release-push-image.yaml

##
# Copyright (C) 2024-2025 Hedera Hashgraph, LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
##
name: Release Workflow

on:
  push:
    # `v*` tags are used for production environment
    tags: [ v* ]
    # `main` tag is used for integration environment
    branches: [ main ]
  # Manual trigger with custom release tag
  workflow_dispatch:
    inputs:
      version:
        description: 'Release tag:'
        type: string
        required: false

defaults:
  run:
    shell: bash

permissions:
  id-token: write
  contents: read
  packages: write

env:
  OWNER: hashgraph
  PACKAGE_NAME: hedera-block-node
  REGISTRY: ghcr.io

jobs:
  check-gradle:
    name: Gradle
    uses: ./.github/workflows/zxc-verify-gradle-build-determinism.yaml
    with:
      ref: ${{ github.event.inputs.ref || '' }}
      java-distribution: ${{ inputs.java-distribution || 'temurin' }}
      java-version: ${{ inputs.java-version || '21.0.4' }}

  check-docker:
    name: Docker
    uses: ./.github/workflows/zxc-verify-docker-build-determinism.yaml
    with:
      ref: ${{ github.event.inputs.ref || '' }}
      java-distribution: ${{ inputs.java-distribution || 'temurin' }}
      java-version: ${{ inputs.java-version || '21.0.4' }}

  publish:
    runs-on: block-node-linux-medium

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Install JDK
        uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
        with:
          distribution: "temurin"
          java-version: "21.0.4"

      - name: Build
        run: ./gradlew clean build

      - name: Login to GitHub Container Registry
        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Qemu
        uses: docker/setup-qemu-action@5927c834f5b4fdf503fca6f4c7eccda82949e1ee # v3.1.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.4.0
        with:
          driver-opts: network=host

      - name: Extract version
        id: extract_version
        run: |
          VERSION=$(grep 'version=' gradle.properties | cut -d '=' -f2)
          echo "VERSION=${VERSION}" >> $GITHUB_ENV

      - name: Extract Source Date Epoch
        id: extract_source_date_epoch
        run: |
          SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)
          echo "SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}" >> $GITHUB_ENV

      - name: Build and push image
        uses: docker/build-push-action@1ca370b3a9802c92e886402e0dd88098a2533b12 # v6.4.1
        with:
          context: ./server/docker
          file: ./server/docker/Dockerfile
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64, linux/arm64
          push: true
          tags: ${{ env.REGISTRY }}/${{ github.repository }}:${{ env.VERSION }}
          build-args: |
            VERSION=${{ env.VERSION }}
            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
          build-contexts: |
            distributions=./server/build/distributions

  helm-chart-release:
    needs: publish
    runs-on: block-node-linux-medium

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Install Helm
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract version
        id: extract_version
        run: |
          VERSION=$(grep 'version=' gradle.properties | cut -d '=' -f2)
          echo "VERSION=${VERSION}" >> $GITHUB_ENV

      - name: Package helm chart
        run: |
          helm dependency update charts/hedera-block-node
          helm package charts/hedera-block-node

      - name: Push helm chart
        run: |
          helm push block-node-helm-chart-${{ env.VERSION }}.tgz oci://ghcr.io/hashgraph/hedera-block-node