cozystack/.github/workflows/pull-requests-release.yaml

name: Releasing PR

on:
  pull_request:
    types: [labeled, opened, synchronize, reopened, closed]

jobs:
  verify:
    name: Test Release
    runs-on: [self-hosted]
    permissions:
      contents: read
      packages: write

    if: |
      contains(github.event.pull_request.labels.*.name, 'ok-to-test') &&
      contains(github.event.pull_request.labels.*.name, 'release') &&
      github.event.action != 'closed'

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
          registry: ghcr.io

      - name: Run tests
        run: make test

  finalize:
    name: Finalize Release
    runs-on: [self-hosted]
    permissions:
      contents: write
  
    if: |
      github.event.pull_request.merged == true &&
      contains(github.event.pull_request.labels.*.name, 'release')
  
    steps:
      - name: Extract tag from branch name
        id: get_tag
        uses: actions/github-script@v7
        with:
          script: |
            const branch = context.payload.pull_request.head.ref;
            const match = branch.match(/^release-(v\d+\.\d+\.\d+(?:[-\w\.]+)?)$/);
  
            if (!match) {
              core.setFailed(`Branch '${branch}' does not match expected format 'release-vX.Y.Z[-suffix]'`);
            } else {
              const tag = match[1];
              core.setOutput('tag', tag);
              console.log(`✅ Extracted tag: ${tag}`);
            }
  
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
  
      - name: Create tag on merged commit
        run: |
          git tag ${{ steps.get_tag.outputs.tag }} ${{ github.sha }}
          git push origin ${{ steps.get_tag.outputs.tag }}
  
      - name: Publish draft release
        uses: actions/github-script@v7
        with:
          script: |
            const tag = '${{ steps.get_tag.outputs.tag }}';
            const releases = await github.rest.repos.listReleases({
              owner: context.repo.owner,
              repo: context.repo.repo
            });
  
            const release = releases.data.find(r => r.tag_name === tag && r.draft);
            if (!release) {
              throw new Error(`Draft release with tag ${tag} not found`);
            }
  
            await github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: release.id,
              draft: false
            });
  
            console.log(`✅ Published release for ${tag}`);