release.yml

name: Release

# 仅当推送符合语义化版本的 tag（如 v1.2.3）时触发，
# 自动创建 GitHub Release 并将对应版本的 Docker 镜像推送到 GHCR。
on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  packages: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  release:
    runs-on: ubuntu-latest

    services:
      # 质量门禁：单元测试需要数据库
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ROOT_PASSWORD: root
          MYSQL_DATABASE: vnerp_test
          MYSQL_USER: test
          MYSQL_PASSWORD: test123
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping -h 127.0.0.1 -uroot -proot --silent"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=10
      redis:
        image: redis:7
        ports:
          - 6379:6379
        options: >-
          --health-cmd="redis-cli ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=10

    env:
      DB_HOST: 127.0.0.1
      DB_PORT: 3306
      DB_USER: test
      DB_PASSWORD: test123
      DB_NAME: vnerp_test
      REDIS_URL: redis://127.0.0.1:6379
      JWT_SECRET: test-jwt-secret
      NODE_ENV: test

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # ============================================================
      # 质量门禁：只有通过 lint / 类型检查 / 单元测试的代码才允许发布
      # 确保只有 CI 通过的代码才能发布
      # ============================================================
      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run linter
        run: pnpm lint

      - name: Run lint gate
        run: pnpm lint:gate

      - name: Run TypeScript check
        run: pnpm ts-check

      - name: Run unit tests
        run: pnpm test:unit:run

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: Release ${{ github.ref_name }}
          generate_release_notes: true
          prerelease: ${{ contains(github.ref_name, '-') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}