penpot/.github/workflows/release.yml

name: Release Publisher

on:
  workflow_dispatch:
    inputs:
      gh_ref:
        description: 'Tag to release'
        type: string
        required: true
  workflow_call:
    inputs:
      gh_ref:
        description: 'Tag to release'
        type: string
        required: true
    secrets:
      AWS_REGION:
        required: false
      DOCKER_PASSWORD:
        required: false
      DOCKER_REGISTRY:
        required: false
      DOCKER_USERNAME:
        required: false
      MATTERMOST_WEBHOOK:
        required: false
      PUB_DOCKER_PASSWORD:
        required: false
      PUB_DOCKER_USERNAME:
        required: false

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.vars.outputs.gh_ref }}
      release_notes: ${{ steps.extract_release_notes.outputs.release_notes }}
    steps:
      - name: Extract some useful variables
        id: vars
        env:
          GH_REF: ${{ inputs.gh_ref || github.ref_name }}
        run: |
          echo "gh_ref=$GH_REF" >> $GITHUB_OUTPUT

      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
          ref: ${{ steps.vars.outputs.gh_ref }}

      # --- Publicly release the docker images ---
      - name: Configure ECR credentials
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          aws-access-key-id: ${{ secrets.DOCKER_USERNAME }}
          aws-secret-access-key: ${{ secrets.DOCKER_PASSWORD }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Install Skopeo
        run: |
          sudo apt-get update -y
          sudo apt-get install -y skopeo

      - name: Copy images from AWS ECR to Docker Hub
        env:
          AWS_REGION: ${{ secrets.AWS_REGION }}
          DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
          PUB_DOCKER_USERNAME: ${{ secrets.PUB_DOCKER_USERNAME }}
          PUB_DOCKER_PASSWORD: ${{ secrets.PUB_DOCKER_PASSWORD }}
          TAG: ${{ steps.vars.outputs.gh_ref }}
        run: |
          aws ecr get-login-password --region $AWS_REGION | \
            skopeo login --username AWS --password-stdin \
            $DOCKER_REGISTRY

          echo "$PUB_DOCKER_PASSWORD" | skopeo login --username "$PUB_DOCKER_USERNAME" --password-stdin docker.io

          IMAGES=("frontend" "backend" "exporter" "admin-console" "mcp" "storybook")
          SHORT_TAG=${TAG%.*}

          for image in "${IMAGES[@]}"; do
            skopeo copy --all \
              docker://$DOCKER_REGISTRY/$image:$TAG \
              docker://docker.io/penpotapp/$image:$TAG

            for alias in main latest "$SHORT_TAG"; do
              skopeo copy --all \
                docker://$DOCKER_REGISTRY/$image:$TAG \
                docker://docker.io/penpotapp/$image:$alias
            done
          done

      # --- Release notes extraction ---
      - name: Extract release notes from CHANGES.md
        id: extract_release_notes
        env:
          TAG: ${{ steps.vars.outputs.gh_ref }}
        run: |
          RELEASE_NOTES=$(awk "/^## $TAG$/{flag=1; next} /^## /{flag=0} flag" CHANGES.md | awk '{$1=$1};1')
          if [ -z "$RELEASE_NOTES" ]; then
            RELEASE_NOTES="No changes for $TAG according to CHANGES.md"
          fi
          echo "release_notes<<EOF" >> $GITHUB_OUTPUT
          echo "$RELEASE_NOTES" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      # --- Create GitHub release ---
      # Updates the release if it already exists, so re-running is safe.
      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          TAG: ${{ steps.vars.outputs.gh_ref }}
          NOTES: ${{ steps.extract_release_notes.outputs.release_notes }}
        run: |
          if gh release view "$TAG" > /dev/null 2>&1; then
            gh release edit "$TAG" --title "$TAG" --notes "$NOTES"
          else
            gh release create "$TAG" --verify-tag --title "$TAG" --notes "$NOTES"
          fi

      - name: Notify Mattermost
        if: failure()
        uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0
        with:
          MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK }}
          MATTERMOST_CHANNEL: bot-alerts-cicd
          TEXT: |
            ❌ 🚀 *[PENPOT] Error releasing penpot.*
            📄 Triggered from ref: `${{ steps.vars.outputs.gh_ref }}`
            🔗 Run: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
            @infra