image is
          # already pushed by the step above, so a hard failure here does not
          # prevent a vulnerable image shipping — it only skips the SARIF
          # upload and the GitHub Release, leaving the run permanently red and
          # the findings INVISIBLE in the Security tab. Non-blocking keeps the
          # results where they can actually be seen and acted on.
          exit-code: "0"

      - name: Upload Trivy results to GitHub Security
        if: always() && steps.tag.outputs.should_release == 'true'
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: trivy-results.sarif

      - name: Generate SBOM
        if: steps.tag.outputs.should_release == 'true'
        uses: anchore/sbom-action@v0.24.0
        with:
          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.version }}
          artifact-name: sbom-tracker-tracker.spdx.json
          output-file: sbom-tracker-tracker.spdx.json

      - name: Extract changelog for this version
        if: steps.tag.outputs.should_release == 'true'
        id: changelog
        env:
          RELEASE_VERSION: ${{ steps.tag.outputs.version }}
        run: |
          NOTES=$(sed -n "/^## \[${RELEASE_VERSION}\]/,/^## /{/^## \[${RELEASE_VERSION}\]/d;/^## /d;p}" CHANGELOG.md | sed '/^$/N;/^\n$/d')
          if [ -z "$NOTES" ]; then
            NOTES="Release v${RELEASE_VERSION}"
          fi
          echo "notes<<CHANGELOG_EOF" >> "$GITHUB_OUTPUT"
          echo "$NOTES" >> "$GITHUB_OUTPUT"
          echo "CHANGELOG_EOF" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        if: steps.tag.outputs.should_release == 'true'
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ steps.tag.outputs.version }}
          name: v${{ steps.tag.outputs.version }}
          body: ${{ steps.changelog.outputs.notes }}
          generate_release_notes: false
          files: sbom-tracker-tracker.spdx.json

      # FORK: upstream's "Sync README to Docker Hub" step removed — no
      # DOCKERHUB_* secrets here, and it targets upstream's Docker Hub repo.