docker-release-cli.yml

# The orion-cli image, ported from the pre-monorepo GoPlasmatic/Orion-cli
# repo. Mirrors docker-release.yml's shape (ci-gate, digest-merge multi-arch
# build) for the CLI package; signing/SBOM stays a server-image concern for
# now.
name: Docker Release (CLI)

permissions:
  contents: read
  packages: write

on:
  # The CLI ships in two shapes. A bare v* tag is the joint release the server
  # and the CLI share while their versions are in lockstep — it builds both
  # images, this workflow's and docker-release.yml's. An orion-cli-v* tag is
  # the out-of-band CLI patch. orion-server-v* is docker-release.yml's alone.
  #
  # On a bare tag the CLI may legitimately not be part of the release (a
  # server-only patch leaves orion-cli's version behind); `prepare` detects
  # that and skips rather than failing, so a server patch never turns the
  # release red on the CLI image's account.
  push:
    tags:
      - "orion-cli-v[0-9]+.[0-9]+.[0-9]+*"
      - "v[0-9]+.[0-9]+.[0-9]+*"
  # Allow manual trigger with options
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Dry run (build but don't push)"
        type: boolean
        default: false
      tag_override:
        description: "Version tag override (e.g. 0.2.1)"
        type: string
        required: false

env:
  GHCR_IMAGE: ghcr.io/goplasmatic/orion-cli

jobs:
  # Releases must not outrun CI (proposal T10): the tagged commit needs a
  # successful CI run before anything is built or pushed.
  ci-gate:
    name: CI Gate
    uses: ./.github/workflows/ci-gate.yml
    with:
      skip: ${{ inputs.dry_run || false }}
    permissions:
      actions: read
      contents: read

  # Determine version once, share across jobs
  prepare:
    name: Prepare
    runs-on: ubuntu-22.04
    outputs:
      version: ${{ steps.version.outputs.version }}
      should_release: ${{ steps.version.outputs.should_release }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Determine version
        id: version
        env:
          TAG_OVERRIDE: ${{ inputs.tag_override }}
        run: |
          RELEASE=1
          if [ -n "${TAG_OVERRIDE}" ]; then
            VERSION="${TAG_OVERRIDE}"
            # P19: the override rides the same `type=semver` metadata path as
            # a tag — an unparseable value is dropped by metadata-action,
            # leaving the merge job's `imagetools create` with zero -t flags
            # after the per-arch digests already pushed.
            if ! printf '%s' "${VERSION}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.+-]+)?$'; then
              echo "::error::tag_override '${VERSION}' is not a semver version — metadata-action would drop it and the merge job would fail with untagged images already pushed."
              exit 1
            fi
          elif [ "${{ github.ref_type }}" = "tag" ]; then
            # Strips either shape: orion-cli-v1.0.0 (the CLI's own tag) and
            # v1.0.0 (the joint release tag) both reduce to 1.0.0.
            VERSION="${GITHUB_REF_NAME#orion-cli-}"
            VERSION="${VERSION#v}"
          else
            VERSION="0.0.0-dev.${GITHUB_SHA::8}"
            RELEASE=0
          fi
          SHOULD_RELEASE=1
          # P19: refuse a version the binary does not report.
          if [ "${RELEASE}" = "1" ]; then
            CARGO_VERSION=$(.github/scripts/crate-version.sh orion-cli)
            if [ "${VERSION}" != "${CARGO_VERSION}" ]; then
              # Only ONE case is a benign mismatch: a bare tag pushed for a
              # server-only release, which the CLI is simply not part of. An
              # explicit override, or a tag that names the CLI, is a mistake
              # and must stay a hard error — a dispatch's GITHUB_REF_NAME is a
              # branch, so the override has to be tested before the tag shape.
              if [ -n "${TAG_OVERRIDE}" ]; then
                echo "::error::tag_override says ${VERSION} but orion-cli is at ${CARGO_VERSION} — the image would be labelled with a version the binary does not report. Re-publish from a ref whose version agrees."
                exit 1
              fi
              case "${GITHUB_REF_NAME}" in
                orion-cli-*)
                  echo "::error::Release version says ${VERSION} but orion-cli is at ${CARGO_VERSION} — the image would be labelled with a version the binary does not report. Release from a ref whose version agrees."
                  exit 1
                  ;;
                *)
                  # Skip, do not fail — and above all do not re-push an
                  # existing immutable tag with freshly built content.
                  echo "::notice::${GITHUB_REF_NAME} is a server-only release (orion-cli is at ${CARGO_VERSION}) — skipping the CLI image."
                  SHOULD_RELEASE=0
                  ;;
              esac
            fi
          fi
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "should_release=${SHOULD_RELEASE}" >> "$GITHUB_OUTPUT"
          echo "Version: ${VERSION} (release: ${SHOULD_RELEASE})"

  # Build per-platform images natively in parallel
  build:
    name: Build (${{ matrix.platform }})
    needs: [prepare, ci-gate]
    # Skips the whole downstream chain (merge) when a bare tag turns out to be
    # a server-only release: it needs this job.
    if: ${{ needs.prepare.outputs.should_release == '1' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-22.04
          - platform: linux/arm64
            runner: ubuntu-22.04-arm
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Login to GitHub Container Registry
        if: ${{ !inputs.dry_run }}
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ env.GHCR_IMAGE }}
          tags: |
            type=semver,pattern={{version}},value=${{ needs.prepare.outputs.version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.prepare.outputs.version }}
            type=sha,prefix=
          flavor: |
            latest=auto

      # Build and push by digest (no tag yet — tags are applied in the merge step)
      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: crates/orion-cli/Dockerfile
          platforms: ${{ matrix.platform }}
          push: ${{ !inputs.dry_run }}
          # .dockerignore excludes .git/, so the SHA must ride in as a
          # build-arg or the published image reports git_hash=unknown.
          build-args: |
            GIT_HASH=${{ github.sha }}
          labels: ${{ steps.meta.outputs.labels }}
          # Distinct cache scope from the server image builds.
          cache-from: type=gha,scope=cli-${{ matrix.platform }}
          cache-to: type=gha,scope=cli-${{ matrix.platform }},mode=max
          outputs: type=image,name=${{ env.GHCR_IMAGE }},push-by-digest=true,name-canonical=true,push=${{ !inputs.dry_run }}

      - name: Export digest
        if: ${{ !inputs.dry_run }}
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        if: ${{ !inputs.dry_run }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: digests-${{ matrix.runner }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  # Merge platform images into a multi-arch manifest
  merge:
    name: Merge & Push Manifest
    needs: [prepare, build]
    if: ${{ !inputs.dry_run }}
    runs-on: ubuntu-22.04
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Login to GitHub Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Download digests
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ env.GHCR_IMAGE }}
          tags: |
            type=semver,pattern={{version}},value=${{ needs.prepare.outputs.version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.prepare.outputs.version }}
            type=sha,prefix=
          flavor: |
            latest=auto

      - name: Create and push multi-arch manifest
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ env.GHCR_IMAGE }}@sha256:%s ' *)

      - name: Inspect manifest
        run: |
          docker buildx imagetools inspect "${{ env.GHCR_IMAGE }}:${{ needs.prepare.outputs.version }}"