release.yml

# Build the git-bridge image on every `v*` tag (or manual run) and push it to
# GHCR. Deployment is NOT done here — the fleet repo (mind-studio/mindpods-infra)
# pins the printed @sha256 digest in its images.env and rolls the stack.
#
#   git tag v0.1.0 && git push --tags
#
# "Codespaces" is the product/brand; this image is the git→pod engine under it,
# named `git-bridge`.
#
# GHCR auth uses the built-in GITHUB_TOKEN (needs Actions → Workflow
# permissions → read+write packages). The same token installs the public
# @mind-studio/* packages from GitHub Packages during `npm ci`.

name: release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      ref:
        description: "git ref to build (tag or branch)"
        required: true
        default: "main"

permissions:
  contents: read
  packages: write

env:
  # Run JS actions (checkout, docker/*) on Node 24 - silences the Node-20
  # deprecation warning. Becomes the default after 2026-06-16.
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  REGISTRY: ghcr.io
  IMAGE_NAME: git-bridge

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref || github.ref }}

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute image tags
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=tag
            type=sha,format=long
            type=raw,value=latest,enable=${{ github.ref_type == 'tag' }}

      - name: Build & push
        id: push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: infra/prod/Dockerfile.bridge
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          # The masthead app launcher links to the sibling Mind apps; their
          # public URLs are inlined into the UI at build time.
          build-args: |
            NEXT_PUBLIC_APP_DOCK_URL=https://dock.mindpods.org
            NEXT_PUBLIC_APP_DRIVE_URL=https://drive.mindpods.org
            NEXT_PUBLIC_APP_BUILDER_URL=https://builder.mindpods.org
            NEXT_PUBLIC_APP_CODESPACES_URL=https://codespaces.mindpods.org
            NEXT_PUBLIC_FEEDBACK_INBOX=https://pods.mindpods.org/mind/codespaces-feedback/
          # Auth for installing the public @mind-studio/* packages from GitHub
          # Packages during `npm ci`. Never baked into a layer (BuildKit secret).
          secrets: |
            node_auth_token=${{ secrets.GITHUB_TOKEN }}

      - name: Emit digest-pinned image ref
        run: |
          IMAGE_LC="$(echo "${REGISTRY}/${{ github.repository_owner }}/${IMAGE_NAME}" | tr '[:upper:]' '[:lower:]')"
          REF="${IMAGE_LC}@${{ steps.push.outputs.digest }}"
          echo "Pinned image: ${REF}"
          {
            echo "### git-bridge image"
            echo "Paste into mindpods-infra/images.env:"
            echo '```'
            echo "MIND_BRIDGE_IMAGE=${REF}"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"