Release #44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| # Runs every Monday at 8 AM EST (1 PM UTC) | |
| # Note: GitHub Actions uses UTC. Adjust for DST if needed (EDT = UTC-4) | |
| - cron: '0 13 * * 1' | |
| jobs: | |
| release: | |
| name: Semantic Release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| issues: write | |
| pull-requests: write | |
| outputs: | |
| released: ${{ steps.release.outputs.released }} | |
| version: ${{ steps.release.outputs.version }} | |
| tag: ${{ steps.release.outputs.tag }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Run Semantic Release | |
| id: release | |
| uses: python-semantic-release/python-semantic-release@v10.3.1 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| deploy-docs: | |
| name: Deploy Documentation | |
| needs: release | |
| if: needs.release.outputs.released == 'true' | |
| uses: ./.github/workflows/docs.yml | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| promote-images: | |
| # Tag every custom image with the release's semantic version, by retagging its | |
| # current :latest (no rebuild). One version for the whole platform — unchanged | |
| # images get their existing digest aliased under the new version too. | |
| name: Promote images to ${{ needs.release.outputs.version }} | |
| needs: release | |
| if: needs.release.outputs.released == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| REGISTRY: ghcr.io | |
| REGISTRY_NAMESPACE: ${{ github.repository_owner }} | |
| VERSION: ${{ needs.release.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@v5 | |
| with: | |
| enable-cache: true | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to ghcr.io | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Promote each image :latest -> :version | |
| # Retag every image's current :latest (its most-recent main build, whether | |
| # or not it changed this cycle) with the release version. Server-side | |
| # manifest retag — no rebuild, no layer push. Using :latest (not :<sha>) | |
| # means unchanged images, which were never built at the release commit, | |
| # still get tagged — so the whole platform ends up on one version. | |
| run: | | |
| set -euo pipefail | |
| for image in $(uv run ci images .); do | |
| repo="${REGISTRY}/${REGISTRY_NAMESPACE}/${image}" | |
| docker buildx imagetools create "${repo}:latest" --tag "${repo}:${VERSION}" | |
| echo "Promoted \`${repo}:${VERSION}\` (from \`:latest\`)." >> "$GITHUB_STEP_SUMMARY" | |
| done |