release-on-main.yml

name: Release on main

on:
  push:
    branches:
      - main

permissions:
  contents: write

jobs:
  tag-release:
    name: Tag release
    runs-on: ubuntu-latest
    outputs:
      release_tag: ${{ steps.tag.outputs.release_tag }}

    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Bump patch version and push tag
        id: tag
        run: |
          set -euo pipefail

          max_attempts=5

          for attempt in $(seq 1 "$max_attempts"); do
            git fetch --force --tags origin

            latest=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -1 || true)
            [ -z "$latest" ] && latest="v0.0.0"

            version="${latest#v}"
            major="${version%%.*}"
            rest="${version#*.}"
            minor="${rest%%.*}"
            patch="${rest#*.}"
            release_tag="v${major}.${minor}.$((patch + 1))"

            echo "Attempt ${attempt}/${max_attempts}: bumping ${latest} -> ${release_tag}"

            if git tag "$release_tag" && git push origin "$release_tag"; then
              echo "release_tag=${release_tag}" >> "$GITHUB_OUTPUT"
              exit 0
            fi

            git tag -d "$release_tag" >/dev/null 2>&1 || true
            sleep "$attempt"
          done

          echo "Could not push a unique release tag after ${max_attempts} attempts." >&2
          exit 1

  publish-docker-images:
    name: Publish Docker images
    needs: tag-release
    uses: ./.github/workflows/publish-docker-images.yml
    with:
      tag: ${{ needs.tag-release.outputs.release_tag }}
    secrets: inherit

  deploy-staging:
    name: Deploy staging
    needs:
      - tag-release
      - publish-docker-images
    uses: ./.github/workflows/deploy-staging.yml
    with:
      tag: ${{ needs.tag-release.outputs.release_tag }}
    secrets: inherit