ci-publish.yaml

name: Publish CI

on:
  release:
    types:
      - released
  workflow_dispatch:

permissions: {}

jobs:
  read-version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.parse.outputs.version }}
    steps:
      - name: Assert ref type
        run: |-
          if [[ "$GITHUB_REF_TYPE" != "tag" ]]; then
            echo "::error::Publishing is only supported for tags!"
            exit 1
          fi

      - name: Checkout Repository
        uses: actions/checkout@v4.2.2

      - name: Parse Version from package.json
        id: parse
        run: |-
          VERSION=`jq -r '.version' package.json`
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

  call-build:
    needs:
      - read-version
    uses: ./.github/workflows/_meta-build.yaml
    with:
      app-version: ${{ needs.read-version.outputs.version }}
      publish-container: true
      ref-name: ${{ github.ref_name }}
    permissions:
      packages: write # Required to push images to ghcr.io
      security-events: write # Required to upload trivy's SARIF output
    secrets:
      registry-0-usr: ${{ github.repository_owner }}
      registry-0-psw: ${{ secrets.GITHUB_TOKEN }}

  update-github-release:
    runs-on: ubuntu-latest
    needs:
      - read-version
      - call-build
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4.2.2

      - name: Download Artifacts
        uses: actions/download-artifact@v4.1.8
        with:
          name: assembled-frontend

      - name: Create Checksums
        run: |-
          zip -qr frontend-dist.zip dist/*

          echo "# SHA1" >> checksums.txt
          sha1sum frontend-dist.zip >> checksums.txt
          echo "# SHA256" >> checksums.txt
          sha256sum frontend-dist.zip >> checksums.txt
          echo "# SHA512" >> checksums.txt
          sha512sum frontend-dist.zip >> checksums.txt

      - name: Update Release
        env:
          GITHUB_TOKEN: ${{ secrets.BOT_RELEASE_TOKEN }}
        run: |-
          gh release upload ${{ needs.read-version.outputs.version }} \
            --clobber \
            frontend-dist.zip \
            checksums.txt \
            bom.xml bom.json