design semver releases

.cargo/config.toml

@@ -0,0 +1,2 @@
+[alias]
+xtask = "run --package xtask --"

.github/workflows/ci.yml

@@ -8,13 +8,15 @@ on:
       - 'src/**'
       - 'Cargo.*'
       - 'flake.*'
+      - 'xtask/**'
   pull_request:
     branches: [main]
     paths:
       - ".github/workflows/ci.yml"
       - 'src/**'
       - 'Cargo.*'
       - 'flake.*'
+      - 'xtask/**'
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -45,6 +47,18 @@ jobs:
           primary-key: nix-${{ runner.os }}-${{ hashFiles('**/Cargo.lock', 'flake.lock') }}
       - run: nix build .#checks.x86_64-linux.clippy
 
+  check-versions:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: cachix/install-nix-action@v31
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: nix-community/cache-nix-action@v7
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/Cargo.lock', 'flake.lock') }}
+      - run: nix develop -c cargo xtask check
+
   test:
     runs-on: ubuntu-latest
     steps:
@@ -71,21 +85,22 @@ jobs:
 
   summary:
     runs-on: ubuntu-latest
-    needs: [fmt, clippy, test, build]
+    needs: [fmt, clippy, check-versions, test, build]
     if: always()
     steps:
       - name: Summary
         if: always()
         run: |
           fmt="${{ needs.fmt.result }}"
           clippy="${{ needs.clippy.result }}"
+          check_versions="${{ needs.check-versions.result }}"
           test="${{ needs.test.result }}"
           build="${{ needs.build.result }}"
 
           icon() { [[ "$1" == "success" ]] && echo "✅" || echo "❌"; }
 
           # Overall result
-          if [[ "$fmt" == "success" && "$clippy" == "success" && "$test" == "success" && "$build" == "success" ]]; then
+          if [[ "$fmt" == "success" && "$clippy" == "success" && "$check_versions" == "success" && "$test" == "success" && "$build" == "success" ]]; then
             header="## ✅ CI Passed"
           else
             header="## ❌ CI Failed"
@@ -98,6 +113,7 @@ jobs:
           | --- | --- |
           | Formatting | $(icon "$fmt") \`cargo fmt\` |
           | Linting | $(icon "$clippy") \`cargo clippy\` |
+          | Versioning | $(icon "$check_versions") \`cargo xtask check\` |
           | Tests | $(icon "$test") \`cargo test\` |
           | Build | $(icon "$build") \`static musl binary\` |
 
@@ -126,6 +142,17 @@ jobs:
           EOF
           fi
 
+          if [[ "$check_versions" != "success" ]]; then
+            cat >> "$GITHUB_STEP_SUMMARY" << 'EOF'
+          ### 🔧 Fix check versions warnings
+
+          ```bash
+          cargo xtask check
+          ```
+
+          EOF
+          fi
+
           if [[ "$test" != "success" ]]; then
             cat >> "$GITHUB_STEP_SUMMARY" << 'EOF'
           ### 🔧 Fix tests
@@ -152,6 +179,94 @@ jobs:
           [[ \
             "$fmt" == "success" && \
             "$clippy" == "success" && \
+            "$check_versions" == "success" && \
             "$test" == "success" && \
             "$build" == "success" \
           ]]
+
+  detect-release:
+    runs-on: ubuntu-latest
+    needs: [summary]
+    if: |
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/main' &&
+      needs.summary.result == 'success'
+    outputs:
+      is_release: ${{ steps.detect.outputs.is_release }}
+      version: ${{ steps.detect.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Detect release commit
+        id: detect
+        run: |
+          MSG=$(git log -1 --format=%s)
+          if [[ "$MSG" =~ ^release\ v([0-9]+\.[0-9]+\.[0-9]+)$ ]];
+          then
+            echo "is_release=true" >> "$GITHUB_OUTPUT"
+            echo "version=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
+          else
+            echo "is_release=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  tag-and-release:
+    runs-on: ubuntu-latest
+    needs: [detect-release]
+    if: needs.detect-release.outputs.is_release == 'true'
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Create git tag
+        env:
+          TAG: v${{ needs.detect-release.outputs.version }}
+        run: |
+          if git ls-remote --tags origin "$TAG" | grep -qF "refs/tags/$TAG";
+          then
+            echo "Tag $TAG already exists, skipping."
+          else
+            git tag "$TAG"
+            git push origin "$TAG"
+          fi
+
+      - name: Setup Nix
+        uses: cachix/install-nix-action@v31
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Restore Nix cache
+        uses: nix-community/cache-nix-action@v7
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/Cargo.lock', 'flake.lock') }}
+
+      - name: Build release image
+        run: nix build .#image
+
+      - name: Push release image
+        id: push
+        env:
+          VERSION: ${{ needs.detect-release.outputs.version }}
+        run: |
+          TAG="v${VERSION}"
+          IMAGE="quay.io/upgrades/k8s-cloud-tagger:${TAG}"
+
+          nix develop -c skopeo login quay.io \
+            -u "${{ secrets.QUAY_USERNAME }}" \
+            -p "${{ secrets.QUAY_PASSWORD }}"
+
+          nix develop -c skopeo copy docker-archive:result "docker://${IMAGE}"
+
+          echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+
+      - name: Summary
+        run: |
+          cat >> "$GITHUB_STEP_SUMMARY" << EOF
+          ## Release ${{ needs.detect-release.outputs.version }}
+
+          | | |
+          | --- | --- |
+          | **Image** | \`${{ steps.push.outputs.image }}\` |
+          | **Tag** | \`${{ steps.push.outputs.tag }}\` |
+          | **Registry** | [Quay.io](https://quay.io/repository/upgrades/k8s-cloud-tagger?tab=tags) |
+          EOF

CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+- Kubernetes operator that propagates PVC labels to GCP persistent disks
+- GCP label sanitisation (lowercasing, replacing invalid characters with hyphens)
+- Helm chart for deployment
+- Prometheus metrics for reconciliation and cloud API calls
+- Health and readiness endpoints
+- Kubernetes Events published on successful tagging
+- Nix dev shell for reproducible development environments
+- Dev image published to Quay.io
+- Integration tests
+- `cargo xtask` release tooling with version sync enforcement