semantic-release.yml

name: semantic-release
on:
  workflow_dispatch:
  push:
  # Only trigger on merged PRs, not on every PR push
  pull_request:
    types: [closed]
    branches:
      - main

permissions:
  contents: write
  packages: write

jobs:
  semantic-release:
    name: semantic-release
    runs-on: ubuntu-latest
    # Only run on push to main, manual dispatch, or when PR is merged
    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged == true)
    outputs:
      new-release-published: ${{ steps.semantic-release.outputs.new-release-published }}
      new-release-version: ${{ steps.semantic-release.outputs.new-release-version }}
    steps:
      - name: checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: false

      - name: setup-node
        uses: actions/setup-node@v4
        with:
          node-version: "22.17.1"

      - name: create-archives
        run: |
          TEMP_DIR=$(mktemp -d)
          tar --warning=no-file-changed \
              --exclude=".git" \
              --exclude="/.git" \
              --exclude="node_modules" \
              -czf "$TEMP_DIR/action-main-release-trials.tar.gz" .
          zip -r "$TEMP_DIR/action-main-release-trials.zip" . \
              -x ".git" "node_modules"
          mv "$TEMP_DIR"/*.{tar.gz,zip} .
          rm -rf "$TEMP_DIR"

      - name: install-dependencies
        run: npm ci

      - name: verify-dependencies-integrity
        run: npm audit signatures

      - name: create-semantic-release
        id: semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Run semantic-release and capture the output
          npx semantic-release > semantic-release-output.txt 2>&1 || true

          # Check if a new release was published by looking for the success message
          if grep -q "Published release" semantic-release-output.txt; then
            echo "new-release-published=true" >> $GITHUB_OUTPUT

            # Extract the version from the output
            VERSION=$(grep "Published release" semantic-release-output.txt | sed -n 's/.*Published release \([0-9]\+\.[0-9]\+\.[0-9]\+\).*/\1/p')

            if [[ -n "$VERSION" ]]; then
              echo "new-release-version=$VERSION" >> $GITHUB_OUTPUT
              echo "✅ New release published: $VERSION"
            else
              echo "❌ Could not extract version from semantic-release output"
              exit 1
            fi
          else
            echo "new-release-published=false" >> $GITHUB_OUTPUT
            echo "ℹ️  No new release published"
          fi

      - name: update-helm-values
        if: steps.semantic-release.outputs.new-release-published == 'true'
        run: |
          echo "🔍 Debug: new-release-published = ${{ steps.semantic-release.outputs.new-release-published }}"
          echo "🔍 Debug: new-release-version = ${{ steps.semantic-release.outputs.new-release-version }}"

          NEW_VERSION="${{ steps.semantic-release.outputs.new-release-version }}"
          VALUES_FILE="infrastructure/rag/values.yaml"

          # Update Helm values using Python script
          pip install ruamel.yaml
          python3 tools/update-helm-values.py "$NEW_VERSION"

          # Show git diff for verification
          if ! git diff --quiet "$VALUES_FILE"; then
            echo "Changes made to values.yaml:"
            git diff "$VALUES_FILE"
          else
            echo "⚠️  No changes detected in values.yaml"
          fi

      - name: commit-helm-changes
        if: steps.semantic-release.outputs.new-release-published == 'true'
        run: |
          # Check if there are changes to commit
          if ! git diff --quiet infrastructure/rag/values.yaml; then
            echo "📝 Committing Helm values changes..."
            git config --local user.email "action@github.com"
            git config --local user.name "GitHub Action"
            git add infrastructure/rag/values.yaml

            # Create a new commit for the Helm changes (don't amend since semantic-release already pushed)
            git commit -m "chore: update helm chart image tags to v${{ steps.semantic-release.outputs.new-release-version }}"
            git push

            echo "✅ Helm chart changes committed and pushed"
          else
            echo "ℹ️  No Helm chart changes to commit"
          fi

  build-and-push-images:
    name: build-and-push-images
    runs-on: ubuntu-latest
    needs: semantic-release
    if: needs.semantic-release.outputs.new-release-published == 'true'
    strategy:
      matrix:
        service:
          - name: rag-backend
            dockerfile: services/rag-backend/Dockerfile
            image: rag-backend
            build-args: "dev=0"
          - name: admin-backend
            dockerfile: services/admin-backend/Dockerfile
            image: admin-backend
            build-args: "dev=0"
          - name: document-extractor
            dockerfile: services/document-extractor/Dockerfile
            image: document-extractor
            build-args: "dev=0"
          - name: mcp-server
            dockerfile: services/mcp-server/Dockerfile
            image: rag-mcp
            build-args: "dev=0"
          - name: frontend
            dockerfile: services/frontend/apps/chat-app/Dockerfile
            image: frontend
            build-args: ""
          - name: admin-frontend
            dockerfile: services/frontend/apps/admin-app/Dockerfile
            image: admin-frontend
            build-args: ""
    steps:
      - name: debug-job-inputs
        run: |
          echo "🔍 Debug: needs.semantic-release.outputs.new-release-published = ${{ needs.semantic-release.outputs.new-release-published }}"
          echo "🔍 Debug: needs.semantic-release.outputs.new-release-version = ${{ needs.semantic-release.outputs.new-release-version }}"

      - name: checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: false

      - name: login-to-github-container-registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: build-and-push-${{ matrix.service.name }}
        run: |
          docker build \
            --tag ghcr.io/${{ github.repository_owner }}/rag-template/${{ matrix.service.image }}:v${{ needs.semantic-release.outputs.new-release-version }} \
            --tag ghcr.io/${{ github.repository_owner }}/rag-template/${{ matrix.service.image }}:latest \
            --file ${{ matrix.service.dockerfile }} \
            .

          docker push ghcr.io/${{ github.repository_owner }}/rag-template/${{ matrix.service.image }}:v${{ needs.semantic-release.outputs.new-release-version }}
          docker push ghcr.io/${{ github.repository_owner }}/rag-template/${{ matrix.service.image }}:latest

      - name: deployment-summary
        if: strategy.job-index == 0  # Only run on first job in matrix
        run: |
          echo "## 🚀 Deployment Summary" >> $GITHUB_STEP_SUMMARY
          echo "**New version:** v${{ needs.semantic-release.outputs.new-release-version }}" >> $GITHUB_STEP_SUMMARY
          echo "**Services built and deployed:**" >> $GITHUB_STEP_SUMMARY
          echo "- rag-backend" >> $GITHUB_STEP_SUMMARY
          echo "- admin-backend" >> $GITHUB_STEP_SUMMARY
          echo "- document-extractor" >> $GITHUB_STEP_SUMMARY
          echo "- mcp-server" >> $GITHUB_STEP_SUMMARY
          echo "- frontend" >> $GITHUB_STEP_SUMMARY
          echo "- admin-frontend" >> $GITHUB_STEP_SUMMARY
          echo "**Registry:** ghcr.io/${{ github.repository_owner }}/rag-template" >> $GITHUB_STEP_SUMMARY
          echo "**Helm chart updated:** infrastructure/rag/values.yaml" >> $GITHUB_STEP_SUMMARY