Comparing release strategies with GitHub Actions

Copycopy code to clipboard
PR merged to main   →  v1.4.0-rc.1   (pre-release tag, image + chart pushed, not "released")
PR merged to main   →  v1.4.1-rc.1
PR merged to main   →  v1.5.0-rc.1
manual release      →  v1.5.0        (GA tag, GitHub Release, chart published for umbrella)

Copycopy code to clipboard
# helm/myapp/values.yaml
image:
  repository: ghcr.io/<org>/<repo>
  tag: ""          # empty → falls back to .Chart.AppVersion
  pullPolicy: IfNotPresent

Copycopy code to clipboard
# helm/myapp/templates/deployment.yaml (excerpt)
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"

Copycopy code to clipboard
actions/checkout@v7
actions/setup-python@v6
actions/create-github-app-token@v3
docker/login-action@v4
docker/metadata-action@v6
docker/setup-buildx-action@v3
docker/build-push-action@v7
azure/setup-helm@v5
googleapis/release-please-action@v5
python-semantic-release/python-semantic-release@v10.6.1
helm/chart-releaser-action@v1.7.0
amannn/action-semantic-pull-request@v6

Copycopy code to clipboard
name: PR title lint

on:
  pull_request_target:
    types: [opened, edited, reopened, synchronize]

permissions:
  pull-requests: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: amannn/action-semantic-pull-request@v6
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          types: |
            feat
            fix
            perf
            refactor
            docs
            test
            build
            ci
            chore
            revert
          scopes: |
            app
            api
            helm
            docker
            deps
          requireScope: false
          subjectPattern: ^(?![A-Z]).+$
          subjectPatternError: |
            The subject "{subject}" must start with a lowercase character.

Copycopy code to clipboard
#!/usr/bin/env bash
# Computes the next version from git history.
# Outputs KEY=VALUE lines suitable for $GITHUB_OUTPUT.
#
# Usage: next-version.sh [--mode auto|major|minor|patch] [--channel rc|ga]
set -euo pipefail

MODE="auto"
CHANNEL="rc"
while [[ $# -gt 0 ]]; do
  case "$1" in
    --mode)    MODE="$2"; shift 2 ;;
    --channel) CHANNEL="$2"; shift 2 ;;
    *) echo "unknown arg: $1" >&2; exit 2 ;;
  esac
done

# Latest GA tag (pre-releases excluded by the match pattern + sort).
LAST_GA=$(git tag --list 'v[0-9]*.[0-9]*.[0-9]*' \
          | grep -Ev '\-' \
          | sort -V | tail -n1 || true)
LAST_GA="${LAST_GA:-v0.0.0}"
BASE="${LAST_GA#v}"
IFS='.' read -r MAJOR MINOR PATCH <<< "$BASE"

# Commits since the last GA tag.
if git rev-parse "$LAST_GA" >/dev/null 2>&1; then
  RANGE="${LAST_GA}..HEAD"
else
  RANGE="HEAD"
fi
SUBJECTS=$(git log --format='%s' "$RANGE")
BODIES=$(git log --format='%b' "$RANGE")

HAS_BREAKING=false
HAS_FEAT=false
HAS_FIX=false
grep -qE '^[a-z]+(\([^)]*\))?!:' <<<"$SUBJECTS" && HAS_BREAKING=true
grep -qE '^BREAKING[ -]CHANGE:' <<<"$BODIES"    && HAS_BREAKING=true
grep -qE '^feat(\([^)]*\))?!?:' <<<"$SUBJECTS"   && HAS_FEAT=true
grep -qE '^(fix|perf|refactor|revert)(\([^)]*\))?!?:' <<<"$SUBJECTS" && HAS_FIX=true

case "$MODE" in
  major) BUMP=major ;;
  minor) BUMP=minor ;;
  patch) BUMP=patch ;;
  auto)
    if $HAS_BREAKING; then
      # Policy: majors are cut manually. Flag loudly, bump minor.
      echo "::warning::Breaking change detected since ${LAST_GA}. Auto path will bump MINOR; cut the major via release-manual.yml."
      BUMP=minor
    elif $HAS_FEAT; then BUMP=minor
    elif $HAS_FIX;  then BUMP=patch
    else                 BUMP=patch
    fi ;;
esac

case "$BUMP" in
  major) MAJOR=$((MAJOR+1)); MINOR=0; PATCH=0 ;;
  minor) MINOR=$((MINOR+1)); PATCH=0 ;;
  patch) PATCH=$((PATCH+1)) ;;
esac
TARGET="${MAJOR}.${MINOR}.${PATCH}"

if [[ "$CHANNEL" == "rc" ]]; then
  # Next rc number for this target version.
  N=$(git tag --list "v${TARGET}-rc.*" | sed -E 's/.*-rc\.([0-9]+)$/\1/' | sort -n | tail -n1)
  N=$(( ${N:-0} + 1 ))
  VERSION="${TARGET}-rc.${N}"
else
  VERSION="${TARGET}"
fi

{
  echo "last-ga=${LAST_GA}"
  echo "bump=${BUMP}"
  echo "version=${VERSION}"
  echo "tag=v${VERSION}"
  echo "target=${TARGET}"
  echo "breaking=${HAS_BREAKING}"
} | tee -a "${GITHUB_OUTPUT:-/dev/stdout}"

Copycopy code to clipboard
chmod +x scripts/next-version.sh
git fetch --tags
./scripts/next-version.sh --mode auto --channel rc
./scripts/next-version.sh --mode minor --channel ga

Copycopy code to clipboard
#!/usr/bin/env bash
# Writes the resolved version into pyproject.toml and Chart.yaml.
# Usage: set-versions.sh <app-version> [chart-version]
set -euo pipefail

APP_VERSION="$1"
CHART_VERSION="${2:-$1}"
CHART_FILE="helm/myapp/Chart.yaml"

python - "$APP_VERSION" <<'PY'
import re, sys, pathlib
v = sys.argv[1]
p = pathlib.Path("pyproject.toml")
s = p.read_text()
s = re.sub(r'(?m)^version\s*=\s*".*"$', f'version = "{v}"', s, count=1)
p.write_text(s)
PY

# Chart.yaml: `version` must be SemVer; `appVersion` is a free-form string.
sed -i -E "s|^version:.*|version: ${CHART_VERSION}|"        "$CHART_FILE"
sed -i -E "s|^appVersion:.*|appVersion: \"${APP_VERSION}\"|" "$CHART_FILE"

echo "--- pyproject.toml ---"; grep -m1 '^version' pyproject.toml
echo "--- ${CHART_FILE} ---";  grep -E '^(version|appVersion):' "$CHART_FILE"

Copycopy code to clipboard
name: "Release A — auto tag on main"

on:
  push:
    branches: [main]
    paths-ignore:
      - '**.md'
      - 'docs/**'
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Compute the version but do not tag or push artefacts"
        type: boolean
        default: true

concurrency:
  group: release-main
  cancel-in-progress: false      # never cancel a release mid-flight

permissions:
  contents: read

jobs:
  version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.calc.outputs.version }}
      tag:     ${{ steps.calc.outputs.tag }}
      bump:    ${{ steps.calc.outputs.bump }}
      dry_run: ${{ steps.flags.outputs.dry_run }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0          # required: full history + tags
          fetch-tags: true

      - id: flags
        run: echo "dry_run=${{ inputs.dry_run == true }}" >> "$GITHUB_OUTPUT"

      - id: calc
        run: ./scripts/next-version.sh --mode auto --channel rc

      - name: Summary
        run: |
          {
            echo "### Candidate \`${{ steps.calc.outputs.tag }}\`"
            echo ""
            echo "| field | value |"
            echo "|---|---|"
            echo "| previous GA | ${{ steps.calc.outputs.last-ga }} |"
            echo "| bump | ${{ steps.calc.outputs.bump }} |"
            echo "| breaking detected | ${{ steps.calc.outputs.breaking }} |"
            echo "| dry run | ${{ steps.flags.outputs.dry_run }} |"
          } >> "$GITHUB_STEP_SUMMARY"

  tag:
    needs: version
    if: needs.version.outputs.dry_run != 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write             # push tags, create releases
    steps:
      - uses: actions/checkout@v7
        with: { fetch-depth: 0 }

      - name: Create annotated tag
        env:
          TAG: ${{ needs.version.outputs.tag }}
        run: |
          git config user.name  "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -a "$TAG" -m "Release candidate $TAG"
          git push origin "$TAG"

      - name: Create GitHub pre-release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ needs.version.outputs.tag }}
        run: |
          gh release create "$TAG" \
            --title "$TAG" \
            --prerelease \
            --generate-notes

  image:
    needs: [version, tag]
    if: always() && needs.version.result == 'success'
    uses: ./.github/workflows/_build-image.yml
    with:
      version: ${{ needs.version.outputs.version }}
      push:    ${{ needs.version.outputs.dry_run != 'true' }}
      latest:  false
    permissions:
      contents: read
      packages: write
      id-token: write

  chart:
    needs: [version, image]
    uses: ./.github/workflows/_package-chart.yml
    with:
      chart_version: ${{ needs.version.outputs.version }}
      app_version:   ${{ needs.version.outputs.version }}
      push:          ${{ needs.version.outputs.dry_run != 'true' }}
    permissions:
      contents: read
      packages: write

Copycopy code to clipboard
{
  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
  "release-type": "python",
  "include-component-in-tag": false,
  "include-v-in-tag": true,
  "bump-minor-pre-major": false,
  "separate-pull-requests": false,
  "changelog-sections": [
    { "type": "feat",     "section": "Features" },
    { "type": "fix",      "section": "Bug Fixes" },
    { "type": "perf",     "section": "Performance" },
    { "type": "refactor", "section": "Refactoring" },
    { "type": "deps",     "section": "Dependencies" },
    { "type": "docs",     "section": "Documentation", "hidden": true },
    { "type": "chore",    "section": "Chores",        "hidden": true }
  ],
  "packages": {
    ".": {
      "package-name": "myapp",
      "extra-files": [
        {
          "type": "yaml",
          "path": "helm/myapp/Chart.yaml",
          "jsonpath": "$.version"
        },
        {
          "type": "yaml",
          "path": "helm/myapp/Chart.yaml",
          "jsonpath": "$.appVersion"
        }
      ]
    }
  }
}

Copycopy code to clipboard
{ ".": "0.1.0" }

Copycopy code to clipboard
name: "Release B — release-please"

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: release-please
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  release-please:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      released:      ${{ steps.rp.outputs.release_created }}
      tag:           ${{ steps.rp.outputs.tag_name }}
      version:       ${{ steps.rp.outputs.version }}
      major:         ${{ steps.rp.outputs.major }}
      minor:         ${{ steps.rp.outputs.minor }}
    steps:
      # A GitHub App token (not GITHUB_TOKEN) so the tag push and the release PR
      # can trigger downstream workflows. See Repository settings and tokens.
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id:      ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - uses: googleapis/release-please-action@v5
        id: rp
        with:
          token:         ${{ steps.app-token.outputs.token }}
          config-file:   .github/release-please-config.json
          manifest-file: .github/.release-please-manifest.json

  image:
    needs: release-please
    if: needs.release-please.outputs.released == 'true'
    uses: ./.github/workflows/_build-image.yml
    with:
      version: ${{ needs.release-please.outputs.version }}
      push:    true
      latest:  true
    permissions:
      contents: read
      packages: write
      id-token: write

  chart:
    needs: [release-please, image]
    if: needs.release-please.outputs.released == 'true'
    uses: ./.github/workflows/_package-chart.yml
    with:
      chart_version: ${{ needs.release-please.outputs.version }}
      app_version:   ${{ needs.release-please.outputs.version }}
      push:          true
    permissions:
      contents: read
      packages: write

Copycopy code to clipboard
git commit --allow-empty -m "chore: release 2.0.0" -m "Release-As: 2.0.0"

Copycopy code to clipboard
name: "Release C — label driven"

on:
  pull_request:
    types: [closed]
    branches: [main]

concurrency:
  group: release-main
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  gate:
    if: github.event.pull_request.merged == true
    runs-on: ubuntu-latest
    outputs:
      bump: ${{ steps.pick.outputs.bump }}
    steps:
      - id: pick
        env:
          LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
        run: |
          set -euo pipefail
          bump=""
          for want in major minor patch none; do
            if jq -e --arg l "release:$want" 'index($l)' <<<"$LABELS" >/dev/null; then
              bump="$want"; break
            fi
          done
          if [[ -z "$bump" ]]; then
            echo "::error::PR #${{ github.event.pull_request.number }} has no release:* label. Add release:major|minor|patch|none and re-run."
            exit 1
          fi
          echo "bump=$bump" >> "$GITHUB_OUTPUT"

  version:
    needs: gate
    if: needs.gate.outputs.bump != 'none'
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.calc.outputs.version }}
      tag:     ${{ steps.calc.outputs.tag }}
    steps:
      - uses: actions/checkout@v7
        with: { fetch-depth: 0, fetch-tags: true, ref: main }
      - id: calc
        run: ./scripts/next-version.sh --mode "${{ needs.gate.outputs.bump }}" --channel rc

  # …tag / image / chart jobs identical to Approach A…

Copycopy code to clipboard
# add to ci.yml
  require-release-label:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - env:
          LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
        run: |
          jq -e 'map(startswith("release:")) | any' <<<"$LABELS" \
            || { echo "::error::Add one of release:major, release:minor, release:patch, release:none"; exit 1; }

Copycopy code to clipboard
release:
    runs-on: ubuntu-latest
    concurrency: release
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v7
        with: { fetch-depth: 0 }
      - id: release
        uses: python-semantic-release/python-semantic-release@v10.6.1
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
      - uses: pypa/gh-action-pypi-publish@release/v1
        if: steps.release.outputs.released == 'true'

Copycopy code to clipboard
[tool.semantic_release]
version_toml = ["pyproject.toml:project.version"]
version_variables = ["helm/myapp/Chart.yaml:version", "helm/myapp/Chart.yaml:appVersion"]
branch = "main"
upload_to_pypi = false
build_command = "pip install build && python -m build"

Copycopy code to clipboard
name: reusable — build image

on:
  workflow_call:
    inputs:
      version:   { required: true,  type: string }
      push:      { required: false, type: boolean, default: false }
      latest:    { required: false, type: boolean, default: false }
      platforms: { required: false, type: string,  default: "linux/amd64,linux/arm64" }
      context:   { required: false, type: string,  default: "." }
      dockerfile:{ required: false, type: string,  default: "Dockerfile" }
    outputs:
      image:  { value: ${{ jobs.build.outputs.image }} }
      digest: { value: ${{ jobs.build.outputs.digest }} }

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    outputs:
      image:  ${{ steps.meta.outputs.tags }}
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v7

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v4
        if: inputs.push
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=raw,value=${{ inputs.version }}
            type=sha,format=short
            type=raw,value=latest,enable=${{ inputs.latest }}
            type=semver,pattern={{major}}.{{minor}},value=${{ inputs.version }},enable=${{ inputs.latest }}
            type=semver,pattern={{major}},value=${{ inputs.version }},enable=${{ inputs.latest }}
          labels: |
            org.opencontainers.image.version=${{ inputs.version }}
            org.opencontainers.image.revision=${{ github.sha }}

      - id: build
        uses: docker/build-push-action@v7
        with:
          context:    ${{ inputs.context }}
          file:       ${{ inputs.dockerfile }}
          platforms:  ${{ inputs.platforms }}
          push:       ${{ inputs.push }}
          load:       ${{ !inputs.push }}
          tags:       ${{ steps.meta.outputs.tags }}
          labels:     ${{ steps.meta.outputs.labels }}
          provenance: mode=max
          sbom:       true
          cache-from: type=gha
          cache-to:   type=gha,mode=max
          build-args: |
            APP_VERSION=${{ inputs.version }}

      - name: Summary
        run: |
          {
            echo "### Image"
            echo '```'
            echo "${{ steps.meta.outputs.tags }}"
            echo "digest: ${{ steps.build.outputs.digest }}"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

Copycopy code to clipboard
name: reusable — package chart

on:
  workflow_call:
    inputs:
      chart_version: { required: true,  type: string }
      app_version:   { required: true,  type: string }
      push:          { required: false, type: boolean, default: false }
      chart_dir:     { required: false, type: string,  default: "helm/myapp" }
      oci_repo:      { required: false, type: string,  default: "" }

jobs:
  package:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v7

      - uses: azure/setup-helm@v5
        with:
          version: v3.19.0

      - name: Stamp versions
        run: |
          set -euo pipefail
          sed -i -E "s|^version:.*|version: ${{ inputs.chart_version }}|"           "${{ inputs.chart_dir }}/Chart.yaml"
          sed -i -E "s|^appVersion:.*|appVersion: \"${{ inputs.app_version }}\"|"   "${{ inputs.chart_dir }}/Chart.yaml"
          cat "${{ inputs.chart_dir }}/Chart.yaml"

      - name: Lint and template
        run: |
          helm lint "${{ inputs.chart_dir }}" --strict
          helm template release-check "${{ inputs.chart_dir }}" > /tmp/rendered.yaml
          wc -l /tmp/rendered.yaml

      - name: Package
        run: |
          mkdir -p dist
          helm package "${{ inputs.chart_dir }}" --destination dist
          ls -la dist

      - uses: actions/upload-artifact@v4
        with:
          name: chart-${{ inputs.chart_version }}
          path: dist/*.tgz
          retention-days: 14

      - name: Push to OCI registry
        if: inputs.push
        env:
          OCI_REPO: ${{ inputs.oci_repo != '' && inputs.oci_repo || format('oci://ghcr.io/{0}/charts', github.repository_owner) }}
        run: |
          set -euo pipefail
          echo "${{ secrets.GITHUB_TOKEN }}" \
            | helm registry login ghcr.io --username "${{ github.actor }}" --password-stdin
          for pkg in dist/*.tgz; do
            helm push "$pkg" "$OCI_REPO"
          done

      - name: Summary
        run: |
          {
            echo "### Chart"
            echo "- chart version: \`${{ inputs.chart_version }}\`"
            echo "- appVersion: \`${{ inputs.app_version }}\`"
            echo "- pushed: \`${{ inputs.push }}\`"
          } >> "$GITHUB_STEP_SUMMARY"

Copycopy code to clipboard
# umbrella/Chart.yaml
apiVersion: v2
name: platform
version: 3.4.0            # the umbrella's own, independent version
type: application
dependencies:
  - name: myapp
    version: "~1.5.0"                              # patch-flexible, minor-pinned
    repository: "oci://ghcr.io/<org>/charts"
    condition: myapp.enabled
  - name: otherservice
    version: "2.1.3"
    repository: "oci://ghcr.io/<org>/charts"

Copycopy code to clipboard
helm registry login ghcr.io -u <user> --password-stdin <<< "$GHCR_TOKEN"
helm dependency update ./umbrella    # writes Chart.lock, downloads charts/*.tgz
helm dependency build  ./umbrella    # reproducible: resolves from Chart.lock

Copycopy code to clipboard
notify-umbrella:
    needs: [version, chart]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id:       ${{ vars.RELEASE_APP_ID }}
          private-key:  ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          owner:        ${{ github.repository_owner }}
          repositories: umbrella-chart

      - name: Dispatch bump request
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          gh workflow run bump-dependency.yml \
            --repo ${{ github.repository_owner }}/umbrella-chart \
            --field chart=myapp \
            --field version=${{ needs.version.outputs.version }} \
            --field source_repo=${{ github.repository }}

Copycopy code to clipboard
- id: changed
        run: |
          base=$(git describe --tags --abbrev=0 --match 'chart-v*' 2>/dev/null || git rev-list --max-parents=0 HEAD)
          if git diff --quiet "$base" HEAD -- helm/; then
            echo "chart_changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "chart_changed=true"  >> "$GITHUB_OUTPUT"
          fi

Copycopy code to clipboard
name: "Release — manual GA"

on:
  workflow_dispatch:
    inputs:
      bump:
        description: "Version bump relative to the last GA tag"
        type: choice
        options: [major, minor, patch, explicit]
        default: minor
      explicit_version:
        description: "Exact version when bump=explicit, e.g. 2.0.0 (no leading v)"
        type: string
        required: false
      ref:
        description: "Ref to release from"
        type: string
        default: main
      dry_run:
        description: "Compute and build, but do not tag or push"
        type: boolean
        default: true

concurrency:
  group: release-ga
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  guard:
    runs-on: ubuntu-latest
    steps:
      - name: Validate inputs
        run: |
          if [[ "${{ inputs.bump }}" == "explicit" && -z "${{ inputs.explicit_version }}" ]]; then
            echo "::error::bump=explicit requires explicit_version"; exit 1
          fi
          if [[ -n "${{ inputs.explicit_version }}" ]] \
             && ! [[ "${{ inputs.explicit_version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::explicit_version must be MAJOR.MINOR.PATCH"; exit 1
          fi

  version:
    needs: guard
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.resolve.outputs.version }}
      tag:     ${{ steps.resolve.outputs.tag }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 0
          fetch-tags: true

      - name: Ensure CI is green on this ref
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          state=$(gh api "repos/${{ github.repository }}/commits/$(git rev-parse HEAD)/status" --jq '.state')
          echo "combined status: $state"
          [[ "$state" == "success" ]] || { echo "::error::CI is not green on ${{ inputs.ref }}"; exit 1; }

      - id: resolve
        run: |
          if [[ "${{ inputs.bump }}" == "explicit" ]]; then
            v="${{ inputs.explicit_version }}"
            echo "version=$v" >> "$GITHUB_OUTPUT"
            echo "tag=v$v"    >> "$GITHUB_OUTPUT"
          else
            ./scripts/next-version.sh --mode "${{ inputs.bump }}" --channel ga
          fi

      - name: Refuse to overwrite an existing tag
        run: |
          if git rev-parse "${{ steps.resolve.outputs.tag }}" >/dev/null 2>&1; then
            echo "::error::Tag ${{ steps.resolve.outputs.tag }} already exists"; exit 1
          fi

  image:
    needs: version
    uses: ./.github/workflows/_build-image.yml
    with:
      version: ${{ needs.version.outputs.version }}
      push:    ${{ !inputs.dry_run }}
      latest:  ${{ !inputs.dry_run }}
    permissions: { contents: read, packages: write, id-token: write }

  chart:
    needs: [version, image]
    uses: ./.github/workflows/_package-chart.yml
    with:
      chart_version: ${{ needs.version.outputs.version }}
      app_version:   ${{ needs.version.outputs.version }}
      push:          ${{ !inputs.dry_run }}
    permissions: { contents: read, packages: write }

  publish:
    needs: [version, image, chart]
    if: ${{ !inputs.dry_run }}
    runs-on: ubuntu-latest
    environment: production        # add required reviewers here for a human gate
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
        with: { ref: ${{ inputs.ref }}, fetch-depth: 0 }

      - name: Tag and release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ needs.version.outputs.tag }}
        run: |
          git config user.name  "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -a "$TAG" -m "Release $TAG"
          git push origin "$TAG"
          gh release create "$TAG" --title "$TAG" --generate-notes --latest

Copycopy code to clipboard
# Delete the GitHub release and tag (only if nothing consumed it)
gh release delete v1.5.0 --yes --cleanup-tag

# Chart: never delete a published version — publish 1.5.1 that reverts.
# Image: retag `latest` back to the previous good digest.
docker buildx imagetools create \
  --tag ghcr.io/<org>/<repo>:latest \
  ghcr.io/<org>/<repo>@sha256:<previous-good-digest>