publish-bicep-recipes.yaml

# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
---
name: Publish Bicep Recipes

# Publishes the repository's Bicep recipes to GHCR as OCI artifacts.
#
# Every publish is tagged with the commit SHA it was built from, and that SHA
# tag is what makes the recipes addressable from Radius. A released `rad`
# resolves a resource type's namespace to the commit SHA that
# deploy/manifest/defaults.yaml pins for it and uses that SHA verbatim as the
# recipe's OCI tag (radius PR #12566). Stable releases are authoritative, while
# units with no stable release can still notify Radius through the edge
# fallback. release-namespace.yaml calls this workflow with `pin_only` before
# creating a release, so the invariant this workflow has to hold is:
#
#   every stable namespace release Radius can receive already has its commit
#   SHA as a tag in `$REGISTRY` for every recipe.
#
# Main pushes also publish the SHA and refresh `edge`; there is no `paths:`
# filter so every main revision remains addressable. Release correctness does
# not depend on that push run: the namespace release workflow republishes its
# exact SHA and fails closed before creating the release. Republishing unchanged
# Bicep is cheap because identical content produces an identical digest.
#
# The floating aliases layered on top support the recipe publication lifecycle:
#   * <sha>     -> every publish. Immutable; the tag Radius pins against.
#   * edge      -> every push to `main`, and manual runs with no version.
#                  Floating; `edge` always resolves to the newest recipes on
#                  `main`, matching the CLI's edge channel.
#   * <version> -> manual dispatch with `release_version`, run alongside a
#                  Radius release. Immutable; never republished.
#   * latest    -> moves only with a stable `release_version`, so `latest`
#                  always resolves to the newest stable release.

on:
  push:
    branches:
      - main
  workflow_call:
    inputs:
      release_version:
        description: Release version to use as the image tag (e.g. 0.51.0). Leave empty to refresh the floating edge tag.
        required: false
        default: ""
        type: string
      pin_only:
        description: Publish only the immutable commit-SHA tag, leaving edge and latest where they are.
        required: false
        default: false
        type: boolean
  workflow_dispatch:
    inputs:
      release_version:
        description: Release version to use as the image tag (e.g. 0.51.0). Leave empty to refresh the floating edge tag.
        required: false
        default: ""
        type: string

permissions: {}

env:
  REGISTRY: ghcr.io/radius-project/kube-recipes

concurrency:
  # Keyed on the ref to avoid unbounded parallel publishes on busy branches.
  # `queue: max` rather than the default `queue: single`, which cancels the
  # pending run whenever a newer one queues -- that would leave some advertised
  # main commit SHA tags unpublished.
  # `cancel-in-progress` stays at its default of false; setting it true is a
  # validation error alongside `queue: max`.
  group: publish-bicep-recipes-${{ github.event_name }}-${{ github.ref }}
  queue: max

jobs:
  publish-bicep-recipes:
    name: Publish Bicep Recipes to GHCR
    # Direct dispatches and reusable callers must both originate from main;
    # otherwise a feature branch could move edge/latest or publish release pins.
    if: >-
      github.repository == 'radius-project/resource-types-contrib' &&
      github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Log in to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Radius CLI
        run: |
          wget -q "https://raw.githubusercontent.com/radius-project/radius/main/deploy/install.sh" -O - | /bin/bash

      - name: Resolve tags
        # Exported through $GITHUB_ENV so every publish step below pushes the
        # same tag set, including the commit SHA Radius pins against.
        id: tags
        env:
          COMMIT_SHA: ${{ github.sha }}
          RELEASE_VERSION: ${{ inputs.release_version }}
          PIN_ONLY: ${{ inputs.pin_only }}
        run: |
          echo "TAGS=$(./.github/scripts/resolve-recipe-tags.sh)" >>"$GITHUB_ENV"

      # Publishing every recipe from one job means checkout, login and the CLI
      # install happen once instead of once per recipe. At most 10 of these run
      # concurrently; the rest queue.
      - parallel:
          - name: Publish containers
            run: ./.github/scripts/publish-bicep-recipe.sh containers Compute/containers/recipes/kubernetes/bicep/kubernetes-containers.bicep
          - name: Publish containerimages
            run: ./.github/scripts/publish-bicep-recipe.sh containerimages Compute/containerImages/recipes/kubernetes/bicep/kubernetes-containerimages.bicep
          - name: Publish persistentvolumes
            run: ./.github/scripts/publish-bicep-recipe.sh persistentvolumes Compute/persistentVolumes/recipes/kubernetes/bicep/kubernetes-volumes.bicep
          - name: Publish routes
            run: ./.github/scripts/publish-bicep-recipe.sh routes Compute/routes/recipes/kubernetes/bicep/kubernetes-routes.bicep
          - name: Publish secrets
            run: ./.github/scripts/publish-bicep-recipe.sh secrets Security/secrets/recipes/kubernetes/bicep/kubernetes-secrets.bicep
          - name: Publish mysqldatabases
            run: ./.github/scripts/publish-bicep-recipe.sh mysqldatabases Data/mySqlDatabases/recipes/kubernetes/bicep/kubernetes-mysql.bicep
          - name: Publish postgresqldatabases
            run: ./.github/scripts/publish-bicep-recipe.sh postgresqldatabases Data/postgreSqlDatabases/recipes/kubernetes/bicep/kubernetes-postgresql.bicep
          - name: Publish rediscaches
            run: ./.github/scripts/publish-bicep-recipe.sh rediscaches Data/redisCaches/recipes/kubernetes/bicep/kubernetes-redis.bicep
          - name: Publish rabbitmq
            run: ./.github/scripts/publish-bicep-recipe.sh rabbitmq Messaging/rabbitMQ/recipes/kubernetes/bicep/kubernetes-rabbitmq.bicep
          # Azure ACI recipes wired by the azure-aci recipe pack. These are not
          # Kubernetes recipes, so they publish to their own GHCR namespace.
          - name: Publish azure-aci containers
            run: REGISTRY=ghcr.io/radius-project/azure-aci-recipes ./.github/scripts/publish-bicep-recipe.sh containers Compute/containers/recipes/azure/bicep/azure-aci-containers.bicep
          - name: Publish azure-aci persistentvolumes
            run: REGISTRY=ghcr.io/radius-project/azure-aci-recipes ./.github/scripts/publish-bicep-recipe.sh persistentvolumes Compute/persistentVolumes/recipes/azure/bicep/azure-file-volumes.bicep
          - name: Publish azure-aci secrets
            run: REGISTRY=ghcr.io/radius-project/azure-aci-recipes ./.github/scripts/publish-bicep-recipe.sh secrets Security/secrets/recipes/azure/bicep/azure-keyvault-secrets.bicep

      - name: Summarize
        run: |
          {
            echo "Published the Bicep recipes to GHCR with tags \`$TAGS\`."
            echo ""
            echo "Radius pins these recipes by commit SHA, so \`$GITHUB_SHA\` is now a resolvable tag for every recipe above."
          } >>"$GITHUB_STEP_SUMMARY"