release.yaml

on:
  workflow_dispatch:
    inputs:
      logLevel:
        description: "Log level"
        required: true
        default: "warning"
        type: choice
        options:
          - info
          - warning
          - debug
      tags:
        description: "Tags"
        required: false
        type: boolean
  release:
    types: [created]

env:
  DOCKER_IMAGE: quay.io/authorizer/authorizer
  # Quay exposes no lifetime pull counter (only a trailing 92-day window), so
  # the same image also goes to Docker Hub, which does.
  DOCKERHUB_IMAGE: docker.io/lakhansamani/authorizer
  BUILDKIT_INLINE_CACHE: 1

jobs:
  test:
    name: Go tests (SQLite)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          persist-credentials: false
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true
      - name: Run tests
        run: make test

  smoke:
    name: Release smoke (GraphQL + REST + gRPC + MCP)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          persist-credentials: false
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true
      # Black-box end-to-end pass over every public API surface against the
      # freshly built binary (see internal/e2e/smoke_test.go).
      - name: Run smoke tests
        run: make smoke

  build:
    name: Build and push Docker image
    runs-on: ubuntu-latest
    needs: [test, smoke]
    steps:
      - uses: actions/checkout@v5
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          platforms: linux/amd64,linux/arm64
      - name: Log in to Quay
        uses: docker/login-action@v4
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}
      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Build and push
        env:
          SOURCE_URL: https://github.com/${{ github.repository }}
        run: |
          VERSION=$(basename ${GITHUB_REF})
          TAG_ARGS=(-t "${DOCKER_IMAGE}:${VERSION}" -t "${DOCKERHUB_IMAGE}:${VERSION}")
          # Only a final release moves :latest. Match strict semver with no
          # pre-release suffix (vX.Y.Z / X.Y.Z) so rc/beta/alpha/pre never win.
          if [[ "$VERSION" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            TAG_ARGS+=(-t "${DOCKER_IMAGE}:latest" -t "${DOCKERHUB_IMAGE}:latest")
          fi
          docker buildx build \
            --platform linux/amd64,linux/arm64 \
            --push \
            --provenance=true \
            --sbom=true \
            --build-arg VERSION="${VERSION}" \
            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
            --build-arg VCS_REF="${GITHUB_SHA}" \
            --build-arg SOURCE_URL="${SOURCE_URL}" \
            --cache-from type=registry,ref=${DOCKER_IMAGE}:buildcache \
            --cache-to type=registry,ref=${DOCKER_IMAGE}:buildcache,mode=max \
            "${TAG_ARGS[@]}" \
            .

  trivy-scan:
    name: Vulnerability scan (Trivy)
    runs-on: ubuntu-latest
    needs: [test, build]
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Run Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.DOCKER_IMAGE }}:${{ github.ref_name }}
          format: "sarif"
          output: "trivy-results.sarif"
          severity: "CRITICAL,HIGH"
      - name: Upload Trivy results
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: "trivy-results.sarif"