homarr/.github/workflows/deployment-docker-image.yml

name: "[Deployment] Release"

on:
  push:
    branches:
      - main
      - beta
      - next
      - dev
  workflow_dispatch:
    inputs:
      send-notifications:
        type: boolean
        required: false
        default: true
        description: Send notifications when redeploying an existing release

permissions:
  contents: write # Required to update package.json version
  packages: write # Required for pushing to GHCR

env:
  SKIP_ENV_VALIDATION: true
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  GHCR_REPO: ghcr.io/${{ github.repository }}
  TURBO_TELEMETRY_DISABLED: 1

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}

jobs:
  release:
    name: Create tag and release
    runs-on: ubuntu-latest
    timeout-minutes: 5
    env:
      SKIP_RELEASE: ${{ github.event_name == 'workflow_dispatch' || github.ref_name == 'dev' || github.ref_name == 'next' }}
    outputs:
      version: ${{ steps.read-semver.outputs.version || steps.version-fallback.outputs.version }}
      git_ref: ${{ steps.read-git-ref.outputs.ref || steps.read-semver.outputs.version || github.ref }}
      skipped: ${{ env.SKIP_RELEASE }}
      upstream_sync: ${{ steps.update-upstream.outcome }}
    steps:
      - run: echo "Manual dispatch redeploys the latest existing release without creating a new one"
        if: env.SKIP_RELEASE == 'true'
        # The below generated version fallback represents a normalized branch name, for example "feature/branch-name" -> "feature-branch-name"
      - run: echo "version="$(echo ${{github.ref_name}} | sed 's/[^a-zA-Z0-9\-]/-/g') >> "$GITHUB_OUTPUT"
        id: version-fallback
        if: env.SKIP_RELEASE == 'true' && github.ref_name != 'main' && github.ref_name != 'beta'

      - name: Obtain token
        if: env.SKIP_RELEASE == 'false'
        id: obtainToken
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
          client-id: ${{ vars.RENOVATE_MERGE_CLIENT_ID }}
          permission-contents: write # required to commit package.json & changelog changes, merge them to dev / next and publish the release

      - uses: actions/checkout@v7
        if: env.SKIP_RELEASE == 'false' || github.ref_name == 'main' || github.ref_name == 'beta'
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: oven-sh/setup-bun@v2
        if: env.SKIP_RELEASE == 'false'
        with:
          bun-version: 1.4.2
      - name: Verify major release intent
        if: env.SKIP_RELEASE == 'false'
        run: |
          latest_tag="$(git describe --tags --abbrev=0)"
          latest_major="${latest_tag#v}"
          latest_major="${latest_major%%.*}"
          package_version="$(jq --raw-output '.version' package.json)"
          package_major="${package_version%%.*}"

          if (( package_major <= latest_major )); then
            exit 0
          fi

          if git log --format='%s%n%b' "${latest_tag}..HEAD" \
            | grep --extended-regexp --quiet '(^[[:alnum:]-]+(\([^)]*\))?!:)|(^BREAKING[ -]CHANGE:)'; then
            exit 0
          fi

          echo "::error::package.json declares ${package_version}, but commits since ${latest_tag} contain no breaking-change signal. Use a conventional ! commit or BREAKING CHANGE footer so Semantic Release creates the intended major version."
          exit 1
      - name: Install dependencies
        if: env.SKIP_RELEASE == 'false'
        run: bun install --frozen-lockfile
      - name: Run Semantic Release
        if: env.SKIP_RELEASE == 'false'
        env:
          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
          GIT_AUTHOR_NAME: "Releases Homarr"
          GIT_AUTHOR_EMAIL: "175486441+homarr-releases[bot]@users.noreply.github.com"
          GIT_COMMITTER_NAME: "Releases Homarr"
          GIT_COMMITTER_EMAIL: "175486441+homarr-releases[bot]@users.noreply.github.com"
        run: |
          bun run release
      - name: Read semver output
        # We read the last tag either from the created release or from the current branch, this is to rerun the deployment job for the currently released version when it failed
        if: env.SKIP_RELEASE == 'false' || github.ref_name == 'main' || github.ref_name == 'beta'
        id: read-semver
        run: |
          git fetch --tags
          echo "version=$(git describe --tags --abbrev=0)" >> "$GITHUB_OUTPUT"
      - name: Read git ref
        if: env.SKIP_RELEASE == 'false'
        id: read-git-ref
        run: |
          echo "ref=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
      - name: Update dev / next branch
        id: update-upstream
        if: env.SKIP_RELEASE == 'false'
        # Finish publishing the already-created release, then fail in the publish job if synchronization did not work.
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
          UPSTREAM_BRANCH: ${{ github.ref_name == 'main' && 'dev' || 'next' }}
          RELEASE_REF: ${{ steps.read-git-ref.outputs.ref }}
        run: |
          git config user.name "Releases Homarr"
          git config user.email "175486441+homarr-releases[bot]@users.noreply.github.com"
          git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git fetch origin "$UPSTREAM_BRANCH"

          # Dependency installation can modify generated files in the release checkout.
          sync_dir="$(mktemp -d "${RUNNER_TEMP}/homarr-release-sync.XXXXXX")"
          trap 'git worktree remove --force "$sync_dir"' EXIT
          git worktree add --detach "$sync_dir" FETCH_HEAD
          git -C "$sync_dir" merge --no-edit "$RELEASE_REF"
          git -C "$sync_dir" push origin "HEAD:${UPSTREAM_BRANCH}"
  build-amd64:
    name: Build docker image for amd64
    needs: release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.release.outputs.git_ref }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: "${{ env.GHCR_REPO }}"

      - name: Log in to the Container registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          network: host
          platforms: linux/amd64
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
          secrets: |
            TURBO_API=${{ secrets.TURBO_API }}
            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
        env:
          SKIP_ENV_VALIDATION: true
  build-arm64:
    name: Build docker image for arm64
    needs: release
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 20
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.release.outputs.git_ref }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: "${{ env.GHCR_REPO }}"

      - name: Log in to the Container registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          network: host
          platforms: linux/arm64
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
          secrets: |
            TURBO_API=${{ secrets.TURBO_API }}
            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
        env:
          SKIP_ENV_VALIDATION: true
  extract-asset-amd64:
    name: Extract amd64 asset from docker image
    needs: [release, build-amd64]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
        if: needs.release.outputs.skipped == 'false'
        with:
          ref: ${{ needs.release.outputs.git_ref }}
          persist-credentials: false
      - name: Extract amd64
        if: needs.release.outputs.skipped == 'false'
        uses: ./.github/actions/extract-build-artifact
        with:
          digest: "${{ env.GHCR_REPO }}@${{ needs.build-amd64.outputs.digest }}"
          architecture: amd64
          release-tag: ${{ needs.release.outputs.version }}
          token: ${{ secrets.GITHUB_TOKEN }}
          repository: ${{ github.repository }}

  extract-asset-arm64:
    name: Extract arm64 asset from docker image
    needs: [release, build-arm64]
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
        if: needs.release.outputs.skipped == 'false'
        with:
          ref: ${{ needs.release.outputs.git_ref }}
          persist-credentials: false
      - name: Extract arm64
        if: needs.release.outputs.skipped == 'false'
        uses: ./.github/actions/extract-build-artifact
        with:
          digest: "${{ env.GHCR_REPO }}@${{ needs.build-arm64.outputs.digest }}"
          architecture: arm64
          release-tag: ${{ needs.release.outputs.version }}
          token: ${{ secrets.GITHUB_TOKEN }}
          repository: ${{ github.repository }}
  publish:
    name: Complete deployment and notify
    needs: [release, build-amd64, build-arm64, extract-asset-amd64, extract-asset-arm64]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    env:
      NEXT_VERSION: ${{ needs.release.outputs.version }}
      DEPLOY_LATEST: ${{ github.ref_name == 'main' }}
      DEPLOY_BETA: ${{ github.ref_name == 'beta' }}
    steps:
      - name: Obtain token
        if: needs.release.outputs.skipped == 'false'
        id: obtainToken
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
          client-id: ${{ vars.RENOVATE_MERGE_CLIENT_ID }}
          permission-contents: write # required to publish the release

      - name: Log in to the Container registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish beta
        if: env.DEPLOY_BETA == 'true'
        run: |
          docker buildx imagetools create -t ${{ env.GHCR_REPO }}:beta \
            ${{ env.GHCR_REPO }}@${{ needs.build-amd64.outputs.digest }} \
            ${{ env.GHCR_REPO }}@${{ needs.build-arm64.outputs.digest }}

      - name: Publish latest
        if: env.DEPLOY_LATEST == 'true'
        run: |
          docker buildx imagetools create -t ${{ env.GHCR_REPO }}:latest \
            ${{ env.GHCR_REPO }}@${{ needs.build-amd64.outputs.digest }} \
            ${{ env.GHCR_REPO }}@${{ needs.build-arm64.outputs.digest }}

      - name: Publish version
        run: |
          docker buildx imagetools create -t ${{ env.GHCR_REPO }}:${{ env.NEXT_VERSION }} \
            ${{ env.GHCR_REPO }}@${{ needs.build-amd64.outputs.digest }} \
            ${{ env.GHCR_REPO }}@${{ needs.build-arm64.outputs.digest }}

      - name: Publish release
        if: needs.release.outputs.skipped == 'false'
        env:
          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
        run: |
          gh release edit --repo ${{ github.repository }} ${{ needs.release.outputs.version }} --draft=false

      - name: Verify dev / next synchronization
        if: needs.release.outputs.skipped == 'false' && needs.release.outputs.upstream_sync != 'success'
        run: |
          echo "::error::The released commit was not synchronized back to the upstream development branch."
          exit 1

      - name: Discord notification
        if: github.event_name != 'workflow_dispatch' || inputs['send-notifications']
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
        with:
          args: "Successfully deployed images for branch **${{ github.ref_name }}**. Tagged as **${{env.NEXT_VERSION}}**."

  notify-failure:
    name: Notify deployment failure
    if: ${{ always() && (failure() || cancelled()) && (github.event_name != 'workflow_dispatch' || inputs['send-notifications']) }}
    needs: [release, build-amd64, build-arm64, extract-asset-amd64, extract-asset-arm64, publish]
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: Discord failure notification
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
        with:
          args: "The deployment for branch **${{ github.ref_name }}** failed or was cancelled: [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"