release.yml

name: Release

run-name: bump ${{ inputs.version }} version by @${{ github.actor }}

on:
  workflow_dispatch:
    inputs:
      version:
        type: choice
        description: 'part of the project version to update'
        options:
        - major
        - minor
        - patch
        required: true

env:
  PIP_NO_OPTION: on
  PIP_NO_CLEAN: on
  PIP_PREFER_BINARY: on

permissions:
  contents: write
  packages: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    outputs:
      tag: ${{ steps.release.outputs.tag }}
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Cache requirements
        uses: actions/cache@v4
        env:
          cache-name: cache-requirements
        with:
          path: ~/.cache/pip
          key: ${{ env.cache-name }}-${{ hashFiles('requirements.txt') }}
          restore-keys: |
            ${{ env.cache-name }}-

      - name: Setup python
        uses: actions/setup-python@v5
        with:
          python-version: 3.11

      - name: Install requirements
        run: make setup

      - name: Configure git
        env:
          MEX_BOT_EMAIL: ${{ vars.MEX_BOT_EMAIL }}
          MEX_BOT_USER: ${{ vars.MEX_BOT_USER }}
          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
          SIGNING_PUB: ${{ secrets.SIGNING_PUB }}
        run: |
          eval "$(ssh-agent -s)"
          pdm setup-commit-signing

      - name: Release new version
        id: release
        env:
          GH_TOKEN: ${{ secrets.WORKFLOW_TOKEN }}
        run: |
          pdm release ${{ inputs.version }}
          echo "tag=$(git describe --abbrev=0 --tags)" >> "$GITHUB_OUTPUT"

  containerize:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: release
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Cache requirements
        uses: actions/cache@v4
        env:
          cache-name: cache-requirements
        with:
          path: ~/.cache/pip
          key: ${{ env.cache-name }}-${{ hashFiles('requirements.txt') }}
          restore-keys: |
            ${{ env.cache-name }}-

      - name: Setup python
        uses: actions/setup-python@v5
        with:
          python-version: 3.11

      - name: Install requirements
        run: make setup

      - name: Generate locked requirements.txt
        run: |
          pdm export --self --output locked-requirements.txt --no-hashes --without dev

      - name: Login to container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{github.actor}}
          password: ${{secrets.GITHUB_TOKEN}}

      - name: Build, tag and push docker image
        run: |
          docker build . \
          --tag ghcr.io/robert-koch-institut/mex-editor:latest \
          --tag ghcr.io/robert-koch-institut/mex-editor:${{ github.sha }} \
          --tag ghcr.io/robert-koch-institut/mex-editor:${{ needs.release.outputs.tag }}
          docker push --all-tags ghcr.io/robert-koch-institut/mex-editor

  distribute:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: release
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Cache requirements
        uses: actions/cache@v4
        env:
          cache-name: cache-requirements
        with:
          path: ~/.cache/pip
          key: ${{ env.cache-name }}-${{ hashFiles('requirements.txt') }}
          restore-keys: |
            ${{ env.cache-name }}-

      - name: Setup python
        uses: actions/setup-python@v5
        with:
          python-version: 3.11

      - name: Install requirements
        run: make setup

      - name: Build wheel and sdist distros and create a github release
        env:
          GH_TOKEN: ${{ secrets.WORKFLOW_TOKEN }}
          PDM_CHECK_UPDATE: False
        run: |
          gh release create ${{ needs.release.outputs.tag }} --generate-notes --latest --verify-tag
          pdm build --dest dist
          for filename in dist/*; do
            gh release upload ${{ needs.release.outputs.tag }} ${filename};
          done