From 8535c4fb51830c056ccf17caf907be7f49f2db02 Mon Sep 17 00:00:00 2001
From: Ben Num <benjamin.num@airwalkconsulting.com>
Date: Fri, 12 Sep 2025 09:28:41 +0100
Subject: [PATCH] feat: add release workflow

---
 .github/workflows/docker-build.yaml | 116 ++++++++++++++++++++++++++++
 release.config.cjs                  |  28 +++++++
 2 files changed, 144 insertions(+)
 create mode 100644 .github/workflows/docker-build.yaml
 create mode 100644 release.config.cjs

diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
new file mode 100644
index 000000000..5ed31f486
--- /dev/null
+++ b/.github/workflows/docker-build.yaml
@@ -0,0 +1,116 @@
+name: Build and Publish Docker Image to ECR
+
+on:
+  push:
+    branches: [main, beta]
+
+  workflow_dispatch:
+    inputs:
+      logLevel:
+        description: 'Log level'
+        required: true
+        default: 'warning'
+      tags:
+        description: 'Enter a reason for running this deploy'
+        required: true
+
+env:
+  AWS_REGION: eu-west-2
+
+jobs:
+  build-and-push:
+    if: always() && (github.ref == 'refs/heads/main' || github.event_name == 'pull_request')
+    runs-on: codebuild-ctx-cortex-systems-prod-m365-mcp-${{ github.run_id }}-${{ github.run_attempt }}
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
+
+    steps:
+      - name: Print Inputs
+        run: |
+          echo "Log level: ${{ github.event.inputs.logLevel }}"
+          echo "Tags: ${{ github.event.inputs.tags }}"
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+        with:
+          registries: '490004636127'
+
+      - name: Login to Amazon ECR (Preprod)
+        id: login-ecr-preprod
+        uses: aws-actions/amazon-ecr-login@v2
+        with:
+          registries: '557690582324'
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+
+      # - name: Install dependencies
+      #   run: npm clean-install
+
+      - name: Install semantic-release extra plugins
+        run: npm i -g pnpm && pnpm install -D semantic-release @semantic-release/changelog @semantic-release-plus/docker
+
+      - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies
+        run: pnpm audit signatures
+        continue-on-error: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver-opts: image=public.ecr.aws/vend/moby/buildkit:buildx-stable-1
+          version: latest
+
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ steps.login-ecr.outputs.registry }}/ctx-cortex-systems-prod-m365-mcp
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            # Latest tag for default branch (main)
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          load: true
+          # push: ${{ github.event_name != 'pull_request' }} # Only pushes container image when pushing to main or creating a tag
+          tags: ${{ steps.meta.outputs.tags }}, 490004636127.dkr.ecr.eu-west-2.amazonaws.com/ctx-cortex-systems-prod-m365-mcp:latest, ctx-cortex-systems-prod-m365-mcp:latest
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Push to Second ECR Registry
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr-preprod.outputs.registry }}
+          ECR_REPOSITORY: ctxpp-cortex-systems-preprod-m365-mcp
+          IMAGE_TAG: latest
+        run: |
+          docker tag ctx-cortex-systems-prod-m365-mcp:latest $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
+
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npx semantic-release
diff --git a/release.config.cjs b/release.config.cjs
new file mode 100644
index 000000000..963c9c9ff
--- /dev/null
+++ b/release.config.cjs
@@ -0,0 +1,28 @@
+// release.config.js
+module.exports = {
+  branches: [
+    'main',
+    {
+      name: 'beta',
+      prerelease: true,
+    },
+  ],
+  plugins: [
+    '@semantic-release/commit-analyzer',
+    '@semantic-release/release-notes-generator',
+    [
+      '@semantic-release/changelog',
+      {
+        changelogFile: 'CHANGELOG.md',
+      },
+    ],
+    [
+      '@semantic-release-plus/docker',
+      {
+        name: '490004636127.dkr.ecr.eu-west-2.amazonaws.com/ctx-cortex-systems-prod-m365-mcp:latest',
+        skipLogin: true,
+      },
+    ],
+    '@semantic-release/github',
+  ],
+}