reusable-release.yml

name: Reusable Release

permissions:
  contents: read

on:
  workflow_call:
    inputs:
      version:
        description: 'Version calculated in Build phase'
        required: true
        type: string
      pep440_version:
        description: 'PEP 440 compliant version for Python packages'
        required: false
        type: string
        default: ''
      components:
        description: 'A JSON string array of components to release'
        required: false
        type: string
        default: '["api"]'
      release_type:
        description: 'Type of release (feature or final)'
        required: true
        type: string
      create_github_release:
        description: 'Whether to create a GitHub release'
        required: false
        type: boolean
        default: true
      tag_prefix:
        description: 'Prefix for the git release tag (e.g. "docker-v" or "chart-v")'
        required: false
        type: string
        default: 'docker-v'
    secrets:
      DOCKERHUB_USER:
        required: true
      DOCKERHUB_TOKEN:
        required: true
      PYPI_TOKEN:
        required: false
      TEST_PYPI_TOKEN:
        required: false

env:
  GIT_USER_NAME: ${{ vars.GIT_USER_NAME || 'GitHub Pipeline' }}
  GIT_USER_EMAIL: ${{ vars.GIT_USER_EMAIL || 'github_pipeline@fairagro.net' }}
  IMAGE_BASE_NAME: ${{ vars.IMAGE_BASE_NAME || 'fairagro-advanced-middleware' }}
  DOCKERHUB_NAMESPACE: ${{ vars.DOCKERHUB_NAMESPACE || 'zalf' }}
  GHCR_NAMESPACE: ${{ github.repository_owner }}

jobs:
  push-dockerhub:
    name: DockerPush/DockerHub
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      matrix:
        component: ${{ fromJson(inputs.components) }}
    outputs:
      digest: ${{ steps.push.outputs.digest }}

    steps:
      - name: Download Docker image artifact
        uses: actions/download-artifact@v8
        with:
          name: docker-image-${{ matrix.component }}-${{ inputs.version }}

      - name: Load Docker image
        run: |
          docker load < docker-image-${{ matrix.component }}.tar.gz
          echo "LOCAL_TAG=local/${{ env.IMAGE_BASE_NAME }}-${{ matrix.component }}:${{ inputs.version }}" >> $GITHUB_ENV

      - name: Login to DockerHub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USER }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Tag and Push to DockerHub
        id: push
        run: |
          DH_TAG="${{ env.DOCKERHUB_NAMESPACE }}/${{ env.IMAGE_BASE_NAME }}-${{ matrix.component }}:${{ inputs.version }}"
          docker tag ${{ env.LOCAL_TAG }} $DH_TAG
          docker push $DH_TAG
          DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' $DH_TAG | cut -d'@' -f2)
          echo "digest=$DIGEST" >> $GITHUB_OUTPUT
          echo "✅ Pushed to DockerHub: $DH_TAG"

  push-ghcr:
    name: DockerPush/GHCR
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        component: ${{ fromJson(inputs.components) }}

    steps:
      - name: Download Docker image artifact
        uses: actions/download-artifact@v8
        with:
          name: docker-image-${{ matrix.component }}-${{ inputs.version }}

      - name: Load Docker image
        run: |
          docker load < docker-image-${{ matrix.component }}.tar.gz
          echo "LOCAL_TAG=local/${{ env.IMAGE_BASE_NAME }}-${{ matrix.component }}:${{ inputs.version }}" >> $GITHUB_ENV

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Tag and Push to GHCR
        run: |
          REPO_LOWER=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
          GHCR_TAG="ghcr.io/$REPO_LOWER/${{ matrix.component }}:${{ inputs.version }}"
          docker tag ${{ env.LOCAL_TAG }} $GHCR_TAG
          docker push $GHCR_TAG
          echo "✅ Pushed to GHCR: $GHCR_TAG"

  publish-pypi:
    name: PyPI/Publish
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Download Python packages artifact
        uses: actions/download-artifact@v8
        with:
          name: python-packages-${{ inputs.version }}
          path: dist/

      - uses: astral-sh/setup-uv@v7

      - name: Publish to PyPI (final release)
        if: inputs.release_type == 'final'
        env:
          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}
        run: uv publish --publish-url https://upload.pypi.org/legacy/ dist/*

      - name: Publish to TestPyPI (pre-release)
        if: inputs.release_type == 'feature'
        env:
          UV_PUBLISH_TOKEN: ${{ secrets.TEST_PYPI_TOKEN }}
        run: uv publish --publish-url https://test.pypi.org/legacy/ dist/*

  create-release-tag:
    name: CreateReleaseTag/Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      timestamp: ${{ steps.timestamp.outputs.value }}

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Generate timestamp
        id: timestamp
        run: echo "value=$(date +%Y%m%d%H%M%S)" >> $GITHUB_OUTPUT

      - name: Create version tag
        uses: mathieudutour/github-tag-action@v6.2
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          custom_tag: ${{ steps.timestamp.outputs.value }}-${{ inputs.tag_prefix }}${{ inputs.version }}
          tag_prefix: ""

  github-release:
    name: GitHubRelease/Release
    if: ${{ always() && inputs.create_github_release == true && needs.create-release-tag.result == 'success' }}
    needs: [push-dockerhub, push-ghcr, publish-pypi, create-release-tag]
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Download SBOM artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: sbom-*
          merge-multiple: true
          path: sboms

      - name: Download Python packages artifact
        if: needs.publish-pypi.result == 'success'
        uses: actions/download-artifact@v8
        with:
          name: python-packages-${{ inputs.version }}
          path: pypi-dist/

      - name: Generate release body
        run: |
          COMPONENT=$(echo '${{ inputs.components }}' | jq -r '.[0]')
          DH_IMAGE="${{ env.DOCKERHUB_NAMESPACE }}/${{ env.IMAGE_BASE_NAME }}-${COMPONENT}:${{ inputs.version }}"
          DH_URL="https://hub.docker.com/r/${{ env.DOCKERHUB_NAMESPACE }}/${{ env.IMAGE_BASE_NAME }}-${COMPONENT}"
          REPO_LOWER=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
          GHCR_IMAGE="ghcr.io/${REPO_LOWER}/${COMPONENT}:${{ inputs.version }}"
          GHCR_URL="https://ghcr.io/${REPO_LOWER}/${COMPONENT}"
          TAG="${{ needs.create-release-tag.outputs.timestamp }}-${{ inputs.tag_prefix }}${{ inputs.version }}"
          REPO_BASENAME=$(basename "${{ github.repository }}")
          PYPI_VERSION="${{ inputs.pep440_version || inputs.version }}"
          PYPI_REGISTRY=$([ "${{ inputs.release_type }}" = "final" ] && echo "https://pypi.org" || echo "https://test.pypi.org")
          DOCKER_SUCCESS=$([[ "${{ needs.push-dockerhub.result }}" == "success" || "${{ needs.push-ghcr.result }}" == "success" ]] && echo "true" || echo "false")
          PYPI_SUCCESS=$([[ "${{ needs.publish-pypi.result }}" == "success" ]] && echo "true" || echo "false")

          {
            # --- Docker section ---
            if [[ "$DOCKER_SUCCESS" == "true" ]]; then
              echo "## Docker Image"
              echo ""
              if [[ "${{ needs.push-dockerhub.result }}" == "success" ]]; then
                echo "| Platform | Image Digest |"
                echo "| --- | --- |"
                echo "| linux/amd64 | \`${{ needs.push-dockerhub.outputs.digest }}\` |"
                echo ""
              fi
              if [[ "${{ needs.push-dockerhub.result }}" == "success" ]]; then
                echo "**[Pull from DockerHub](${DH_URL})**"
                echo '```bash'
                echo "docker pull ${DH_IMAGE}"
                echo '```'
                echo ""
              fi
              if [[ "${{ needs.push-ghcr.result }}" == "success" ]]; then
                echo "**[Pull from GHCR](${GHCR_URL})**"
                echo '```bash'
                echo "docker pull ${GHCR_IMAGE}"
                echo '```'
                echo ""
              fi
            else
              echo "## Docker Image"
              echo ""
              echo "_No Docker registries were successfully updated for this release._"
              echo ""
            fi

            # --- Python packages section ---
            if [[ "$PYPI_SUCCESS" == "true" ]]; then
              echo "## Python Packages"
              echo ""
              echo "Published to [$PYPI_REGISTRY]($PYPI_REGISTRY):"
              echo '```bash'
              echo "pip install fairagro-middleware-shared==${PYPI_VERSION}"
              echo "pip install fairagro-middleware-api-client==${PYPI_VERSION}"
              echo '```'
              echo ""
            fi

            # --- Fallback section (shared clone/checkout, then per-artifact instructions) ---
            if [[ "$DOCKER_SUCCESS" == "true" || "$PYPI_SUCCESS" == "true" ]]; then
              echo "## Build from Source"
              echo ""
              echo '```bash'
              echo "git clone https://github.com/${{ github.repository }}.git"
              echo "cd ${REPO_BASENAME}"
              echo "git checkout ${TAG}"
              echo '```'
              echo ""
              if [[ "$DOCKER_SUCCESS" == "true" ]]; then
                echo "Build the Docker image:"
                echo '```bash'
                echo "docker build -f docker/Dockerfile.${COMPONENT} -t ${COMPONENT}:${{ inputs.version }} ."
                echo '```'
                echo ""
              fi
              if [[ "$PYPI_SUCCESS" == "true" ]]; then
                echo "Install Python packages:"
                echo '```bash'
                echo "pip install middleware/shared middleware/api_client"
                echo '```'
                echo ""
              fi
            fi
          } > release-body.md

      - name: Create GitHub Release (Draft)
        id: create_release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ needs.create-release-tag.outputs.timestamp }}-${{ inputs.tag_prefix }}${{ inputs.version }}
          name: ${{ inputs.tag_prefix }}${{ inputs.version }}
          body_path: release-body.md
          draft: true
          prerelease: ${{ inputs.release_type == 'feature' }}
          generate_release_notes: true
          files: |
            sboms/*
            ${{ needs.publish-pypi.result == 'success' && 'pypi-dist/*' || '' }}

      - name: Publish Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "🔍 Finalizing release for tag: ${{ needs.create-release-tag.outputs.timestamp }}-${{ inputs.tag_prefix }}${{ inputs.version }}"

          # Give GitHub API a moment to index the new release
          sleep 5

          if RELEASE_ID=$(gh api repos/${{ github.repository }}/releases/tags/${{ needs.create-release-tag.outputs.timestamp }}-${{ inputs.tag_prefix }}${{ inputs.version }} --jq '.id' 2>/dev/null); then
            echo "✅ Found release ID via tag: $RELEASE_ID"
          else
            echo "⚠️ Release not found via tag, searching in all releases..."
            RELEASE_ID=$(gh api repos/${{ github.repository }}/releases --jq '.[] | select(.tag_name == "${{ needs.create-release-tag.outputs.timestamp }}-${{ inputs.tag_prefix }}${{ inputs.version }}") | .id')
            if [[ -n "$RELEASE_ID" ]]; then
              echo "✅ Found release ID via search: $RELEASE_ID"
            else
              echo "❌ Release not found at all!"
              exit 1
            fi
          fi

          gh api repos/${{ github.repository }}/releases/$RELEASE_ID \
            --method PATCH \
            --field draft=false
          echo "🎉 Release finalized successfully"