release-action.yml

name: Release New Version

on:
  push:
    branches: main
    tags:
      - v*
  # Manual trigger, so a feature branch can be built without merging to main first. GitHub only
  # offers this for workflows present on the DEFAULT branch, so the button appears once this file
  # reaches main; after that it can target any branch. Images are tagged by commit SHA either way,
  # so a branch build cannot be mistaken for a main one.
  workflow_dispatch:
    inputs:
      deploy:
        description: 'Also run the Nomad job after building (leave off to build only)'
        type: boolean
        default: false
env:
  IMAGE_NAME: operator-checks

jobs:
  push:
    runs-on: ubuntu-latest
    # runs-on: self-hosted
    # runs-on: anyone-arc-runner-set
    permissions:
      packages: write
      contents: read

    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Build image
        run: docker build . --file Dockerfile --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"

      - name: Log in to registry
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u $ --password-stdin

      - name: Push image
        run: |
          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME

          # Change all uppercase to lowercase
          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
          # Strip git ref prefix from version
          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
          # Strip "v" prefix from tag name
          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
          # Use Docker `latest` tag convention
          [ "$VERSION" == "main" ] && VERSION=stage
          echo IMAGE_ID=$IMAGE_ID
          echo VERSION=$VERSION

          echo -e "{\"deploy\":\"$VERSION\",\"commit_sha\":\"${GITHUB_SHA}\"}" > deploy-vars.json

          docker tag $IMAGE_NAME $IMAGE_ID:$GITHUB_SHA
          docker push $IMAGE_ID:$GITHUB_SHA

      # Deploying is MANUAL for now. A push to main used to build and immediately
      # `nomad job run` operator-checks-stage (VERSION=stage when the ref is main), and a v* tag
      # did the same for live, so merging deployed without anyone choosing to. This step now runs
      # only when a workflow_dispatch explicitly ticks `deploy`; a push builds and pushes the
      # image and stops there, and the jobspec is run by hand against the SHA-tagged image.
      - name: Deploy new version
        if: ${{ github.event_name == 'workflow_dispatch' && inputs.deploy }}
        env:
          NOMAD_CACERT: operations/admin-ui-ca.crt
          NOMAD_TOKEN: ${{ secrets.NOMAD_TOKEN_OPERATOR_CHECKS_DEPLOY }}
          NOMAD_ADDR: ${{ secrets.NOMAD_ADDR }}
        run: |
          curl -L https://releases.hashicorp.com/nomad/1.10.2/nomad_1.10.2_linux_amd64.zip -o nomad.zip
          unzip nomad.zip

          if grep -q "stage" deploy-vars.json; then
            sed -i "s/\[\[ .commit_sha \]\]/${GITHUB_SHA}/g" operations/operator-checks-stage.hcl
            ./nomad job run operations/operator-checks-stage.hcl
          else
            sed -i "s/\[\[ .commit_sha \]\]/${GITHUB_SHA}/g" operations/operator-checks-live.hcl
            ./nomad job run operations/operator-checks-live.hcl
          fi