release-push-image.yaml

##
# Copyright (C) 2024 Hedera Hashgraph, LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
##
name: Release Workflow

on:
  push:
    # `v*` tags are used for production environment
    tags: [ v* ]
    # `main` tag is used for integration environment
    branches: [ main ]
  # Manual trigger with custom release tag
  workflow_dispatch:
    inputs:
      version:
        description: 'Release tag:'
        type: string
        required: false

defaults:
  run:
    shell: bash

permissions:
  contents: read
  packages: write

env:
  OWNER: hashgraph
  PACKAGE_NAME: hedera-block-node
  REGISTRY: ghcr.io

jobs:
  publish:
    runs-on: [self-hosted, Linux, medium, ephemeral]

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Install JDK
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
        with:
          distribution: "temurin"
          java-version: 21

      - name: Build
        run: ./gradlew clean build

      - name: Login to GitHub Container Registry
        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Qemu
        uses: docker/setup-qemu-action@5927c834f5b4fdf503fca6f4c7eccda82949e1ee # v3.1.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.4.0
        with:
          driver-opts: network=host

      - name: Extract version
        id: extract_version
        run: |
          VERSION=$(grep 'version=' gradle.properties | cut -d '=' -f2)
          echo "VERSION=${VERSION}" >> $GITHUB_ENV

      - name: Build and push image
        uses: docker/build-push-action@1ca370b3a9802c92e886402e0dd88098a2533b12 # v6.4.1
        with:
          context: ./server/docker
          file: ./server/docker/Dockerfile
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64, linux/arm64
          push: true
          tags: ${{ env.REGISTRY }}/${{ github.repository }}:${{ env.VERSION }}
          build-args: |
            VERSION=${{ env.VERSION }}
          build-contexts: |
            distributions=./server/build/distributions


  helm-chart-release:
    needs: publish
    runs-on: [ self-hosted, Linux, medium, ephemeral ]
    permissions:
      contents: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Install Helm
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0

      - name: Publish helm chart
        uses: stefanprodan/helm-gh-pages@0ad2bb377311d61ac04ad9eb6f252fb68e207260 # v1.7.0
        with:
          target_dir: charts
          token: ${{ secrets.GITHUB_TOKEN }}
          branch: gh-pages
          app_version: ${{ env.VERSION }}