cd.yml

name: CD

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write
  packages: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: boringcode-dev/feedreader

jobs:
  build-and-push:
    runs-on: ubuntu-latest

    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=raw,value=latest
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ github.ref_name }}

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  update-release-notes:
    runs-on: ubuntu-latest
    needs: build-and-push

    steps:
      - name: Ensure GitHub release exists
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          tag="${GITHUB_REF_NAME}"
          if ! gh release view "$tag" --repo "$GH_REPO" >/dev/null 2>&1; then
            gh release create "$tag" --repo "$GH_REPO" --title "$tag" --generate-notes
          fi

      - name: Append container image instructions to release body
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          IMAGE_REF: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        run: |
          # GITHUB_REF_NAME comes from the trusted maintainer-created tag ref that triggered this workflow.
          python3 <<'PY'
          import os
          import subprocess
          import textwrap

          tag = os.environ["GITHUB_REF_NAME"]
          image_ref = os.environ["IMAGE_REF"]
          marker = "## Container image"

          body = subprocess.check_output(
              [
                  "gh",
                  "release",
                  "view",
                  tag,
                  "--repo",
                  os.environ["GH_REPO"],
                  "--json",
                  "body",
                  "-q",
                  ".body",
              ],
              text=True,
          )

          container_section = textwrap.dedent(
              f"""
              ## Container image

              Pull the published container from GHCR:

              ```bash
              docker pull {image_ref}:{tag.lstrip('v')}
              docker pull {image_ref}:latest
              ```
              """
          ).strip()

          if marker in body:
              body = body.split(marker, 1)[0].rstrip()

          body = f"{body}\n\n{container_section}\n" if body.strip() else f"{container_section}\n"

          with open("RELEASE_NOTES.md", "w", encoding="utf-8") as fh:
              fh.write(body)
          PY

          gh release edit "$GITHUB_REF_NAME" --repo "$GH_REPO" --notes-file RELEASE_NOTES.md