release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

# Prevent concurrent releases from running simultaneously.
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  REGISTRY: ghcr.io
  ORG: telocel-labs

jobs:
  # ---------------------------------------------------------------------------
  # Build and push multi-platform Docker images in parallel
  # ---------------------------------------------------------------------------
  build-indexer:
    name: Build indexer image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      digest: ${{ steps.push.outputs.digest }}
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Set up QEMU (cross-platform emulation)
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0

      - name: Log in to GHCR
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract tag name
        id: tag
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Build and push indexer
        id: push
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: crates/indexer/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.ORG }}/trident-indexer:${{ github.ref_name }}
            ${{ env.REGISTRY }}/${{ env.ORG }}/trident-indexer:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-grpc-api:
    name: Build gRPC API image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      digest: ${{ steps.push.outputs.digest }}
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0

      - name: Log in to GHCR
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push gRPC API
        id: push
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: crates/api/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.ORG }}/trident-grpc-api:${{ github.ref_name }}
            ${{ env.REGISTRY }}/${{ env.ORG }}/trident-grpc-api:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-go-api:
    name: Build Go API image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      digest: ${{ steps.push.outputs.digest }}
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0

      - name: Log in to GHCR
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Go API
        id: push
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: services/api/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.ORG }}/trident-go-api:${{ github.ref_name }}
            ${{ env.REGISTRY }}/${{ env.ORG }}/trident-go-api:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-migrate:
    name: Build database migration image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      digest: ${{ steps.push.outputs.digest }}
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0

      - name: Log in to GHCR
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push database migration image
        id: push
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: database/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.ORG }}/trident-migrate:${{ github.ref_name }}
            ${{ env.REGISTRY }}/${{ env.ORG }}/trident-migrate:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ---------------------------------------------------------------------------
  # Publish TypeScript SDK to npm
  # ---------------------------------------------------------------------------
  publish-sdk:
    name: Publish TypeScript SDK
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: sdk/typescript
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Set up Node.js
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version: "20"
          registry-url: "https://registry.npmjs.org"

      - name: Derive version from Git tag (strip leading v)
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          npm version "$VERSION" --no-git-tag-version

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Publish to npm
        run: npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  # ---------------------------------------------------------------------------
  # Create GitHub Release — only after all builds succeed
  # ---------------------------------------------------------------------------
  create-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs:
      - build-indexer
      - build-grpc-api
      - build-go-api
      - build-migrate
      - publish-sdk
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0  # needed for auto-generated release notes

      - name: Write image digests file
        run: |
          cat > digests.txt <<EOF
          ## Docker image digests

          | Image | Digest |
          |-------|--------|
          | trident-indexer | ${{ needs.build-indexer.outputs.digest }} |
          | trident-grpc-api | ${{ needs.build-grpc-api.outputs.digest }} |
          | trident-go-api | ${{ needs.build-go-api.outputs.digest }} |
          | trident-migrate | ${{ needs.build-migrate.outputs.digest }} |
          EOF

      - name: Create GitHub Release
        uses: softprops/action-gh-release@9d7c94cfd0a1f3ed45544c887983e9fa900f0564 # v2.0.4
        with:
          generate_release_notes: true
          files: digests.txt
          body: |
            ## Docker Images

            Pull the images for this release:

            ```bash
            docker pull ghcr.io/${{ env.ORG }}/trident-indexer:${{ github.ref_name }}
            docker pull ghcr.io/${{ env.ORG }}/trident-grpc-api:${{ github.ref_name }}
            docker pull ghcr.io/${{ env.ORG }}/trident-go-api:${{ github.ref_name }}
            docker pull ghcr.io/${{ env.ORG }}/trident-migrate:${{ github.ref_name }}
            ```

            ## TypeScript SDK

            ```bash
            npm install @trident-indexer/sdk@${{ github.ref_name }}
            ```

            ---
            <!-- GitHub will append auto-generated release notes below -->