build-and-push-production.yml

name: Build and Push Docker Image Production

on:
  pull_request:
    paths:
      - "**/**"
      - "!.github/**"
      - "!k8s/**"
      - "!.dockerignore"
      - "!.editorconfig"
      - "!.gitignore"
      - "!.node-version"
      - "!CHANGELOG.md"
      - "!README.md"
    branches:
      - main
    types:
      - closed

jobs:
  merge_and_publish_prod:
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true &&
      (startsWith(github.event.pull_request.head.ref, 'release/') || startsWith(github.event.pull_request.head.ref, 'hotfix/'))
    permissions:
      contents: write
      packages: write
      actions: write
      pull-requests: write
    steps:
      - name: Extract version from branch name (for release branches)
        if: startsWith(github.event.pull_request.head.ref, 'release/')
        run: |
          BRANCH_NAME="${{ github.event.pull_request.head.ref }}"
          VERSION=${BRANCH_NAME#release/}

          echo "RELEASE_VERSION=$VERSION" >> $GITHUB_ENV

      - name: Extract version from branch name (for hotfix branches)
        if: startsWith(github.event.pull_request.head.ref, 'hotfix/')
        run: |
          BRANCH_NAME="${{ github.event.pull_request.head.ref }}"
          VERSION=${BRANCH_NAME#hotfix/}

          echo "RELEASE_VERSION=$VERSION" >> $GITHUB_ENV

      - name: Create Release
        uses: thomaseizinger/create-release@1.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          target_commitish: ${{ github.event.pull_request.merge_commit_sha }}
          tag_name: ${{ env.RELEASE_VERSION }}
          name: ${{ env.RELEASE_VERSION }}
          draft: false
          prerelease: false

      - name: Merge main into develop branch
        uses: thomaseizinger/create-pull-request@1.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          head: main
          base: develop
          title: Merge main into develop branch
          body: |
            This PR merges the main branch back into develop.
            This happens to ensure that the updates that happend on the release branch, i.e. CHANGELOG and manifest updates are also present on the develop branch.

      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: set lower case owner name
        run: |
          echo "REPO_LC=${REPO,,}" >>${GITHUB_ENV}
        env:
          REPO: "${{ github.repository }}"

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./.docker/Dockerfile.prod
          platforms: linux/amd64
          push: true
          tags: ghcr.io/${{ env.REPO_LC }}:${{ env.RELEASE_VERSION }}, ghcr.io/${{ env.REPO_LC }}:latest

      - name: "Setup yq"
        uses: dcarbone/install-yq-action@v1.1.1
        with:
          version: "v4.42.1"
          force: true

      - name: Initialize mandatory git config
        run: |
          git config --global user.name 'GitHub Actions'
          git config --global user.email 'noreply@github.com'

      - name: Bump version in values/develop.yaml
        run: yq -i '.deployment.image.tag=strenv(RELEASE_VERSION)' ./k8s/values/prod.yaml

      - name: Commit k8s values files
        id: make-commit
        run: |
          git add ./k8s/values/prod.yaml
          git commit --message "chore: update prod image to version ${{ env.RELEASE_VERSION }}"

          echo "::set-output name=commit::$(git rev-parse HEAD)"

      - name: Push changes
        uses: CasperWA/push-protected@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          branch: develop