release.yml

name: Release

# Production delivery follows the same release-manifest model as hduhelp-neo:
# edit the root release.yml, then push that commit to main. Images are published
# to GHCR for public/self-host use and mirrored to Aliyun ACR for the production
# cluster. The unified chart is published as an OCI artifact in GHCR.
on:
  push:
    branches: [main]
    paths: [release.yml]
  workflow_dispatch:
    inputs:
      rebuild:
        description: Component to rebuild with the versions already in release.yml
        required: true
        default: all
        type: choice
        options:
          - all
          - backend
          - web
          - chart

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

permissions:
  contents: read
  packages: write

env:
  REGISTRY: ghcr.io
  ACR_REGISTRY: registry.ap-northeast-1.aliyuncs.com
  CHART_PATH: deploy/helm/multica

jobs:
  detect:
    name: Detect version change
    runs-on: ubuntu-latest
    outputs:
      backend_changed: ${{ steps.diff.outputs.backend_changed }}
      backend_version: ${{ steps.parse.outputs.backend_version }}
      web_changed: ${{ steps.diff.outputs.web_changed }}
      web_version: ${{ steps.parse.outputs.web_version }}
      chart_changed: ${{ steps.diff.outputs.chart_changed }}
      chart_version: ${{ steps.parse.outputs.chart_version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Parse versions
        id: parse
        shell: bash
        run: |
          set -euo pipefail
          emit() {
            key=$1
            value=$(awk -v key="$key" '$1 == key ":" { print $2 }' release.yml)
            if [[ ! "$value" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "::error::release.yml must contain '$key: <major.minor.patch>'; got '$value'."
              exit 1
            fi
            echo "${key}_version=${value}" >> "$GITHUB_OUTPUT"
          }
          emit backend
          emit web
          emit chart

      - name: Diff against previous release.yml
        id: diff
        shell: bash
        env:
          REBUILD: ${{ inputs.rebuild }}
        run: |
          set -euo pipefail

          if [[ "${GITHUB_EVENT_NAME}" == workflow_dispatch ]]; then
            selected=${REBUILD:-all}
            for component in backend web chart; do
              changed=false
              if [[ "$selected" == all || "$selected" == "$component" ]]; then
                changed=true
              fi
              echo "${component}_changed=${changed}" >> "$GITHUB_OUTPUT"
            done
            exit 0
          fi

          if ! git show HEAD~1:release.yml > /tmp/old-release.yml 2>/dev/null; then
            echo "backend_changed=true" >> "$GITHUB_OUTPUT"
            echo "web_changed=true" >> "$GITHUB_OUTPUT"
            echo "chart_changed=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          changed_key() {
            key=$1
            old=$(awk -v key="$key" '$1 == key ":" { print $2 }' /tmp/old-release.yml)
            new=$(awk -v key="$key" '$1 == key ":" { print $2 }' release.yml)
            [[ "$old" != "$new" ]]
          }

          backend_changed=false
          web_changed=false
          chart_changed=false
          changed_key backend && backend_changed=true
          changed_key web && web_changed=true
          changed_key chart && chart_changed=true

          if [[ ("$backend_changed" == true || "$web_changed" == true) && "$chart_changed" != true ]]; then
            echo "::error::Bump 'chart' whenever an image version changes so the OCI chart remains immutable."
            exit 1
          fi

          echo "backend_changed=$backend_changed" >> "$GITHUB_OUTPUT"
          echo "web_changed=$web_changed" >> "$GITHUB_OUTPUT"
          echo "chart_changed=$chart_changed" >> "$GITHUB_OUTPUT"

  registry-preflight:
    name: Validate Registry Credentials
    needs: detect
    if: >
      needs.detect.outputs.backend_changed == 'true' ||
      needs.detect.outputs.web_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Require Aliyun ACR credentials
        shell: bash
        env:
          ACR_USERNAME: ${{ secrets.ALIYUN_REGISTRY_USERNAME }}
          ACR_PASSWORD: ${{ secrets.ALIYUN_REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
          if [[ -z "$ACR_USERNAME" || -z "$ACR_PASSWORD" ]]; then
            echo "::error::Grant hduhelp/multica access to the organization Actions secrets ALIYUN_REGISTRY_USERNAME and ALIYUN_REGISTRY_PASSWORD."
            exit 1
          fi

  backend-build:
    name: Build Backend (${{ matrix.platform }})
    needs: [detect, registry-preflight]
    if: needs.detect.outputs.backend_changed == 'true' && github.ref == 'refs/heads/main'
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Prepare platform name
        shell: bash
        run: |
          platform=${{ matrix.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"

      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Aliyun ACR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.ACR_REGISTRY }}
          username: ${{ secrets.ALIYUN_REGISTRY_USERNAME }}
          password: ${{ secrets.ALIYUN_REGISTRY_PASSWORD }}

      - name: Build and push platform image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          pull: true
          push: true
          platforms: ${{ matrix.platform }}
          # Aliyun ACR rejects the OCI empty descriptor that buildx writes for
          # attestation manifests ("unknown manifest class for
          # application/vnd.oci.empty.v1+json"), which fails the push for every
          # platform. Neither attestation is consumed by our deploy path.
          provenance: false
          sbom: false
          cache-from: type=gha,scope=release-backend-${{ env.PLATFORM_PAIR }}
          cache-to: type=gha,mode=max,scope=release-backend-${{ env.PLATFORM_PAIR }}
          build-args: |
            VERSION=${{ needs.detect.outputs.backend_version }}
            COMMIT=${{ github.sha }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ needs.detect.outputs.backend_version }}
          tags: |
            ghcr.io/${{ github.repository_owner }}/multica-backend:${{ needs.detect.outputs.backend_version }}-${{ env.PLATFORM_PAIR }}
            ${{ env.ACR_REGISTRY }}/${{ github.repository_owner }}/multica-backend:${{ needs.detect.outputs.backend_version }}-${{ env.PLATFORM_PAIR }}

  backend-publish:
    name: Publish Backend Image
    needs: [detect, backend-build]
    runs-on: ubuntu-latest
    steps:
      - uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Aliyun ACR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.ACR_REGISTRY }}
          username: ${{ secrets.ALIYUN_REGISTRY_USERNAME }}
          password: ${{ secrets.ALIYUN_REGISTRY_PASSWORD }}

      - name: Publish multi-arch manifests
        shell: bash
        env:
          VERSION: ${{ needs.detect.outputs.backend_version }}
        run: |
          set -euo pipefail
          owner=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
          ghcr="ghcr.io/${owner}/multica-backend"
          acr="${ACR_REGISTRY}/${owner}/multica-backend"
          sha="sha-${GITHUB_SHA::7}"

          docker buildx imagetools create \
            -t "${ghcr}:${VERSION}" -t "${ghcr}:${sha}" -t "${ghcr}:latest" \
            "${ghcr}:${VERSION}-linux-amd64" \
            "${ghcr}:${VERSION}-linux-arm64"
          docker buildx imagetools create \
            -t "${acr}:${VERSION}" -t "${acr}:${sha}" -t "${acr}:latest" \
            "${acr}:${VERSION}-linux-amd64" \
            "${acr}:${VERSION}-linux-arm64"
          docker buildx imagetools inspect "${acr}:${VERSION}"

  web-build:
    name: Build Web (${{ matrix.platform }})
    needs: [detect, registry-preflight]
    if: needs.detect.outputs.web_changed == 'true' && github.ref == 'refs/heads/main'
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Prepare platform name
        shell: bash
        run: |
          platform=${{ matrix.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"

      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Aliyun ACR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.ACR_REGISTRY }}
          username: ${{ secrets.ALIYUN_REGISTRY_USERNAME }}
          password: ${{ secrets.ALIYUN_REGISTRY_PASSWORD }}

      - name: Build and push platform image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile.web
          pull: true
          push: true
          platforms: ${{ matrix.platform }}
          # Aliyun ACR rejects the OCI empty descriptor that buildx writes for
          # attestation manifests ("unknown manifest class for
          # application/vnd.oci.empty.v1+json"), which fails the push for every
          # platform. Neither attestation is consumed by our deploy path.
          provenance: false
          sbom: false
          cache-from: type=gha,scope=release-web-${{ env.PLATFORM_PAIR }}
          cache-to: type=gha,mode=max,scope=release-web-${{ env.PLATFORM_PAIR }}
          build-args: |
            REMOTE_API_URL=http://backend:8080
            DOCS_URL=https://multica.ai
            NEXT_PUBLIC_APP_VERSION=${{ needs.detect.outputs.web_version }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ needs.detect.outputs.web_version }}
          tags: |
            ghcr.io/${{ github.repository_owner }}/multica-web:${{ needs.detect.outputs.web_version }}-${{ env.PLATFORM_PAIR }}
            ${{ env.ACR_REGISTRY }}/${{ github.repository_owner }}/multica-web:${{ needs.detect.outputs.web_version }}-${{ env.PLATFORM_PAIR }}

  web-publish:
    name: Publish Web Image
    needs: [detect, web-build]
    runs-on: ubuntu-latest
    steps:
      - uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Aliyun ACR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.ACR_REGISTRY }}
          username: ${{ secrets.ALIYUN_REGISTRY_USERNAME }}
          password: ${{ secrets.ALIYUN_REGISTRY_PASSWORD }}

      - name: Publish multi-arch manifests
        shell: bash
        env:
          VERSION: ${{ needs.detect.outputs.web_version }}
        run: |
          set -euo pipefail
          owner=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
          ghcr="ghcr.io/${owner}/multica-web"
          acr="${ACR_REGISTRY}/${owner}/multica-web"
          sha="sha-${GITHUB_SHA::7}"

          docker buildx imagetools create \
            -t "${ghcr}:${VERSION}" -t "${ghcr}:${sha}" -t "${ghcr}:latest" \
            "${ghcr}:${VERSION}-linux-amd64" \
            "${ghcr}:${VERSION}-linux-arm64"
          docker buildx imagetools create \
            -t "${acr}:${VERSION}" -t "${acr}:${sha}" -t "${acr}:latest" \
            "${acr}:${VERSION}-linux-amd64" \
            "${acr}:${VERSION}-linux-arm64"
          docker buildx imagetools inspect "${acr}:${VERSION}"

  helm-chart:
    name: Publish Helm Chart
    needs: [detect, backend-build, backend-publish, web-build, web-publish]
    if: >
      always() &&
      needs.detect.outputs.chart_changed == 'true' &&
      (needs.detect.outputs.backend_changed != 'true' ||
        (needs.backend-build.result == 'success' && needs.backend-publish.result == 'success')) &&
      (needs.detect.outputs.web_changed != 'true' ||
        (needs.web-build.result == 'success' && needs.web-publish.result == 'success')) &&
      github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Sync chart metadata from release.yml
        shell: bash
        env:
          BACKEND_VERSION: ${{ needs.detect.outputs.backend_version }}
          WEB_VERSION: ${{ needs.detect.outputs.web_version }}
          CHART_VERSION: ${{ needs.detect.outputs.chart_version }}
        run: |
          set -euo pipefail
          sed -i -E "s/^version:.*/version: ${CHART_VERSION}/" "${CHART_PATH}/Chart.yaml"
          sed -i -E "s/^appVersion:.*/appVersion: \"backend-${BACKEND_VERSION}.web-${WEB_VERSION}\"/" "${CHART_PATH}/Chart.yaml"
          sed -i -E "s/^  backendVersion:.*/  backendVersion: \"${BACKEND_VERSION}\"/" "${CHART_PATH}/values.yaml"
          sed -i -E "s/^  webVersion:.*/  webVersion: \"${WEB_VERSION}\"/" "${CHART_PATH}/values.yaml"

      - uses: azure/setup-helm@v4
        with:
          version: v3.15.0

      - name: Lint chart
        run: helm lint "${CHART_PATH}"

      - name: Package chart
        id: package
        shell: bash
        run: |
          mkdir -p .chart-out
          helm package "${CHART_PATH}" --destination .chart-out
          package=$(find .chart-out -maxdepth 1 -name '*.tgz' -print -quit)
          echo "package=${package}" >> "$GITHUB_OUTPUT"

      - name: Login to GHCR
        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io --username "${{ github.actor }}" --password-stdin

      - name: Push OCI chart
        shell: bash
        run: |
          owner=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
          helm push "${{ steps.package.outputs.package }}" "oci://ghcr.io/${owner}/charts"