fix(ci): gate wallet builds and deployment on published releases

.github/workflows/patch-v1.10-CI-build-release.yml

@@ -2,7 +2,7 @@
 name: Patch v1.10.x and Release
 on:
   workflow_dispatch:
-  
+
 env:
   project-directory: ./
 
@@ -28,7 +28,7 @@ jobs:
           --health-timeout 5s
           --health-retries 5
     steps:
-        # just care about the v1.10.x version, this is the current online version
+      # just care about the v1.10.x version, this is the current online version
       - uses: actions/checkout@v2
         with:
           ref: v1.10
@@ -67,52 +67,89 @@ jobs:
           DATABASE_URL: postgresql://postgres:postgres@postgres/postgres
           CI: true
   release:
-    name: Release and Build
+    name: Release v1.10
     needs: test
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    outputs:
+      new-release-published: ${{ steps.semantic-release.outputs.new-release-published }}
+      new-release-version: ${{ steps.semantic-release.outputs.new-release-version }}
+      new-release-git-tag: ${{ steps.semantic-release.outputs.new-release-git-tag }}
     steps:
-    - uses: actions/checkout@v2
-      # just care about the v1.10.x version, this is the current online version
-      with:
-        ref: v1.10
-    - name: Use Node.js 14.x
-      uses: actions/setup-node@v1
-      with:
-        node-version: '14.x'
-    - run: npm i -g semantic-release @semantic-release/{git,exec,changelog}
-    - run: semantic-release --branches v1.10
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: npm clean install
-      run: npm ci
-      working-directory: ${{ env.project-directory }}
-    - name: get-npm-version
-      id: package-version
-      uses: martinbeentjes/npm-get-version-action@master
-      with:
-        path: ./
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v1
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v1
-    - name: Login to DockerHub
-      uses: docker/login-action@v1 
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
-    - name: Build snapshot with git sha and push on merge
-      id: docker_build_snapshot_merge
-      uses: docker/build-push-action@v2
-      with:
-        context: ./
-        file: ./Dockerfile
-        push: true
-        tags: greenstand/treetracker-wallet-api:${{ steps.package-version.outputs.current-version }}
-    - shell: bash
-      run: |
-        echo '${{ steps.package-version.outputs.current-version }}' > image-tag
-    - name: persist tag name
-      uses: actions/upload-artifact@v1
-      with:
-        name: image-tag-${{github.sha}}
-        path: image-tag
+      - uses: actions/checkout@v4
+        with:
+          ref: v1.10
+          fetch-depth: 0
+      - name: Use Node.js LTS
+        uses: actions/setup-node@v4
+        with:
+          node-version: 'lts/*'
+      - run: npm i -g semantic-release @semantic-release/{git,exec,changelog}
+      # The maintenance branch does not inherit master's release-output plugin.
+      # Copy only that plugin from the workflow revision, preserving its config.
+      - name: Enable release outputs on the maintenance branch
+        env:
+          WORKFLOW_SHA: ${{ github.sha }}
+        run: |
+          node <<'NODE'
+          const fs = require('fs');
+          const { execFileSync } = require('child_process');
+          const workflowConfig = JSON.parse(execFileSync('git', ['show', `${process.env.WORKFLOW_SHA}:.releaserc`], { encoding: 'utf8' }));
+          const outputPlugin = workflowConfig.plugins.find(plugin => Array.isArray(plugin) && plugin[0] === '@semantic-release/exec');
+          if (!outputPlugin) throw new Error('Release-output plugin is missing from the workflow revision');
+          const config = JSON.parse(fs.readFileSync('.releaserc', 'utf8'));
+          config.plugins = config.plugins.filter(plugin => (Array.isArray(plugin) ? plugin[0] : plugin) !== '@semantic-release/exec');
+          config.plugins.push(outputPlugin);
+          fs.writeFileSync('.releaserc', `${JSON.stringify(config, null, 2)}\n`);
+          NODE
+      - name: Run semantic-release
+        id: semantic-release
+        # A dispatch from master still releases the checked-out v1.10 branch.
+        run: env GITHUB_REF=refs/heads/v1.10 semantic-release --branches v1.10
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  build:
+    name: Build and push v1.10 release image
+    needs: release
+    if: needs.release.outputs.new-release-published == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.release.outputs.new-release-git-tag }}
+      - name: Use Node.js 14.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: '14.x'
+      - name: npm clean install
+        run: npm ci
+        working-directory: ${{ env.project-directory }}
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build and push release image
+        uses: docker/build-push-action@v2
+        with:
+          context: ./
+          file: ./Dockerfile
+          push: true
+          tags: greenstand/treetracker-wallet-api:${{ needs.release.outputs.new-release-version }}
+      - name: Write image tag
+        env:
+          IMAGE_TAG: ${{ needs.release.outputs.new-release-version }}
+        run: printf '%s\n' "$IMAGE_TAG" > image-tag
+      - name: Persist tag name
+        uses: actions/upload-artifact@v4
+        with:
+          name: image-tag-${{ github.sha }}
+          path: image-tag

.github/workflows/treetracker-wallet-api-build-deploy-dev.yml

@@ -12,35 +12,55 @@ env:
   project-directory: ./
 
 jobs:
-  build:
-    name: Release and Build
+  release:
+    name: Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     if: |
       !contains(github.event.head_commit.message, 'skip-ci') &&
       github.event_name == 'push' &&
       github.repository == 'Greenstand/treetracker-wallet-api'
+    outputs:
+      new-release-published: ${{ steps.semantic-release.outputs.new-release-published }}
+      new-release-version: ${{ steps.semantic-release.outputs.new-release-version }}
+      new-release-git-tag: ${{ steps.semantic-release.outputs.new-release-git-tag }}
     steps:
       - uses: actions/checkout@v4
-      - name: Use Node.js 20.x
+        with:
+          fetch-depth: 0
+      - name: Use Node.js LTS
         uses: actions/setup-node@v4
         with:
-          node-version: '20.x'
+          node-version: 'lts/*'
 
       - run: npm i -g semantic-release @semantic-release/{git,exec,changelog}
-      - run: semantic-release
+      - name: Run semantic-release
+        id: semantic-release
+        run: semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+  build:
+    name: Build and push release image
+    runs-on: ubuntu-latest
+    needs: release
+    if: needs.release.outputs.new-release-published == 'true'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.release.outputs.new-release-git-tag }}
+      - name: Use Node.js 20.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+
       - name: npm clean install
         run: npm ci
         working-directory: ${{ env.project-directory }}
 
-      - name: get-npm-version
-        id: package-version
-        uses: martinbeentjes/npm-get-version-action@master
-        with:
-          path: ./
-
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
 
@@ -60,50 +80,27 @@ jobs:
           context: ./
           file: ./Dockerfile
           push: true
-          tags: greenstand/treetracker-wallet-api:${{ steps.package-version.outputs.current-version }}
-
-      - shell: bash
-        run: |
-          echo '${{ steps.package-version.outputs.current-version }}' > image-tag
-
-      - name: persist tag name
-        uses: actions/upload-artifact@v4
-        with:
-          name: image-tag-${{github.sha}}
-          path: image-tag
+          tags: greenstand/treetracker-wallet-api:${{ needs.release.outputs.new-release-version }}
 
   deploy:
     name: Deploy latest to development environment
     runs-on: ubuntu-latest
-    needs: build
-    if: |
-      !contains(github.event.head_commit.message, 'skip-ci') &&
-      github.event_name == 'push' &&
-      github.repository == 'Greenstand/${{ github.event.repository.name }}'
+    needs: [release, build]
+    if: needs.release.outputs.new-release-published == 'true'
     steps:
       - uses: actions/checkout@v4
-      - name: get-npm-version
-        id: package-version
-        uses: martinbeentjes/npm-get-version-action@master
         with:
-          path: ./
-
-      - name: Download tag name
-        uses: actions/download-artifact@v4
-        with:
-          name: image-tag-${{github.sha}}
-
-      - name: Set image tag name
-        id: image-tag-name
-        run: |
-          value=`cat image-tag`
-          echo "::set-output name=image-tag-name::$value"
+          ref: ${{ needs.release.outputs.new-release-git-tag }}
 
       - name: Install kustomize
         run: curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"  | bash
 
       - name: Run kustomize
-        run: (cd deployment/overlays/development && ../../../kustomize edit set image greenstand/treetracker-wallet-api:${{ steps.image-tag-name.outputs.image-tag-name }} )
+        env:
+          IMAGE_TAG: ${{ needs.release.outputs.new-release-version }}
+        run: |
+          cd deployment/overlays/development
+          ../../../kustomize edit set image "greenstand/treetracker-wallet-api:${IMAGE_TAG}"
 
       - name: Install doctl for kubernetes
         uses: digitalocean/action-doctl@v2
@@ -124,12 +121,15 @@ jobs:
   test:
     name: End to End Test
     runs-on: ubuntu-latest
-    needs: deploy
+    needs: [release, deploy]
+    if: needs.release.outputs.new-release-published == 'true'
     env:
       ENVIRONMENT: dev
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.release.outputs.new-release-git-tag }}
 
       - name: Use Node.js 20.x
         uses: actions/setup-node@v4

.releaserc

@@ -1,14 +1,23 @@
 {
   "branches": ["master", "v1.10"],
   "plugins": [
-      "@semantic-release/commit-analyzer",
-      "@semantic-release/release-notes-generator",
-      "@semantic-release/changelog",
-      "@semantic-release/npm",
-      ["@semantic-release/git", {
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    "@semantic-release/changelog",
+    "@semantic-release/npm",
+    [
+      "@semantic-release/git",
+      {
         "assets": ["docs", "package.json", "CHANGELOG.md"],
         "message": "chore(release): ${nextRelease.version} [skip ci]"
-      }],
-      "@semantic-release/github"
+      }
+    ],
+    "@semantic-release/github",
+    [
+      "@semantic-release/exec",
+      {
+        "successCmd": "if [ -n \"$GITHUB_OUTPUT\" ]; then printf '%s\\n' 'new-release-published=true' 'new-release-version=${nextRelease.version}' 'new-release-git-tag=${nextRelease.gitTag}' >> \"$GITHUB_OUTPUT\"; fi"
+      }
     ]
+  ]
 }

README.md

@@ -624,14 +624,26 @@ Any developers joining the project should feel free to review any outstanding pu
 
 When you are ready to submit a pull request, please rebase your branch off of the shared master branch again to integrate any new updates in the codebase before submitting.
 
+# CI releases
+
+The development workflow runs semantic-release before building an image. If no
+release is published, Docker build/push, development deployment, and post-deploy
+end-to-end tests are skipped. When a release is published, these jobs check out
+its Git tag and use its version for the Docker image tag.
+
+The manual v1.10 patch workflow also builds and uploads an image tag only after a
+release is published. It runs from master and checks out v1.10 for the release,
+adding the release-output plugin to that branch's existing configuration.
+Manual test and production deployment workflows can still deploy an existing tag.
+
 # How to patch v1.10.x
 
 Now the online version of wallet API is v1.10.x, to patch this version:
 
 1. Checkout branch: v1.10
 2. Do the work, commit, NOTE, just commit with comment `fix:` rather than `feat`
 3. Raise PR against v1.10
-4. Run action: Patch v1.10.x and Release (NOTE, choose running on branch v1.10)
+4. Run action: Patch v1.10.x and Release (NOTE, choose running on branch master; the workflow releases v1.10)
 5. Check if new tag with name v1.10.x created
 6. Run action: Deploy to Production (NOTE, choose running on branch v1.10, and the tag name just created)
 7. Check the online version, it should be the one you released.