release.yaml

---
# yamllint disable rule:line-length
name: release

on:
  pull_request:
    paths:
    - '.github/workflows/release.yaml'
    - '.releaserc.js'
    - 'images/homelab-workspace/**'
    - 'templates/**'
  workflow_dispatch:
    inputs:
      test_publish:
        description: "Test Publish"
        required: true
        type: boolean

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  image_name: ${{ secrets.CONTAINER_REGISTRY }}/${{ vars.CONTAINER_REGISTRY_PATH }}/coder-workspace
  image_cache_name: ${{ secrets.CONTAINER_REGISTRY }}/${{ vars.CONTAINER_REGISTRY_CACHE_PATH }}/coder-workspace
  image_path: images/homelab-workspace
  template_path: templates/kubernetes/homelab-workspace
  default_branch: main

jobs:
  create-release:
    uses: ppat/github-workflows/.github/workflows/release-semantic.yaml@0bf8cd1eeb8e6e9f67fab279bc3be57e0be29c50 # v3.2.0
    with:
      dry_run: ${{ (github.event_name == 'pull_request') || (github.event_name == 'workflow_dispatch' && github.event.inputs.test_publish == 'true') }}
      release_branch: ${{ github.head_ref || github.ref_name }}
    secrets:
      app_id: ${{ secrets.HOMELAB_BOT_APP_ID }}
      app_private_key: ${{ secrets.HOMELAB_BOT_APP_PRIVATE_KEY }}

  publish-image:
    needs: [create-release]
    uses: ppat/github-workflows/.github/workflows/build-docker-image.yaml@0bf8cd1eeb8e6e9f67fab279bc3be57e0be29c50 # v3.2.0
    with:
      image_context_path: images/homelab-workspace
      label_title: "Homelab Workspace"
      label_description: "Homelab workspace image"
      platforms: linux/amd64,linux/arm64
      private_registry_repository: ${{ vars.CONTAINER_REGISTRY_PATH }}/coder-workspace
      private_registry_build_cache: ${{ vars.CONTAINER_REGISTRY_CACHE_PATH }}/coder-workspace
      source_git_ref: ${{ needs.create-release.outputs.released_gitref }}
      timeout_minutes: 180
    secrets:
      private_registry_username: ${{ secrets.CONTAINER_REGISTRY_USERNAME }}
      private_registry_token: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
      private_registry: ${{ secrets.CONTAINER_REGISTRY }}
      tailscale_oauth_client_id: ${{ secrets.TAILSCALE_OAUTH_CLIENT_ID }}
      tailscale_oauth_secret: ${{ secrets.TAILSCALE_OAUTH_SECRET }}
      build_secrets: |
        FETCH_GH_TOKEN=${{ secrets.GITHUB_TOKEN }}

  publish-template:
    needs: [create-release, publish-image]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
    - name: Checkout
      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      with:
        fetch-depth: 1
        persist-credentials: false

    - name: Tailscale Connect
      uses: tailscale/github-action@6cae46e2d796f265265cfcf628b72a32b4d7cade # v3
      with:
        oauth-client-id: ${{ secrets.TAILSCALE_OAUTH_CLIENT_ID }}
        oauth-secret: ${{ secrets.TAILSCALE_OAUTH_SECRET }}
        tags: tag:github-action-ci-runner
        # renovate: datasource=github-releases depName=tailscale/tailscale
        version: "1.96.4"

    - name: Login to Coder
      id: login
      env:
        CODER_URL: "${{ secrets.CODER_URL }}"
      shell: bash
      # yamllint disable-line rule:indentation
      run: |
        while ! curl -fsSL ${CODER_URL} > /dev/null; do
          echo "Waiting for coder service to be ready... sleep 5s!"
          sleep 5
        done
        echo "Coder service is accepting connections..."
        echo

        echo "Generating authentication token..."
        export CODER_SESSION_TOKEN=$(curl -X POST ${CODER_URL}/api/v2/users/login \
          -H 'Content-Type: application/json' \
          -H 'Accept: application/json' \
          --data '{"email": "'${{ secrets.CODER_EMAIL }}'", "password": "'${{ secrets.CODER_PASSWORD }}'"}' \
          | jq -r .session_token)
        echo "::add-mask::${CODER_SESSION_TOKEN}"
        if [[ -z "${CODER_SESSION_TOKEN}" || "${CODER_SESSION_TOKEN}" = "null" ]]; then
          echo "Error generating coder authentication token."
          exit 1
        fi
        echo "Authentication token generated."
        echo
        echo "Determining coder version..."
        export CODER_VERSION=$(curl -fsSL ${CODER_URL}/api/v2/buildinfo | jq -r .version | cut -d'+' -f1 | cut -d'v' -f2)
        echo "Installing coder CLI..."
        curl -fsSL https://coder.com/install.sh | sh -s -- --method standalone --version "${CODER_VERSION}"
        echo
        echo "Logging into Coder..."
        coder login ${CODER_URL}

    - name: Publish template
      id: publish-template
      env:
        TEMPLATE_DIR: ${{ env.template_path }}
        TEMPLATE_VERSION: "${{ needs.create-release.outputs.released_version != 'v0.0.0' && needs.create-release.outputs.released_version || needs.create-release.outputs.released_sha }}"
        WORKSPACE_IMAGE: "${{ secrets.CONTAINER_REGISTRY }}/${{ vars.CONTAINER_REGISTRY_PATH }}/coder-workspace:${{ needs.publish-image.outputs.image_tag }}"
      shell: bash
      # yamllint disable-line rule:indentation
      run: |
        if echo $TEMPLATE_VERSION | grep -E '[0-9]+\.[0-9]+\.[0-9]+'; then
          export TEMPLATE_NAME="$(echo ${TEMPLATE_DIR} | cut -d/ -f3)"
          export RELEASE_MSG="[Release Notes](https://github.com/${{ github.repository }}/releases/tag/${TEMPLATE_VERSION})"
          export TEST_MODE=false
        else
          export TEMPLATE_NAME="$(echo ${TEMPLATE_DIR} | cut -d/ -f3)-test"
          export RELEASE_MSG="[Changes](https://github.com/${{ github.repository }}/commit/${TEMPLATE_VERSION})"
          export TEST_MODE=true
        fi
        echo "Publishing template ${TEMPLATE_DIR} as ${TEMPLATE_NAME}..."
        set -x
        coder template push \
          --directory ${TEMPLATE_DIR} \
          --var workspace_image=${WORKSPACE_IMAGE} \
          --var test_mode=${TEST_MODE} \
          --name ${TEMPLATE_VERSION} \
          --message "${RELEASE_MSG}" \
          --yes \
          ${TEMPLATE_NAME}
        set +x
        echo
        echo "Confirming template has been published..."
        coder templates list --output json > /tmp/templates.json
        export SELECTED_TEMPLATE=$(cat /tmp/templates.json | jq -r '.[] | select(.Template.name == "'${TEMPLATE_NAME}'")')
        if [[ -z $SELECTED_TEMPLATE ]]; then
          echo "Could not find any template published as $TEMPLATE_NAME."
          exit 1
        fi
        echo "Template has been published successfully."

    - name: Tailscale Disconnect
      if: success() || failure()
      run: sudo -E tailscale logout