container.yml

name: Test and publish container

on:
  pull_request:
  push:
    branches: [main]
    tags: ["v*"]
  schedule:
    - cron: "0 6 * * 1"

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: astral-sh/setup-uv@v6
        with:
          version: "0.8.15"
          enable-cache: true

      - uses: actions/setup-python@v5
        with:
          python-version: "3.14"

      - name: Install locked dependencies
        run: uv sync --locked

      - name: Run tests
        run: uv run python -m unittest discover -s tests -v

      - name: Verify installed CLI
        run: uv run stands-engine --version

  image-smoke:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - name: Build local smoke image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Containerfile
          load: true
          tags: stands-engine:smoke
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Run image smoke test
        run: docker run --rm stands-engine:smoke --version

      - name: Scan image
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          image-ref: stands-engine:smoke
          format: table
          exit-code: "1"
          ignore-unfixed: true
          severity: HIGH,CRITICAL
          trivyignores: .trivyignore.yaml

  publish:
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    needs: image-smoke
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - name: Validate release metadata
        shell: bash
        run: |
          package_version="$(
            python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])'
          )"
          expected_tag="v${package_version}"
          notes_file=".github/release-notes/${GITHUB_REF_NAME}.md"

          if [[ "${GITHUB_REF_NAME}" != "${expected_tag}" ]]; then
            echo "::error::Tag ${GITHUB_REF_NAME} does not match package version ${package_version}"
            exit 1
          fi

          if [[ ! -s "${notes_file}" ]]; then
            echo "::error::Release notes file ${notes_file} is missing or empty"
            exit 1
          fi

      - uses: docker/setup-qemu-action@v3

      - uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository_owner }}/stands-engine
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha

      - name: Build and publish multi-platform image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Containerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: mode=max
          sbom: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

  release:
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    needs: publish
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4

      - name: Create GitHub release
        uses: actions/github-script@v7
        env:
          RELEASE_NOTES_FILE: .github/release-notes/${{ github.ref_name }}.md
        with:
          script: |
            const fs = require("fs");
            const tag = context.ref.replace("refs/tags/", "");
            const releaseName = `Stands Engine ${tag}`;
            const body = fs.readFileSync(
              process.env.RELEASE_NOTES_FILE,
              "utf8",
            ).trim();

            try {
              const { data: existingRelease } =
                await github.rest.repos.getReleaseByTag({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  tag,
                });

              core.info(
                `Release ${existingRelease.html_url} already exists; skipping creation.`,
              );
            } catch (error) {
              if (error.status !== 404) {
                throw error;
              }

              const { data: release } = await github.rest.repos.createRelease({
                owner: context.repo.owner,
                repo: context.repo.repo,
                tag_name: tag,
                name: releaseName,
                body,
                draft: false,
                prerelease: false,
                generate_release_notes: true,
                make_latest: "true",
              });

              core.info(`Published ${release.html_url}`);
            }