mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-13 06:06:38 +00:00
kevinveenbirkenbach
6936d84798
- Always build and publish Docker images for v* tags (version + latest), independent of test results - Run full code analyses in parallel and only mark Git + container :stable when all checks succeed - Replace rebuild-on-stable with pure imagetools retagging (no rebuild) - Prevent race conditions by ordering stable tagging after image publish - Ensure latest always tracks the most recent version image https://chatgpt.com/share/695bdfa5-dbe0-800f-bb1c-4fe81eba6058
126 lines
3.4 KiB
YAML
126 lines
3.4 KiB
YAML
name: Mark commit as stable
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
security-events: write
|
|
|
|
jobs:
|
|
# Build & publish images ALWAYS for version tags (even if tests fail)
|
|
publish-version-images:
|
|
name: Publish images for version tag (always)
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
steps:
|
|
- name: Checkout repository (with tags)
|
|
uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
fetch-tags: true
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
|
|
with:
|
|
use: true
|
|
|
|
- name: Login to GHCR
|
|
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Publish images (latest + version, no stable)
|
|
env:
|
|
OWNER: ${{ github.repository_owner }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# github.ref_name is like "v1.2.3"
|
|
VERSION="${{ github.ref_name }}"
|
|
VERSION="${VERSION#v}"
|
|
|
|
# Always publish latest+version, but never stable here:
|
|
OWNER="${OWNER}" \
|
|
VERSION="${VERSION}" \
|
|
IS_STABLE="false" \
|
|
bash scripts/build/publish.sh
|
|
|
|
# Run full analyses/tests (gates "stable" marking)
|
|
code-analyses:
|
|
uses: ./.github/workflows/code-analyses.yml
|
|
|
|
# Only mark stable if ALL checks passed (code-analyses succeeded)
|
|
ci-version:
|
|
needs:
|
|
- code-analyses
|
|
- publish-version-images
|
|
runs-on: ubuntu-latest
|
|
|
|
# Only run this job if the push is for a version tag (v*)
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
fetch-tags: true
|
|
|
|
- name: Move 'stable' tag only if this version is the highest
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
|
|
echo "Ref: $GITHUB_REF"
|
|
echo "SHA: $GITHUB_SHA"
|
|
|
|
VERSION="${GITHUB_REF#refs/tags/}"
|
|
echo "Current version tag: ${VERSION}"
|
|
|
|
echo "Collecting all version tags..."
|
|
ALL_V_TAGS="$(git tag --list 'v*' || true)"
|
|
|
|
if [[ -z "${ALL_V_TAGS}" ]]; then
|
|
echo "No version tags found. Skipping stable update."
|
|
exit 0
|
|
fi
|
|
|
|
echo "All version tags:"
|
|
echo "${ALL_V_TAGS}"
|
|
|
|
LATEST_TAG="$(printf '%s\n' ${ALL_V_TAGS} | sort -V | tail -n1)"
|
|
echo "Highest version tag: ${LATEST_TAG}"
|
|
|
|
if [[ "${VERSION}" != "${LATEST_TAG}" ]]; then
|
|
echo "Current version ${VERSION} is NOT the highest version."
|
|
echo "Stable tag will NOT be updated."
|
|
exit 0
|
|
fi
|
|
|
|
echo "Current version ${VERSION} IS the highest version."
|
|
echo "Updating 'stable' tag..."
|
|
|
|
git tag -d stable 2>/dev/null || true
|
|
git push origin :refs/tags/stable || true
|
|
|
|
git tag stable "$GITHUB_SHA"
|
|
git push origin stable
|
|
|
|
echo "✅ Stable tag updated to ${VERSION}."
|