immich-sync/.gitea/workflows/container.yml

name: Publish image, chart, and GitOps promotion

on:
  push:

env:
  IMAGE: registry.brunner.ninja/feedc0de/immich-sync
  GITOPS_REPOSITORY: feedc0de/homelab-gitops

jobs:
  publish:
    name: Test and publish immutable artifacts
    runs-on: ubuntu-latest
    steps:
      - name: Check out source and tags
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          version: v4.2.2

      - name: Resolve and validate chart version
        id: version
        run: |
          version=$(./scripts/chart-version.sh)
          echo "version=${version}" >> "${GITEA_OUTPUT}"
          helm lint chart
          helm template immich-sync chart --set-string image.tag="${GITEA_SHA}" >/dev/null

      - name: Log in to Quay
        if: gitea.ref == 'refs/heads/main' || startsWith(gitea.ref, 'refs/tags/v')
        uses: docker/login-action@v3
        with:
          registry: registry.brunner.ninja
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_TOKEN }}

      - name: Build and push image
        if: gitea.ref == 'refs/heads/main' || startsWith(gitea.ref, 'refs/tags/v')
        run: |
          docker build --load \
            --label "org.opencontainers.image.revision=${GITEA_SHA}" \
            --label "org.opencontainers.image.source=https://code.brunner.ninja/feedc0de/immich-sync" \
            --tag "${IMAGE}:${GITEA_SHA}" .
          docker push "${IMAGE}:${GITEA_SHA}"
          if [ "${GITEA_REF}" = refs/heads/main ]; then
            docker tag "${IMAGE}:${GITEA_SHA}" "${IMAGE}:latest"
            docker push "${IMAGE}:latest"
          fi

      - name: Package and publish Helm chart
        if: gitea.ref == 'refs/heads/main' || startsWith(gitea.ref, 'refs/tags/v')
        env:
          CHART_VERSION: ${{ steps.version.outputs.version }}
        run: |
          mkdir -p dist
          helm package chart --destination dist \
            --version "${CHART_VERSION}" --app-version "${GITEA_SHA}"
          curl --fail-with-body --user "${{ secrets.PACKAGE_USERNAME }}:${{ secrets.PACKAGE_TOKEN }}" \
            --request POST \
            --upload-file "dist/immich-sync-${CHART_VERSION}.tgz" \
            https://code.brunner.ninja/api/packages/feedc0de/helm/api/charts

      - name: Check that this is still current main
        if: gitea.ref == 'refs/heads/main'
        run: |
          git fetch --no-tags origin main
          test "$(git rev-parse FETCH_HEAD)" = "${GITEA_SHA}"

      - name: Check out GitOps repository
        if: gitea.ref == 'refs/heads/main'
        uses: actions/checkout@v4
        with:
          repository: ${{ env.GITOPS_REPOSITORY }}
          ref: main
          token: ${{ secrets.GITOPS_TOKEN }}
          path: homelab-gitops

      - name: Promote exact chart version
        if: gitea.ref == 'refs/heads/main'
        working-directory: homelab-gitops
        env:
          CHART_VERSION: ${{ steps.version.outputs.version }}
        run: |
          ./scripts/update-chart-version.sh immich-sync "${CHART_VERSION}"
          git config user.name "feedc0de"
          git config user.email "feedc0de@users.noreply.code.brunner.ninja"
          git add bootstrap/immich-sync.yaml
          if git diff --cached --quiet; then exit 0; fi
          git commit -m "Deploy immich-sync chart ${CHART_VERSION}"
          for attempt in 1 2 3; do
            if git push origin HEAD:main; then
              exit 0
            fi
            if [ "${attempt}" = 3 ]; then
              echo "GitOps promotion failed after three attempts" >&2
              exit 1
            fi
            git fetch origin main
            git rebase origin/main
          done