Release #32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| inputs: | |
| image_tag: | |
| description: Optional image tag for manual runs | |
| required: false | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| smoke-test: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 | |
| - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f | |
| - name: Build image for tests | |
| uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 | |
| with: | |
| context: . | |
| file: docker/Dockerfile | |
| load: true | |
| tags: winebot:latest | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Capability Check - Environment & API | |
| run: | | |
| scripts/smoke-test.sh --phase health --no-build | |
| timeout-minutes: 10 | |
| - name: Capability Check - Automation (AHK/AutoIt) | |
| run: | | |
| scripts/smoke-test.sh --phase smoke --no-build | |
| timeout-minutes: 10 | |
| - name: Capability Check - Input Tracing & CV | |
| run: | | |
| scripts/smoke-test.sh --phase cv --no-build | |
| timeout-minutes: 10 | |
| - name: Capability Check - Trace Verification | |
| run: | | |
| scripts/smoke-test.sh --phase trace --no-build | |
| timeout-minutes: 10 | |
| - name: Capability Check - Recording & Artifacts | |
| run: | | |
| scripts/smoke-test.sh --phase recording --no-build --cleanup | |
| timeout-minutes: 10 | |
| - name: Scan image (Trivy) | |
| uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 | |
| with: | |
| image-ref: winebot:latest | |
| format: table | |
| exit-code: 1 | |
| ignore-unfixed: true | |
| severity: CRITICAL,HIGH | |
| publish: | |
| runs-on: ubuntu-latest | |
| needs: smoke-test | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 | |
| - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f | |
| - name: Set image tags | |
| id: meta | |
| run: | | |
| set -euo pipefail | |
| image="ghcr.io/${{ github.repository_owner }}/winebot" | |
| if [ "${{ github.event_name }}" = "release" ]; then | |
| tag="${{ github.ref_name }}" | |
| { | |
| echo "tags<<EOF" | |
| echo "${image}:${tag}" | |
| echo "${image}:latest" | |
| echo "${image}:sha-${GITHUB_SHA::7}" | |
| echo "EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| if [ -n "${{ github.event.inputs.image_tag }}" ]; then | |
| tag="${{ github.event.inputs.image_tag }}" | |
| else | |
| tag="manual-${GITHUB_SHA::7}" | |
| fi | |
| { | |
| echo "tags<<EOF" | |
| echo "${image}:${tag}" | |
| echo "${image}:sha-${GITHUB_SHA::7}" | |
| echo "EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build & push | |
| uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 | |
| with: | |
| context: . | |
| file: docker/Dockerfile | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |