release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: write
  issues: write
  pull-requests: write
  id-token: write  # Required for trusted publishing to PyPI

jobs:
  release:
    name: Create Release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 'lts/*'

      - name: Install semantic-release
        run: |
          npm install -g semantic-release @semantic-release/changelog @semantic-release/git @semantic-release/github @semantic-release/exec

      - name: Get version before release
        id: version_before
        run: echo "version=$(grep '^version = ' pyproject.toml | cut -d'"' -f2)" >> "$GITHUB_OUTPUT"

      - name: Run semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx semantic-release

      - name: Get version after release
        id: version_after
        run: echo "version=$(grep '^version = ' pyproject.toml | cut -d'"' -f2)" >> "$GITHUB_OUTPUT"

      - name: Check if new release
        id: check_release
        run: |
          if [ "${{ steps.version_before.outputs.version }}" != "${{ steps.version_after.outputs.version }}" ]; then
            echo "new_release=true" >> "$GITHUB_OUTPUT"
            echo "version=${{ steps.version_after.outputs.version }}" >> "$GITHUB_OUTPUT"
          else
            echo "new_release=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up Python
        if: steps.check_release.outputs.new_release == 'true'
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'

      - name: Install build dependencies
        if: steps.check_release.outputs.new_release == 'true'
        run: |
          python -m pip install --upgrade pip
          pip install build

      - name: Build package
        if: steps.check_release.outputs.new_release == 'true'
        run: |
          python -m build
          echo "📦 Built distribution files:"
          ls -lh dist/

      - name: Publish to Test PyPI
        if: steps.check_release.outputs.new_release == 'true'
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/
          attestations: false  # Disable to avoid conflict with production PyPI

      - name: Publish to PyPI
        if: steps.check_release.outputs.new_release == 'true'
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          attestations: true  # Enable attestations for production

    outputs:
      new_release: ${{ steps.check_release.outputs.new_release }}
      version: ${{ steps.check_release.outputs.version }}

  build-container:
    name: Build and Push Container
    runs-on: ubuntu-latest
    needs: release
    if: needs.release.outputs.new_release == 'true'
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: main

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/ambient-code/agentready
          tags: |
            type=semver,pattern={{version}},value=${{ needs.release.outputs.version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.release.outputs.version }}
            type=semver,pattern={{major}},value=${{ needs.release.outputs.version }}
            type=raw,value=latest

      - name: Build and push container
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Containerfile.scratch
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64,linux/arm64

      - name: Container summary
        env:
          VERSION: ${{ needs.release.outputs.version }}
          REPOSITORY: ${{ github.repository }}
        run: |
          {
            echo "## Container Published to GHCR"
            echo ""
            echo "📦 **Version**: $VERSION"
            echo "🐳 **Registry**: ghcr.io/$REPOSITORY"
            echo ""
            echo "### Usage"
            echo "\`\`\`bash"
            echo "# Pull latest"
            echo "podman pull ghcr.io/$REPOSITORY:latest"
            echo ""
            echo "# Pull specific version"
            echo "podman pull ghcr.io/$REPOSITORY:$VERSION"
            echo ""
            echo "# Run assessment"
            echo "podman run --rm -v /path/to/repo:/repo:ro ghcr.io/$REPOSITORY:latest assess /repo --output-dir /tmp/out"
            echo "\`\`\`"
          } >> "$GITHUB_STEP_SUMMARY"