call-release-version.yml

name: "🚀 Release: Version Logic"

on:
  workflow_call:
    inputs:
      tag:
        description: "Version tag to release (e.g. v1.2.3)"
        required: true
        type: string

  workflow_dispatch:
    inputs:
      tag:
        description: "🏷️ Version tag to release (e.g. v1.2.3)"
        required: true
        type: string

concurrency:
  group: infinito-release
  cancel-in-progress: false

permissions:
  contents: read
  packages: read

env:
  REGISTRY: ghcr.io
  DEFAULT_DISTRO: "debian"

jobs:
  check-ci-images:
    name: 🔎 Check CI images
    runs-on: ubuntu-26.04
    outputs:
      missing: ${{ steps.check.outputs.missing }}
      ci_tag: ${{ steps.citag.outputs.ci_tag }}
      distros: ${{ steps.vars.outputs.distros }}
      repo_prefix: ${{ steps.vars.outputs.repo_prefix }}
      owner: ${{ steps.vars.outputs.owner }}
      version_tag: ${{ steps.vars.outputs.version_tag }}
      publish_latest: ${{ steps.highest.outputs.publish_latest }}
    steps:
      - name: ⬇️ Checkout trusted workflow repo (helpers)
        uses: actions/checkout@v7.0.0
        with:
          ref: ${{ github.sha }}
          path: _helpers
          persist-credentials: false

      - name: 🔍 Resolve release inputs
        id: vars
        shell: bash
        run: bash _helpers/scripts/github/resolve/release/inputs.sh "${{ inputs.tag || github.event.inputs.tag }}"

      - name: ⬇️ Checkout repository at version tag
        uses: actions/checkout@v7.0.0
        with:
          ref: ${{ steps.vars.outputs.version_tag }}
          path: _src
          fetch-depth: 0
          fetch-tags: true

      - name: 🧮 Compute CI tag (ci-<sha> of version tag)
        id: citag
        shell: bash
        run: |
          set -euo pipefail
          sha="$(git -C _src rev-parse HEAD)"
          echo "ci_tag=ci-${sha}" >> "$GITHUB_OUTPUT"

      - name: 🤔 Decide whether this version should update latest
        id: highest
        shell: bash
        env:
          REPOSITORY_DIR: _src
          VERSION_TAG: ${{ steps.vars.outputs.version_tag }}
        run: _helpers/scripts/meta/resolve/publish_latest.sh

      - name: 🔑 Login to GHCR (manifest checks)
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 🔎 Check whether CI images already exist
        id: check
        shell: bash
        env:
          OWNER: ${{ steps.vars.outputs.owner }}
          REPO_PREFIX: ${{ steps.vars.outputs.repo_prefix }}
          INFINITO_DISTROS: ${{ steps.vars.outputs.distros }}
          CI_TAG: ${{ steps.citag.outputs.ci_tag }}
        run: |
          set -euo pipefail
          missing="$(_helpers/scripts/meta/resolve/missing/ci_images.sh)"
          echo "missing=${missing}" >> "$GITHUB_OUTPUT"

  build-ci-images-if-missing:
    name: 🏗️ Build missing CI images
    needs: check-ci-images
    if: needs.check-ci-images.outputs.missing == 'true'
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/call-images-build-ci.yml
    with:
      distros: ${{ needs.check-ci-images.outputs.distros }}
      checkout_ref: ${{ needs.check-ci-images.outputs.version_tag }}
      image_tag: ${{ needs.check-ci-images.outputs.ci_tag }}
      concurrency_channel: release-backfill
    secrets: inherit

  release:
    name: 🚀 Release version
    needs:
      - check-ci-images
      - build-ci-images-if-missing
    if: |
      !cancelled() &&
      needs.check-ci-images.result == 'success' &&
      (
        needs.build-ci-images-if-missing.result == 'success' ||
        needs.build-ci-images-if-missing.result == 'skipped'
      )
    runs-on: ubuntu-26.04
    permissions:
      contents: read
      packages: write
    env:
      VERSION_TAG: ${{ needs.check-ci-images.outputs.version_tag }}
      OWNER: ${{ needs.check-ci-images.outputs.owner }}
      REPO_PREFIX: ${{ needs.check-ci-images.outputs.repo_prefix }}
      INFINITO_DISTROS: ${{ needs.check-ci-images.outputs.distros }}
      CI_TAG: ${{ needs.check-ci-images.outputs.ci_tag }}
      PUBLISH_LATEST: ${{ needs.check-ci-images.outputs.publish_latest }}

    steps:
      - name: ⬇️ Checkout trusted workflow repo (helpers)
        uses: actions/checkout@v7.0.0
        with:
          ref: ${{ github.sha }}
          persist-credentials: false

      - name: 🔍 Resolve buildkit image ref
        id: buildkit
        shell: bash
        run: |
          set -euo pipefail
          ref="$(bash scripts/meta/resolve/image/service_ref.sh svc-runner buildkit mirror)"
          echo "ref=${ref}" >> "$GITHUB_OUTPUT"

      - name: ⬇️ Pre-pull buildkit image (retry 7x, 20s)
        shell: bash
        env:
          MAX_ATTEMPTS: "7"
          RETRY_DELAY_SECONDS: "20"
        run: bash scripts/github/runner/pull_with_retry.sh "${{ steps.buildkit.outputs.ref }}"

      - name: 🔧 Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
        with:
          driver-opts: image=${{ steps.buildkit.outputs.ref }}

      - name: 🔑 Login to GHCR
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 🏷️ Retag CI images to release tags (and latest for the highest version)
        shell: bash
        run: scripts/image/release.sh