release.yml

name: Release

on:
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Docker tag override (for manual runs, e.g. 0.0.1-test)'
        required: false
        default: ''

permissions:
  contents: read
  packages: write

env:
  DOCKERHUB_IMAGE: durableworkflow/server
  GHCR_IMAGE: ghcr.io/durable-workflow/server

jobs:
  publish:
    name: Build and push Docker image
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/checkout@v6

      - name: Validate release publish context and credentials
        id: release_publish
        env:
          INPUT_TAG: ${{ github.event.inputs.tag }}
          DOCKERHUB_IMAGE: ${{ env.DOCKERHUB_IMAGE }}
          GHCR_IMAGE: ${{ env.GHCR_IMAGE }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: scripts/ci/validate-release-image-publish.sh

      - name: Select compatible workflow package version
        id: workflow
        run: scripts/ci/select-compatible-workflow-package-ref.sh

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract exact image metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ env.DOCKERHUB_IMAGE }}
            ${{ env.GHCR_IMAGE }}
          # On a release tag like 0.1.0, produces immutable tags:
          #   durableworkflow/server:0.1.0
          #   ghcr.io/durable-workflow/server:0.1.0
          # workflow_dispatch with a semver input reproduces the same exact tags
          # from the default branch, so skipped tag-triggered releases can be
          # republished after workflow-only fixes.
          tags: |
            type=semver,pattern={{version}},value=${{ steps.release_publish.outputs.tag }},enable=${{ steps.release_publish.outputs.is_semver == 'true' }}
            type=raw,value=${{ steps.release_publish.outputs.tag }},enable=${{ steps.release_publish.outputs.is_semver != 'true' }}
          flavor: |
            latest=false
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            dev.durable-workflow.release.tag=${{ steps.release_publish.outputs.tag }}
            dev.durable-workflow.release.run-id=${{ github.run_id }}
            dev.durable-workflow.release.run-attempt=${{ github.run_attempt }}
            dev.durable-workflow.workflow.package=durable-workflow/workflow
            dev.durable-workflow.workflow.version=${{ steps.workflow.outputs.tag }}
            dev.durable-workflow.workflow.commit=${{ steps.workflow.outputs.commit }}

      - name: Build and push exact image tags
        id: build
        continue-on-error: true
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max,ignore-error=true
          provenance: false
          build-args: |
            WORKFLOW_PACKAGE_REF=${{ steps.workflow.outputs.tag }}
            WORKFLOW_PACKAGE_COMMIT=${{ steps.workflow.outputs.commit }}

      - name: Verify exact image publication
        id: exact
        env:
          RELEASE_TAG: ${{ steps.release_publish.outputs.tag }}
          DOCKERHUB_IMAGE: ${{ env.DOCKERHUB_IMAGE }}
          GHCR_IMAGE: ${{ env.GHCR_IMAGE }}
          DOCKER_BUILD_OUTCOME: ${{ steps.build.outcome || 'skipped' }}
          BUILT_IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
          BUILT_IMAGE_METADATA: ${{ steps.build.outputs.metadata }}
          RELEASE_COMMIT: ${{ github.sha }}
          RELEASE_RUN_ID: ${{ github.run_id }}
          RELEASE_RUN_ATTEMPT: ${{ github.run_attempt }}
          WORKFLOW_PACKAGE_REF: ${{ steps.workflow.outputs.tag }}
          WORKFLOW_PACKAGE_COMMIT: ${{ steps.workflow.outputs.commit }}
        run: scripts/ci/verify-release-exact-images.sh

      - name: Resolve rolling image aliases
        id: rolling
        if: ${{ steps.release_publish.outputs.is_semver == 'true' && steps.exact.outputs.exact_publish_outcome == 'success' }}
        env:
          RELEASE_TAG: ${{ steps.release_publish.outputs.tag }}
          DOCKERHUB_IMAGE: ${{ env.DOCKERHUB_IMAGE }}
          GHCR_IMAGE: ${{ env.GHCR_IMAGE }}
          RELEASE_IMAGE_TAG_SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}.git
        run: scripts/ci/resolve-release-image-rolling-tags.sh

      - name: Promote rolling image aliases
        id: promote_rolling
        if: ${{ steps.rolling.outputs.rolling_should_promote == 'true' }}
        env:
          RELEASE_TAG: ${{ steps.release_publish.outputs.tag }}
          DOCKERHUB_IMAGE: ${{ env.DOCKERHUB_IMAGE }}
          GHCR_IMAGE: ${{ env.GHCR_IMAGE }}
          ROLLING_SHOULD_PROMOTE: ${{ steps.rolling.outputs.rolling_should_promote }}
          RELEASE_IMAGE_TAG_SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}.git
        run: scripts/ci/promote-release-image-rolling-tags.sh

      - name: Write release image publish evidence
        if: ${{ always() }}
        env:
          RELEASE_TAG: ${{ steps.release_publish.outputs.tag || github.event.inputs.tag || github.ref_name }}
          DOCKERHUB_IMAGE: ${{ env.DOCKERHUB_IMAGE }}
          GHCR_IMAGE: ${{ env.GHCR_IMAGE }}
          VALIDATION_OUTCOME: ${{ steps.release_publish.outcome || 'skipped' }}
          EXACT_PUBLISH_OUTCOME: ${{ steps.exact.outputs.exact_publish_outcome || steps.exact.outcome || steps.build.outcome || 'skipped' }}
          EXACT_PUBLISH_REASON: ${{ steps.exact.outputs.exact_publish_reason }}
          EXACT_VERIFY_OUTCOME: ${{ steps.exact.outcome || 'skipped' }}
          DOCKER_BUILD_OUTCOME: ${{ steps.build.outcome || 'skipped' }}
          ROLLING_GUARD_OUTCOME: ${{ steps.rolling.outcome || 'skipped' }}
          ROLLING_PROMOTE_OUTCOME: ${{ steps.promote_rolling.outcome || 'skipped' }}
          ROLLING_ARTIFACT_STATUS: ${{ steps.promote_rolling.outputs.artifact_status || steps.rolling.outputs.artifact_status }}
          ROLLING_SHOULD_PROMOTE: ${{ steps.promote_rolling.outputs.rolling_should_promote || steps.rolling.outputs.rolling_should_promote || 'false' }}
          ROLLING_SUPERSEDED_BY: ${{ steps.promote_rolling.outputs.superseded_by || steps.rolling.outputs.superseded_by }}
          IMAGE_DIGEST: ${{ steps.exact.outputs.image_digest || steps.build.outputs.digest }}
          RELEASE_COMMIT: ${{ github.sha }}
          RELEASE_RUN_ID: ${{ github.run_id }}
          RELEASE_RUN_ATTEMPT: ${{ github.run_attempt }}
          WORKFLOW_PACKAGE_REF: ${{ steps.workflow.outputs.tag }}
          WORKFLOW_PACKAGE_COMMIT: ${{ steps.workflow.outputs.commit }}
        run: scripts/ci/write-release-image-publish-evidence.sh

      - name: Verify live docs release audit after public images
        if: ${{ steps.exact.outputs.exact_publish_outcome == 'success' }}
        env:
          DOCS_RELEASE_AUDIT_ARTIFACT: server
          DOCS_RELEASE_AUDIT_VERSION: ${{ steps.release_publish.outputs.tag || github.event.inputs.tag || github.ref_name }}
          DOCS_RELEASE_AUDIT_EVIDENCE: docs-release-audit-evidence.json
          DOCS_RELEASE_AUDIT_HANDOFF: docs-release-audit-handoff.json
        run: scripts/ci/check-docs-release-audit.sh

      - name: Upload release image publish evidence
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: release-image-publish-evidence
          path: |
            release-image-publish-evidence.json
            docs-release-audit-evidence.json
            docs-release-audit-handoff.json
          if-no-files-found: error