ci-release.yaml

name: CI - Release

on:
  push:
    tags:
      - 'v*'
  release:
    types: [published]

permissions:
  contents: read
  packages: write

jobs:
  docker-build-and-push:
    strategy:
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    outputs:
      project_name: ${{ steps.meta.outputs.project_name }}
      tag: ${{ steps.tag.outputs.tag }}
      prerelease: ${{ steps.tag.outputs.prerelease }}
    steps:
      - name: Checkout source
        uses: actions/checkout@v7

      - name: Set project name
        id: meta
        run: echo "project_name=${GITHUB_REPOSITORY##*/}" >> "$GITHUB_OUTPUT"

      - name: Determine tag
        id: tag
        run: |
          if [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then
            echo "tag=${GITHUB_REF##refs/tags/}" >> "$GITHUB_OUTPUT"
            echo "prerelease=${{ github.event.release.prerelease }}" >> "$GITHUB_OUTPUT"
          elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
            echo "tag=${GITHUB_REF##refs/tags/}" >> "$GITHUB_OUTPUT"
            echo "prerelease=false" >> "$GITHUB_OUTPUT"
          else
            echo "tag=latest" >> "$GITHUB_OUTPUT"
            echo "prerelease=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Build and push
        id: build
        uses: ./.github/actions/docker-build-and-push
        with:
          image-name: ${{ steps.meta.outputs.project_name }}
          tag: ${{ steps.tag.outputs.tag }}
          registry: ghcr.io/opendatahub-io
          platform: ${{ matrix.platform }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          push-by-digest: "true"

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ strategy.job-index }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  create-manifest-and-scan:
    needs: docker-build-and-push
    runs-on: ubuntu-latest
    steps:
      - name: Checkout source
        uses: actions/checkout@v7

      - name: Download all digests
        uses: actions/download-artifact@v8
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          IMAGE="ghcr.io/opendatahub-io/${{ needs.docker-build-and-push.outputs.project_name }}"
          TAG="${{ needs.docker-build-and-push.outputs.tag }}"
          PRERELEASE="${{ needs.docker-build-and-push.outputs.prerelease }}"
          
          DIGESTS=$(printf "${IMAGE}@sha256:%s " *)
          
          docker buildx imagetools create -t ${IMAGE}:${TAG} ${DIGESTS}
          
          if [[ "${PRERELEASE}" != "true" ]]; then
            docker buildx imagetools create -t ${IMAGE}:latest ${DIGESTS}
          fi

      - name: Trivy security scan
        uses: ./.github/actions/trivy-scan
        with:
          image: ghcr.io/opendatahub-io/${{ needs.docker-build-and-push.outputs.project_name }}:${{ needs.docker-build-and-push.outputs.tag }}