publish_pipedv1_exp.yaml

name: publish_pipedv1_exp

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release (e.g. v0.1.0)"
        required: true

permissions: {}

env:
  GO_VERSION: 1.25.0
  GHCR: ghcr.io
  GCR: gcr.io
  HELM_VERSION: 3.8.2

jobs:
  binary:
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v3
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - name: Build binary artifacts
        run: |
          make build/go MOD=pipedv1 BUILD_VERSION=${{ inputs.version }} BUILD_OS=linux BUILD_ARCH=amd64 BIN_SUFFIX=_${{ inputs.version }}_linux_amd64
          make build/go MOD=pipedv1 BUILD_VERSION=${{ inputs.version }} BUILD_OS=linux BUILD_ARCH=arm64 BIN_SUFFIX=_${{ inputs.version }}_linux_arm64
          make build/go MOD=pipedv1 BUILD_VERSION=${{ inputs.version }} BUILD_OS=darwin BUILD_ARCH=amd64 BIN_SUFFIX=_${{ inputs.version }}_darwin_amd64
          make build/go MOD=pipedv1 BUILD_VERSION=${{ inputs.version }} BUILD_OS=darwin BUILD_ARCH=arm64 BIN_SUFFIX=_${{ inputs.version }}_darwin_arm64

      - name: Publish binary artifacts
        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda #v2.2.1
        with:
          tag_name: pipedv1/exp/${{ inputs.version }}
          name: pipedv1 experimental ${{ inputs.version }}
          target_commitish: ${{ github.sha }}
          draft: true
          make_latest: "false"
          files: |
            ./.artifacts/pipedv1_${{ inputs.version }}_linux_amd64
            ./.artifacts/pipedv1_${{ inputs.version }}_linux_arm64
            ./.artifacts/pipedv1_${{ inputs.version }}_darwin_amd64
            ./.artifacts/pipedv1_${{ inputs.version }}_darwin_arm64

  # Build images for each platform in parallel using native runners
  container_image_build:
    strategy:
      fail-fast: false
      matrix:
        platform:
          - runner: ubuntu-24.04
            arch: amd64
          - runner: ubuntu-24.04-arm
            arch: arm64
        container_registry:
          - ghcr.io/pipe-cd
          - gcr.io/pipecd
    runs-on: ${{ matrix.platform.runner }}
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

      # Login to push container images.
      - name: Log in to GHCR
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.GHCR }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to GCR
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.GCR }}
          username: _json_key
          password: ${{ secrets.GCR_SA }}

      # Build and push image by digest (without tag)
      - name: Build and push pipedv1 experimental image (${{ matrix.platform.arch }})
        id: build
        uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
        with:
          context: .
          file: cmd/pipedv1/Dockerfile
          platforms: linux/${{ matrix.platform.arch }}
          outputs: type=image,name=${{ matrix.container_registry }}/pipedv1-exp,push-by-digest=true,name-canonical=true,push=true
          cache-from: type=registry,ref=${{ matrix.container_registry }}/pipedv1-exp:latest
          cache-to: type=inline

      # Export digest as artifact for merge job
      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: digests-pipedv1-exp-${{ matrix.platform.arch }}-${{ matrix.container_registry == 'ghcr.io/pipe-cd' && 'ghcr' || 'gcr' }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  # Merge platform-specific images into multi-arch manifest
  container_image_merge:
    runs-on: ubuntu-24.04
    needs: container_image_build
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        container_registry:
          - ghcr.io/pipe-cd
          - gcr.io/pipecd
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Download digests
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: /tmp/digests
          pattern: digests-pipedv1-exp-*-${{ matrix.container_registry == 'ghcr.io/pipe-cd' && 'ghcr' || 'gcr' }}
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

      # Login to push manifest.
      - name: Log in to GHCR
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.GHCR }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to GCR
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.GCR }}
          username: _json_key
          password: ${{ secrets.GCR_SA }}

      # Create and push multi-arch manifest
      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create \
            -t ${{ matrix.container_registry }}/pipedv1-exp:${{ inputs.version }} \
            $(printf '${{ matrix.container_registry }}/pipedv1-exp@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ matrix.container_registry }}/pipedv1-exp:${{ inputs.version }}

  image_chart:
    runs-on: ubuntu-24.04
    needs: container_image_merge
    permissions:
      packages: write
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      # Building and pushing Helm charts.
      - name: Install helm
        uses: azure/setup-helm@v4
        with:
          version: ${{ env.HELM_VERSION }}
      - name: Login to OCI using Helm
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ${{ env.GHCR }} --username ${{ github.repository_owner }} --password-stdin
      - name: Publish helm charts
        run: |
          make build/chart MOD=pipedv1-exp VERSION=${{ inputs.version }}
          helm push .artifacts/pipedv1-exp-${{ inputs.version }}.tgz oci://${{ env.GHCR }}/pipe-cd/chart

      # Publish pipedv1 experimental manifests
      - name: Build pipedv1 experimental quickstart manifests
        run: |
          helm template pipedv1-exp .artifacts/pipedv1-exp-${{ inputs.version }}.tgz --version ${{ inputs.version }} -n pipecd --set quickstart.enabled=true --set quickstart.pipedId=\<YOUR_PIPED_ID\> --set quickstart.pipedKeyData=\<YOUR_PIPED_KEY_DATA\> > quickstart/manifests/pipedv1-exp.yaml
      - name: Publish pipedv1 experimental quickstart manifests
        uses: peter-evans/create-pull-request@v6
        with:
          title: '[bot] Publish pipedv1 experimental quickstart manifests'
          commit-message: '[bot] Publish pipedv1 experimental quickstart manifests'
          branch: 'create-pull-request/publish-pipedv1-experimental-quickstart-manifests'
          body: |
            Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action.
            The workflow is defined [here](https://github.com/pipe-cd/pipecd/blob/master/.github/workflows/publish_pipedv1_exp.yaml).

            **Note:** You need to **close and reopen this PR** manually to trigger status check workflows. (Or just click `Update branch` if possible.)
            For details, see https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#triggering-further-workflow-runs.
          delete-branch: true
          signoff: true
          token: ${{ secrets.GITHUB_TOKEN }}