release-push-image.yaml

# SPDX-License-Identifier: Apache-2.0
name: Release Workflow

on:
  push:
    # `v*` tags are used for production environment
    tags: [ v* ]
    # `main` tag is used for integration environment
    branches: [ main ]
  # Manual trigger with custom release tag
  workflow_dispatch:
    inputs:
      version:
        description: 'Release tag:'
        type: string
        required: false

defaults:
  run:
    shell: bash

permissions:
  id-token: write
  contents: read
  packages: write

env:
  OWNER: hashgraph
  PACKAGE_NAME: hedera-block-node
  REGISTRY: ghcr.io

jobs:
  check-gradle:
    name: Gradle
    uses: ./.github/workflows/zxc-verify-gradle-build-determinism.yaml
    with:
      ref: ${{ github.event.inputs.ref || '' }}
      java-distribution: ${{ inputs.java-distribution || 'temurin' }}
      java-version: ${{ inputs.java-version || '21.0.5' }}

  check-docker:
    name: Docker
    uses: ./.github/workflows/zxc-verify-docker-build-determinism.yaml
    with:
      ref: ${{ github.event.inputs.ref || '' }}
      java-distribution: ${{ inputs.java-distribution || 'temurin' }}
      java-version: ${{ inputs.java-version || '21.0.5' }}

  publish:
    needs: [check-gradle, check-docker]
    runs-on: block-node-linux-medium

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Install JDK
        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
        with:
          distribution: "temurin"
          java-version: "21.0.5"

      - name: Build
        run: ./gradlew clean build

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Qemu
        uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
        with:
          driver-opts: network=host
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["https://hub.mirror.docker.lat.ope.eng.hashgraph.io"]

      - name: Extract version
        id: extract_version
        run: |
          VERSION=$(cat version.txt)
          echo "VERSION=${VERSION}" >> $GITHUB_ENV

      - name: Extract Source Date Epoch
        id: extract_source_date_epoch
        run: |
          SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)
          echo "SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}" >> $GITHUB_ENV

      - name: Server - Build and push image
        uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
        with:
          context: ./server/docker
          file: ./server/docker/Dockerfile
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64, linux/arm64
          push: true
          tags: ${{ env.REGISTRY }}/${{ github.repository }}:${{ env.VERSION }}
          build-args: |
            VERSION=${{ env.VERSION }}
            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
          build-contexts: |
            distributions=./server/build/distributions

      # Build and push SIMULATOR image

      - name: Simulator - Prepare docker directory
        run: |
          ./gradlew :simulator:copyDependenciesFolders

      - name: Simulator - Build and push image
        uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
        with:
          context: ./simulator/build/docker
          file: ./simulator/docker/Dockerfile
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64, linux/arm64
          push: true
          tags: ${{ env.REGISTRY }}/${{ github.repository }}/simulator-image:${{ env.VERSION }}
          build-args: |
            VERSION=${{ env.VERSION }}

  helm-chart-release:
    needs: publish
    runs-on: block-node-linux-medium

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install Helm
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract version
        id: extract_version
        run: |
          VERSION=$(cat version.txt)
          echo "VERSION=${VERSION}" >> $GITHUB_ENV

      - name: Package helm chart
        run: |
          helm dependency update charts/hedera-block-node
          helm package charts/hedera-block-node

      - name: Push helm chart
        run: |
          helm push block-node-helm-chart-${{ env.VERSION }}.tgz oci://ghcr.io/hashgraph/hedera-block-node

      - name: Simulator Chart - Package helm chart
        run: |
          helm dependency update charts/blockstream-simulator
          helm package charts/blockstream-simulator

      - name: Simulator Chart - Push helm chart
        run: |
          helm push bblockstream-simulator-chart-${{ env.VERSION }}.tgz oci://ghcr.io/hashgraph/hedera-block-node