upstream-deploy.yaml

---
name: Reusable Deploy

# yamllint disable-line rule:truthy
on:
  workflow_call:
    inputs:
      event_name:
        description: Event name from the caller
        required: true
        type: string
      release_prerelease:
        description: Release prerelease flag from the caller
        required: false
        type: boolean
      release_tag_name:
        description: Release tag name from the caller
        required: false
        type: string
      slug:
        description: Optional slug override
        required: false
        type: string
concurrency:
  group: deploy

permissions:
  contents: read

jobs:
  information:
    if: inputs.event_name == 'release' || inputs.event_name == 'workflow_run'
    name: ℹ️ Gather app (add-on) information
    runs-on: ubuntu-latest
    outputs:
      architectures: ${{ steps.metadata.outputs.architectures }}
      description: ${{ steps.metadata.outputs.description }}
      environment: ${{ steps.release.outputs.environment }}
      name: ${{ steps.metadata.outputs.name }}
      slug: ${{ steps.metadata.outputs.slug }}
      target: ${{ steps.metadata.outputs.target }}
      version: ${{ steps.release.outputs.version }}
    steps:
      - name: ⤵️ Check out code from GitHub
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: 🐍 Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.15"

      - name: ⚡ Set up uv
        uses: astral-sh/setup-uv@v10.3.2
        with:
          version: "0.13.5"

      - name: 🧰 Install Python dependencies
        run: uv sync --frozen

      - name: ℹ️ Gather app metadata
        id: metadata
        env:
          SLUG_OVERRIDE: ${{ inputs.slug }}
        run: uv run python scripts/addon_metadata.py cloudflared/config.yaml

      - name: ℹ️ Gather version and environment
        id: release
        run: |
          sha="${{ github.sha }}"
          environment="edge"
          version="${sha:0:7}"
          if [[ "${{ inputs.event_name }}" = "release" ]]; then
            version="${{ inputs.release_tag_name }}"
            version="${version,,}"
            version="${version#v}"
            environment="stable"
            if [[ "${{ inputs.release_prerelease }}" = "true" ]]; then
              environment="beta"
            fi
          fi

          echo "environment=$environment" >> $GITHUB_OUTPUT
          echo "version=$version" >> $GITHUB_OUTPUT

  deploy:
    name: 👷 Build & Deploy ${{ matrix.architecture }}
    needs: information
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        architecture: ${{ fromJson(needs.information.outputs.architectures) }}
    steps:
      - name: ⤵️ Check out code from GitHub
        uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: 🏗 Set up QEMU
        uses: docker/setup-qemu-action@v4.4.0
      - name: 🏗 Set up Docker Buildx
        uses: docker/setup-buildx-action@v4.4.1
      - name: ℹ️ Compose build flags
        id: flags
        run: |
          echo "date=$(date +"%Y-%m-%dT%H:%M:%SZ")" >> $GITHUB_OUTPUT
          if [[ "${{ matrix.architecture }}" = "amd64" ]]; then
            echo "platform=linux/amd64" >> $GITHUB_OUTPUT
          elif [[ "${{ matrix.architecture }}" = "aarch64" ]]; then
            echo "platform=linux/arm64/v8" >> $GITHUB_OUTPUT
          else
            echo "::error ::Could not determine platform for architecture ${{ matrix.architecture }}"
            exit 1
          fi
      - name: 🔤 Normalize registry owner
        id: registry
        run: |
          owner="${GITHUB_REPOSITORY_OWNER,,}"
          echo "owner=$owner" >> "$GITHUB_OUTPUT"
      - name: 🏗  Login to GitHub Container Registry
        uses: docker/login-action@v4.6.0
        with:
          registry: ghcr.io
          username: ${{ steps.registry.outputs.owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: 🚀 Build
        uses: docker/build-push-action@v7.4.0
        with:
          load: true
          # yamllint disable rule:line-length
          tags: |
            ghcr.io/${{ steps.registry.outputs.owner }}/${{ needs.information.outputs.slug }}/${{ matrix.architecture }}:${{ needs.information.outputs.environment }}
            ghcr.io/${{ steps.registry.outputs.owner }}/${{ needs.information.outputs.slug }}/${{ matrix.architecture }}:${{ needs.information.outputs.version }}
            ghcr.io/${{ steps.registry.outputs.owner }}/cloudflared:${{ matrix.architecture }}-${{ needs.information.outputs.environment }}
            ghcr.io/${{ steps.registry.outputs.owner }}/cloudflared:${{ matrix.architecture }}-${{ needs.information.outputs.version }}
          # yamllint enable rule:line-length
          context: ${{ needs.information.outputs.target }}
          file: ${{ needs.information.outputs.target }}/Dockerfile
          cache-from: type=gha,scope=${{ needs.information.outputs.slug }}-${{ matrix.architecture }}
          cache-to: type=gha,mode=max,scope=${{ needs.information.outputs.slug }}-${{ matrix.architecture }}
          platforms: ${{ steps.flags.outputs.platform }}
          build-args: |
            BUILD_ARCH=${{ matrix.architecture }}
            BUILD_DATE=${{ steps.flags.outputs.date }}
            BUILD_DESCRIPTION=${{ needs.information.outputs.description }}
            BUILD_NAME=${{ needs.information.outputs.name }}
            BUILD_REF=${{ github.sha }}
            BUILD_REPOSITORY=${{ github.repository }}
            BUILD_VERSION=${{ needs.information.outputs.version }}
      # yamllint disable rule:line-length
      - name: 🚀 Push
        run: |
          docker push \
            "ghcr.io/${{ steps.registry.outputs.owner }}/${{ needs.information.outputs.slug }}/${{ matrix.architecture }}:${{ needs.information.outputs.environment }}"
          docker push \
            "ghcr.io/${{ steps.registry.outputs.owner }}/${{ needs.information.outputs.slug }}/${{ matrix.architecture }}:${{ needs.information.outputs.version }}"
          docker push "ghcr.io/${{ steps.registry.outputs.owner }}/cloudflared:${{ matrix.architecture }}-${{ needs.information.outputs.environment }}"
          docker push "ghcr.io/${{ steps.registry.outputs.owner }}/cloudflared:${{ matrix.architecture }}-${{ needs.information.outputs.version }}"
      # yamllint enable rule:line-length
  manifest:
    name: 📦 Publish multi-arch manifest
    needs:
      - information
      - deploy
    runs-on: ubuntu-latest
    permissions:
      contents: none
      packages: write
    steps:
      - name: 🏗 Set up Docker Buildx
        uses: docker/setup-buildx-action@v4.4.1
      - name: 🔤 Normalize registry owner
        id: registry
        run: |
          owner="${GITHUB_REPOSITORY_OWNER,,}"
          echo "owner=$owner" >> "$GITHUB_OUTPUT"
      - name: 🏗  Login to GitHub Container Registry
        uses: docker/login-action@v4.6.0
        with:
          registry: ghcr.io
          username: ${{ steps.registry.outputs.owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: 🚀 Create manifest list
        run: |
          docker buildx imagetools create \
            --tag ghcr.io/${{ steps.registry.outputs.owner }}/cloudflared:${{ needs.information.outputs.environment }} \
            ghcr.io/${{ steps.registry.outputs.owner }}/cloudflared:amd64-${{ needs.information.outputs.environment }} \
            ghcr.io/${{ steps.registry.outputs.owner }}/cloudflared:aarch64-${{ needs.information.outputs.environment }}
          docker buildx imagetools create \
            --tag ghcr.io/${{ steps.registry.outputs.owner }}/cloudflared:${{ needs.information.outputs.version }} \
            ghcr.io/${{ steps.registry.outputs.owner }}/cloudflared:amd64-${{ needs.information.outputs.version }} \
            ghcr.io/${{ steps.registry.outputs.owner }}/cloudflared:aarch64-${{ needs.information.outputs.version }}