ci: conventional commits et semantic release (epic #101)

.github/workflows/lint-commits.yml

@@ -0,0 +1,20 @@
+name: lint-commits
+on:
+  pull_request:
+    branches:
+      - master
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  commitlint:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: wagoid/commitlint-github-action@v6
+        with:
+          configFile: commitlint.config.mjs

.github/workflows/lint-pr-title.yml

@@ -0,0 +1,20 @@
+name: lint-pr-title
+on:
+  pull_request:
+    branches:
+      - master
+    types:
+      - opened
+      - edited
+      - synchronize
+
+permissions:
+  pull-requests: read
+
+jobs:
+  lint-pr-title:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/push-latest.yml

@@ -30,7 +30,10 @@ jobs:
           echo "AWS_VERSION=$(jq -r '.awscli_versions | sort | .[-1]' supported_versions.json)" >> $GITHUB_ENV
 
       - name: Login to Docker Hub registry
-        run: echo '${{ secrets.DOCKERHUB_PAT }}' | docker login -u ${{ secrets.DOCKERHUB_USERNAME }} --password-stdin
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PAT }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2

.github/workflows/release.yml

@@ -1,63 +1,88 @@
 name: release
-
-# trigger on published release
 on:
-  release:
-    types: [published]
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  ORGANIZATION: "bgauduch"
+  IMAGE_NAME: "terraform-aws-cli"
 
 jobs:
   load_supported_versions:
     runs-on: ubuntu-22.04
-
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
-
     steps:
-      - name: Check out the repo
-        uses: actions/checkout@v3
-
-      - name: Save supported versions as output
-        id: set-matrix
+      - uses: actions/checkout@v4
+      - id: set-matrix
         run: |
           VERSIONS=$(cat ./supported_versions.json | jq -c)
           echo "matrix=${VERSIONS}" >> $GITHUB_OUTPUT
 
   build_push_release:
     runs-on: ubuntu-22.04
     needs: load_supported_versions
-
     strategy:
       matrix: ${{ fromJSON(needs.load_supported_versions.outputs.matrix) }}
-
-    env:
-      ORGANIZATION: "zenika"
-      IMAGE_NAME: "terraform-aws-cli"
-
     steps:
-      - name: Check out the repo
-        uses: actions/checkout@v3
-
-      - name: Get and save the release tag
-        run: echo "RELEASE_TAG=${GITHUB_REF##*/}" >> $GITHUB_ENV
-
-      - name: Login to Docker Hub registry
-        run: echo '${{ secrets.DOCKERHUB_PAT }}' | docker login -u ${{ secrets.DOCKERHUB_USERNAME }} --password-stdin
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
-      - name: Set up Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Build and push container images
-        uses: docker/build-push-action@v4
+      - uses: actions/checkout@v4
+      - name: Get release version
+        run: echo "RELEASE_VERSION=${GITHUB_REF_NAME}" >> $GITHUB_ENV
+      - name: Get minor versions for floating tags
+        run: |
+          TF_MINOR=$(echo "${{ matrix.tf_versions }}" | cut -d. -f1-2)
+          AWS_MINOR=$(echo "${{ matrix.awscli_versions }}" | cut -d. -f1-2)
+          echo "TF_MINOR=${TF_MINOR}" >> $GITHUB_ENV
+          echo "AWS_MINOR=${AWS_MINOR}" >> $GITHUB_ENV
+      - name: Check if this is the latest version combination
+        run: |
+          LATEST_TF=$(jq -r '.tf_versions | sort | .[-1]' supported_versions.json)
+          LATEST_AWS=$(jq -r '.awscli_versions | sort | .[-1]' supported_versions.json)
+          if [ "${{ matrix.tf_versions }}" = "${LATEST_TF}" ] && [ "${{ matrix.awscli_versions }}" = "${LATEST_AWS}" ]; then
+            echo "IS_LATEST=true" >> $GITHUB_ENV
+          else
+            echo "IS_LATEST=false" >> $GITHUB_ENV
+          fi
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PAT }}
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - name: Build and push (non-latest)
+        if: env.IS_LATEST != 'true'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/386
+          build-args: |
+            TERRAFORM_VERSION=${{ matrix.tf_versions }}
+            AWS_CLI_VERSION=${{ matrix.awscli_versions }}
+          tags: |
+            ${{ env.ORGANIZATION }}/${{ env.IMAGE_NAME }}:${{ env.RELEASE_VERSION }}_tf-${{ matrix.tf_versions }}_aws-${{ matrix.awscli_versions }}
+            ${{ env.ORGANIZATION }}/${{ env.IMAGE_NAME }}:tf-${{ env.TF_MINOR }}_aws-${{ env.AWS_MINOR }}
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      - name: Build and push (latest)
+        if: env.IS_LATEST == 'true'
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/386
           build-args: |
             TERRAFORM_VERSION=${{ matrix.tf_versions }}
             AWS_CLI_VERSION=${{ matrix.awscli_versions }}
-          tags: zenika/terraform-aws-cli:release-${{ env.RELEASE_TAG }}_terraform-${{ matrix.tf_versions }}_awscli-${{ matrix.awscli_versions }}
+          tags: |
+            ${{ env.ORGANIZATION }}/${{ env.IMAGE_NAME }}:${{ env.RELEASE_VERSION }}_tf-${{ matrix.tf_versions }}_aws-${{ matrix.awscli_versions }}
+            ${{ env.ORGANIZATION }}/${{ env.IMAGE_NAME }}:tf-${{ env.TF_MINOR }}_aws-${{ env.AWS_MINOR }}
+            ${{ env.ORGANIZATION }}/${{ env.IMAGE_NAME }}:latest
+            ${{ env.ORGANIZATION }}/${{ env.IMAGE_NAME }}:${{ env.RELEASE_VERSION }}
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/semantic-release.yml

@@ -0,0 +1,32 @@
+name: semantic-release
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - Dockerfile
+      - supported_versions.json
+      - "security/**"
+      - "tests/**"
+      - .dockerignore
+      - hadolint.yaml
+      - ".github/workflows/semantic-release.yml"
+      - ".github/workflows/release.yml"
+      - CHANGELOG.md
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  release:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: cycjimmy/semantic-release-action@v4
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -1,2 +1,5 @@
 # ignore generated container structure test config
 tests/container-structure-tests.yml
+
+# Claude Code internal directory
+.claude/

.releaserc.json

@@ -0,0 +1,21 @@
+{
+  "branches": ["master"],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    [
+      "@semantic-release/changelog",
+      {
+        "changelogFile": "CHANGELOG.md"
+      }
+    ],
+    [
+      "@semantic-release/git",
+      {
+        "assets": ["CHANGELOG.md"],
+        "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+      }
+    ],
+    "@semantic-release/github"
+  ]
+}

CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+This file is auto-generated by [Semantic Release](https://semantic-release.gitbook.io/).

commitlint.config.mjs

@@ -0,0 +1,3 @@
+export default {
+  extends: ["@commitlint/config-conventional"],
+};