tag-and-release.yaml

name: Publish UDS Package Mattermost

on:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  tag-new-version:
    name: Tag New Version
    permissions: write-all
    runs-on: ubuntu-latest
    outputs:
      release_created: ${{ steps.release-flag.outputs.release_created }}
    steps:
      - name: Create release tag
        id: tag
        uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3
      - id: release-flag
        run: echo "release_created=${{ steps.tag.outputs.release_created || false }}" >> $GITHUB_OUTPUT

  publish-package:
    needs: tag-new-version
    if: ${{ needs.tag-new-version.outputs.release_created == 'true' }}
    runs-on: ${{ matrix.architecture == 'arm64' && 'uds-swf-ubuntu-arm64-4-core' || 'uds-swf-ubuntu-big-boy-4-core' }}
    strategy:
      matrix:
        flavor: [upstream, unicorn, registry1]
        architecture: [amd64, arm64]
        exclude:
          - flavor: registry1
            architecture: arm64
    name: Publish ${{ matrix.flavor }} ${{ matrix.architecture }}

    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Environment setup
        uses: defenseunicorns/uds-common/.github/actions/setup@76287d41ec5f06ecbdd0a6453877a78675aceffe # v0.11.2
        with:
          registry1Username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
          registry1Password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }}
          ghToken: ${{ secrets.GITHUB_TOKEN }}
          chainguardIdentity: ${{ secrets.CHAINGUARD_IDENTITY }}

      - uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1

      - name: Build Package
        run: uds run -f tasks/publish.yaml build-package --set FLAVOR=${{ matrix.flavor }} --no-progress

      - name: Test Package
        if: ${{ runner.arch != 'ARM64' }}
        run: uds run -f tasks/publish.yaml test-package --set FLAVOR=${{ matrix.flavor }} --no-progress

      - name: Publish Package
        run: uds run -f tasks/publish.yaml publish-package --set FLAVOR=${{ matrix.flavor }} --no-progress

      # Only publish one version of the plugin package since it is "flavorless"
      - name: Publish Plugin Package
        if: ${{ matrix.flavor == 'upstream' }}
        run: uds run -f tasks/publish.yaml publish-plugin-package --set FLAVOR=${{ matrix.flavor }} --no-progress

      - name: Debug Output
        if: ${{ always() }}
        uses: defenseunicorns/uds-common/.github/actions/debug-output@76287d41ec5f06ecbdd0a6453877a78675aceffe # v0.11.2

      - name: Save logs
        if: always()
        uses: defenseunicorns/uds-common/.github/actions/save-logs@76287d41ec5f06ecbdd0a6453877a78675aceffe # v0.11.2
        with:
          suffix: ${{ matrix.flavor }}-${{ matrix.architecture }}-${{ github.run_id }}-${{ github.run_attempt }}