release.yml

name: Release

on:
  push:
    tags:
      - "v*"

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  test:
    name: Test gate
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Set up JDK 21 (Temurin)
        uses: actions/setup-java@v5
        with:
          java-version: "21"
          distribution: temurin

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Run tests
        run: ./gradlew test integrationTest --no-daemon

  images:
    name: Build & sign ${{ matrix.image }}
    needs: test
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        include:
          - { image: fincore-ledger, context: ".", file: Dockerfile, build_args: "SERVICE=ledger" }
          - { image: fincore-payments, context: ".", file: Dockerfile, build_args: "SERVICE=payments" }
          - { image: fincore-compliance, context: ".", file: Dockerfile, build_args: "SERVICE=compliance" }
          - { image: fincore-decision, context: ".", file: Dockerfile, build_args: "SERVICE=decision" }
          - { image: fincore-web, context: "web", file: web/Dockerfile, build_args: "" }

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.file }}
          build-args: ${{ matrix.build_args }}
          push: true
          platforms: linux/amd64,linux/arm64
          tags: |
            ghcr.io/tiana-code/${{ matrix.image }}:${{ steps.version.outputs.version }}
            ghcr.io/tiana-code/${{ matrix.image }}:latest
          labels: |
            org.opencontainers.image.source=https://github.com/tiana-code/fincore-engine
            org.opencontainers.image.version=${{ steps.version.outputs.version }}
            org.opencontainers.image.licenses=BUSL-1.1
          cache-from: type=gha,scope=${{ matrix.image }}
          cache-to: type=gha,mode=max,scope=${{ matrix.image }}

      - name: Sign image with cosign (keyless)
        run: |
          cosign sign --yes \
            ghcr.io/tiana-code/${{ matrix.image }}@${{ steps.build.outputs.digest }}

  helm:
    name: Package & sign Helm umbrella chart
    needs: test
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Set up Helm
        uses: azure/setup-helm@v5
        with:
          version: "v3.16.4"

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Log in to GHCR for Helm OCI
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" \
            | helm registry login ghcr.io --username "${{ github.actor }}" --password-stdin

      - name: Build chart dependencies
        run: helm dependency build deploy/helm/fincore-engine

      - name: Package Helm umbrella chart
        run: |
          helm package deploy/helm/fincore-engine \
            --version "${{ steps.version.outputs.version }}" \
            --app-version "${{ steps.version.outputs.version }}" \
            --destination /tmp/helm-packages

      - name: Push Helm chart to GHCR OCI registry
        run: |
          helm push "/tmp/helm-packages/fincore-engine-${{ steps.version.outputs.version }}.tgz" \
            oci://ghcr.io/tiana-code/charts

      - name: Sign Helm chart with cosign (keyless)
        run: |
          cosign sign --yes \
            ghcr.io/tiana-code/charts/fincore-engine:${{ steps.version.outputs.version }}

  release:
    name: SBOM & GitHub release
    needs: [images, helm]
    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Set up JDK 21 (Temurin)
        uses: actions/setup-java@v5
        with:
          java-version: "21"
          distribution: temurin

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Generate SBOM (CycloneDX aggregate)
        run: ./gradlew cyclonedxBom --no-daemon

      - name: Create GitHub release
        uses: softprops/action-gh-release@v3
        with:
          generate_release_notes: true
          files: |
            build/reports/cyclonedx/bom.json
            build/reports/cyclonedx/bom.xml
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}