release.yml

name: Project Release
on:
  push:
    tags:
      - '*'

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    steps:
      - name: Checkout source
        uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3

      - name: Setup PHP 8.2 with PHIVE
        uses: shivammathur/setup-php@efffd0e4f2504f936fcfe3b69293d31ce0e2fd7a # v2.30.3
        with:
          php-version: '8.2'
          ini-values: phar.readonly=0
          coverage: none
          tools: phive, composer:v2

      - name: Install dependencies
        uses: ramsey/composer-install@57532f8be5bda426838819c5ee9afb8af389d51a # v3.0.0

      - name: Build PHAR
        run: |
          phive --no-progress install --trust-gpg-keys 2DF45277AEF09A2F humbug/box
          phive status
          ./tools/box compile
          sha512sum bin/watchr.phar > bin/watchr.phar.sha512
        env:
          GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check that the PHAR works
        run: bin/watchr.phar --ansi --version
        env:
          BOX_REQUIREMENTS_CHECKER_LOG_TO_STDOUT: 1

      - name: Import GPG Key
        uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}

      - name: Sign PHAR
        run: >
          gpg
          --batch
          --yes
          --pinentry-mode loopback
          --local-user flaviohbatista@gmail.com
          --passphrase ${{ secrets.GPG_PASSPHRASE }}
          --detach-sign
          --output bin/watchr.phar.asc
          bin/watchr.phar

      - name: Create release
        id: create_release
        uses: softprops/action-gh-release@9d7c94cfd0a1f3ed45544c887983e9fa900f0564 # v2.0.4
        with:
          draft: true
          body: TODO
          files: |
            bin/watchr.phar
            bin/watchr.phar.sha512
            bin/watchr.phar.asc

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Docker Image (runtime-cli)
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: ./docker/Dockerfile
          push: true
          build-args:
            "VERSION=${{ github.ref_name }}"
          tags: |
            ghcr.io/flavioheleno/watchr:${{ github.ref_name }}
            ghcr.io/flavioheleno/watchr:latest
          target: runtime-cli
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build Docker Image (standalone-cli)
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          context: .
          file: ./docker/Dockerfile
          push: true
          build-args:
            "VERSION=${{ github.ref_name }}-standalone"
          tags: |
            ghcr.io/flavioheleno/watchr:${{ github.ref_name }}-standalone
            ghcr.io/flavioheleno/watchr:latest-standalone
          target: standalone-cli
          cache-from: type=gha
          cache-to: type=gha,mode=max