npm-release.yml

name: Release npm package and container image

on:
  push:
    branches:
      - master
      - release/*
    tags:
    - 'v*'
  workflow_dispatch:

env:
  REGISTRY: ghcr.io

jobs:
  pkg:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
    - uses: actions/checkout@v4
    - name: Use Node.js
      uses: actions/setup-node@v4
      with:
        node-version: 21.x
        registry-url: https://registry.npmjs.org/
    - name: Trim CI agent
      run: |
        chmod +x contrib/free_disk_space.sh
        ./contrib/free_disk_space.sh
    - name: Release npm package
      if: startsWith(github.ref, 'refs/tags/')
      run: |
        npm config set //npm.pkg.github.com/:_authToken=$GITHUB_TOKEN
        npm config set //registry.npmjs.org/:_authToken=$NODE_AUTH_TOKEN
        echo "cyclonedx:registry=https://npm.pkg.github.com" > ~/.npmrc
        npm publish --access=public --@cyclonedx:registry='https://npm.pkg.github.com'
        echo "cyclonedx:registry=https://registry.npmjs.org" > ~/.npmrc
        npm publish --provenance --access=public --@cyclonedx:registry='https://registry.npmjs.org'
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
    - name: jsr publish
      if: startsWith(github.ref, 'refs/tags/')
      run: |
        npm install
        npx jsr publish --allow-dirty
      continue-on-error: true
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  containers:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
    - uses: actions/checkout@v4
    - name: Use Node.js
      uses: actions/setup-node@v4
      with:
        node-version: 21.x
        registry-url: https://registry.npmjs.org/
    - name: Trim CI agent
      run: |
        chmod +x contrib/free_disk_space.sh
        ./contrib/free_disk_space.sh
    - name: Setup nydus
      run: |
        curl -LO https://github.com/dragonflyoss/nydus/releases/download/v2.2.4/nydus-static-v2.2.4-linux-amd64.tgz
        tar -xvf nydus-static-v2.2.4-linux-amd64.tgz
        chmod +x nydus-static/*
        mv nydus-static/* /usr/local/bin/
        rm -rf nydus-static-v2.2.4-linux-amd64.tgz nydus-static
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    - name: Log in to the Container registry
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Extract metadata (tags, labels) for Docker
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: |
          ghcr.io/cyclonedx/cdxgen
    - name: Build and push Docker images
      uses: docker/build-push-action@v5
      with:
        context: .
        file: ci/Dockerfile
        platforms: linux/amd64,linux/arm64
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha,scope=cdxgen
        cache-to: type=gha,mode=max,scope=cdxgen
    - name: nydusify
      run: |
        nydusify convert --oci --oci-ref --source ${{ steps.meta.outputs.tags }} --target ${{ steps.meta.outputs.tags }}-nydus --prefetch-dir /opt/cdxgen
        nydusify check --target ${{ steps.meta.outputs.tags }}-nydus
      if: github.ref == 'refs/heads/master'
      continue-on-error: true
    - name: Attach cdx sbom
      run: |
        npm install
        node bin/cdxgen.js -t docker -o bom.json ghcr.io/cyclonedx/cdxgen:latest
        oras attach --artifact-type sbom/cyclonedx ghcr.io/cyclonedx/cdxgen:latest ./bom.json:application/json
        oras discover -o tree ghcr.io/cyclonedx/cdxgen:latest
      continue-on-error: true
      if: startsWith(github.ref, 'refs/tags/')
    - name: Extract metadata (tags, labels) for Docker
      id: meta2
      uses: docker/metadata-action@v5
      with:
        images: |
          ghcr.io/cyclonedx/cdxgen-deno
    - name: Build and push Docker images
      uses: docker/build-push-action@v5
      with:
        context: .
        file: ci/Dockerfile-deno
        platforms: linux/amd64
        push: true
        tags: ${{ steps.meta2.outputs.tags }}
        labels: ${{ steps.meta2.outputs.labels }}
        cache-from: type=gha,scope=cdxgen-deno
        cache-to: type=gha,mode=max,scope=cdxgen-deno
    - name: Extract metadata (tags, labels) for Docker
      id: meta3
      uses: docker/metadata-action@v5
      with:
        images: |
          ghcr.io/cyclonedx/cdxgen-ppc64
    - name: Build and push Docker images
      uses: docker/build-push-action@v5
      with:
        context: .
        file: ci/Dockerfile-ppc64
        platforms: linux/ppc64le
        push: true
        tags: ${{ steps.meta3.outputs.tags }}
        labels: ${{ steps.meta3.outputs.labels }}
        cache-from: type=gha,scope=cdxgen-ppc64
        cache-to: type=gha,mode=max,scope=cdxgen-ppc64
    - name: Extract metadata (tags, labels) for Docker
      id: meta4
      uses: docker/metadata-action@v5
      with:
        images: |
          ghcr.io/cyclonedx/cdxgen-next
      if: github.ref == 'refs/heads/master'
    - name: Extract metadata (tags, labels) for Docker
      id: meta5
      uses: docker/metadata-action@v5
      with:
        images: |
          ghcr.io/cyclonedx/cdxgen-bun
    - name: Build and push Docker images
      uses: docker/build-push-action@v5
      with:
        context: .
        file: ci/Dockerfile-bun
        platforms: linux/amd64,linux/arm64
        push: true
        tags: ${{ steps.meta5.outputs.tags }}
        labels: ${{ steps.meta5.outputs.labels }}
        cache-from: type=gha,scope=cdxgen-bun
        cache-to: type=gha,mode=max,scope=cdxgen-bun