daily-refresh.yml

name: daily-refresh

# Rebuilds and republishes the images when a new upstream Cassandra release or
# a new axon-agent package appears.
#
# Runs check-updates.sh, which compares the upstream Cassandra version (from the
# docker-library Dockerfile) and the upstream axon-agent version (from the
# AxonOps apt index) against the versions baked into the currently published
# "<minor>" manifests. If anything drifted, the next repo tag is computed by
# bumping the patch component of the newest existing "v*" tag, build-images.yml
# is called with it, and the tag is created on the built commit afterwards.
#
# All versions are rebuilt whenever any of them is stale so that a single repo
# tag consistently describes every published manifest.
#
# Note: the tag is pushed with GITHUB_TOKEN, and GitHub deliberately does not
# start new workflow runs from GITHUB_TOKEN pushes — so this does not re-trigger
# the "v*" tag build.
on:
  schedule:
    # 03:00 UTC daily.
    - cron: "0 3 * * *"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: daily-refresh
  cancel-in-progress: false

env:
  IMGBASE: ghcr.io/axonops/axonops-cassandra

jobs:
  check:
    name: Check for upstream updates
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    outputs:
      stale: ${{ steps.check.outputs.stale }}
      next_tag: ${{ steps.next_tag.outputs.next_tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # Full history so every existing "v*" tag is available.
          fetch-depth: 0

      - name: Log in to GitHub Container Registry
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" \
            | docker login ghcr.io -u "${{ github.actor }}" --password-stdin

      - name: Compare upstream and published versions
        id: check
        run: |
          ./check-updates.sh | tee versions.txt
          stale_versions=$(sed -n 's/^STALE_VERSIONS=//p' versions.txt)
          if [ -n "$stale_versions" ]; then
            echo "stale=true" >> "$GITHUB_OUTPUT"
          else
            echo "stale=false" >> "$GITHUB_OUTPUT"
          fi
          {
            echo "### Upstream version check"
            echo ""
            echo '```'
            cat versions.txt
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Compute next repo tag
        id: next_tag
        if: steps.check.outputs.stale == 'true'
        run: |
          # Newest existing vX.Y.Z tag, defaulting to v0.0.0 when none exist.
          latest=$(git tag --list 'v[0-9]*.[0-9]*.[0-9]*' | sort -V | tail -1)
          latest=${latest:-v0.0.0}
          version=${latest#v}
          major=$(echo "$version" | cut -d. -f1)
          minor=$(echo "$version" | cut -d. -f2)
          patch=$(echo "$version" | cut -d. -f3)
          next="${major}.${minor}.$((patch + 1))"
          echo "Latest tag $latest, next repo tag v$next"
          echo "next_tag=$next" >> "$GITHUB_OUTPUT"

  rebuild:
    name: Rebuild images
    needs: check
    if: needs.check.outputs.stale == 'true'
    uses: ./.github/workflows/build-images.yml
    permissions:
      contents: read
      packages: write
    with:
      repo_tag: ${{ needs.check.outputs.next_tag }}

  tag:
    name: Tag the release
    needs: [check, rebuild]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Create and push tag
        env:
          NEXT_TAG: ${{ needs.check.outputs.next_tag }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -a "v${NEXT_TAG}" -m "Automated image refresh v${NEXT_TAG}"
          git push origin "v${NEXT_TAG}"