release.yml

name: Release Image

on:
  push:
    tags:
      - "v*.*.*"

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: acornops/execution-engine
  # 30 minutes allows full CI completion under occasional queue delays.
  CI_GATE_TIMEOUT_MS: 1800000
  # 15 seconds balances API polling load with release responsiveness.
  CI_GATE_POLL_MS: 15000

jobs:
  ci-gate:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
    steps:
      - name: Wait for CI workflow success
        uses: actions/github-script@v7
        with:
          script: |
            const workflowId = "ci.yml";
            const sha = context.sha;
            const timeoutMs = Number(process.env.CI_GATE_TIMEOUT_MS);
            const pollMs = Number(process.env.CI_GATE_POLL_MS);
            const start = Date.now();

            while (Date.now() - start < timeoutMs) {
              const { data } = await github.rest.actions.listWorkflowRuns({
                owner: context.repo.owner,
                repo: context.repo.repo,
                workflow_id: workflowId,
                event: "push",
                head_sha: sha,
                per_page: 20,
              });

              const matchingRun = data.workflow_runs
                .filter((run) => run.name === "CI")
                .sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime())[0];
              if (matchingRun) {
                core.info(`Found CI run ${matchingRun.id} with status=${matchingRun.status} conclusion=${matchingRun.conclusion}`);
                if (matchingRun.status === "completed") {
                  if (matchingRun.conclusion === "success") {
                    core.info("CI completed successfully for release commit.");
                    return;
                  }
                  core.setFailed(`Release blocked: CI conclusion is ${matchingRun.conclusion}.`);
                  return;
                }
              } else {
                core.info("No CI run found yet for this commit.");
              }

              await new Promise((resolve) => setTimeout(resolve, pollMs));
            }

            core.setFailed("Release blocked: timed out waiting for CI workflow completion.");

  release:
    needs: ci-gate
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Resolve release version
        id: version
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "image=${REGISTRY}/${IMAGE_NAME}:${VERSION}" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: .
          target: production
          push: true
          tags: ${{ steps.version.outputs.image }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.version=${{ steps.version.outputs.version }}
          provenance: true
          sbom: true
          cache-from: type=gha
          cache-to: type=gha,mode=max