Merge pull request 'feat(release): add workflow for creating release tags and update CHANGELOG.md' (#22) from patch-2-gitea-registry into main

Reviewed-on: #22

.gitea/workflows/docker-publish.yml

@@ -70,17 +70,6 @@ jobs:
           username: ${{ gitea.actor }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
-      # Build a single-arch image locally so Trivy can inspect it before the real push.
-      - name: Build local image for scanning
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          target: final
-          platforms: linux/amd64
-          load: true
-          tags: scan-target:${{ inputs.tag }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache
-
       - name: Build and push
         uses: docker/build-push-action@v5
         with:

.gitea/workflows/release.yml

@@ -0,0 +1,62 @@
+# Cuts a release: moves CHANGELOG.md's [Unreleased] section under a new
+# version heading, commits it to main, then creates and pushes the version tag.
+# Trigger manually via workflow_dispatch, entering the semver to release.
+# The pushed tag can then be built with docker-publish.yml.
+
+name: Create Release Tag
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to release (semver, e.g. 1.2.3)"
+        required: true
+        type: string
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Validate version and Unreleased section
+        run: |
+          if ! [[ "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Error: '${{ inputs.version }}' is not a valid semver (e.g. 1.2.3)."
+            exit 1
+          fi
+          if git rev-parse "refs/tags/${{ inputs.version }}" >/dev/null 2>&1; then
+            echo "Error: tag '${{ inputs.version }}' already exists."
+            exit 1
+          fi
+          awk '/^## \[Unreleased\]/{f=1;next}/^## \[/{f=0}f' CHANGELOG.md > /tmp/unreleased.md
+          if ! grep -q '[^[:space:]]' /tmp/unreleased.md; then
+            echo "Error: CHANGELOG.md's [Unreleased] section is empty — nothing to release."
+            exit 1
+          fi
+
+      - name: Move Unreleased entries under the new version heading
+        run: |
+          today=$(date +%Y-%m-%d)
+          awk -v ver="${{ inputs.version }}" -v date="$today" '
+            /^## \[Unreleased\]/ { print; print ""; print "## [" ver "] - " date; next }
+            { print }
+          ' CHANGELOG.md > /tmp/CHANGELOG.md
+          mv /tmp/CHANGELOG.md CHANGELOG.md
+
+      - name: Commit and tag
+        run: |
+          git config user.name "gitea-actions"
+          git config user.email "actions@noreply.git.arthurerlich.de"
+          git add CHANGELOG.md
+          git commit -m "chore(release): ${{ inputs.version }}"
+          git tag "${{ inputs.version }}"
+          git push origin HEAD:main
+          git push origin "${{ inputs.version }}"

.gitea/workflows/test.yml

@@ -8,7 +8,6 @@ on:
 
 env:
   REGISTRY: git.arthurerlich.de
-  DEV_IMAGE: git.arthurerlich.de/${{ gitea.repository }}:ci-${{ gitea.sha }}
 
 jobs:
   build-dev:
@@ -27,17 +26,30 @@ jobs:
           username: ${{ gitea.actor }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
-      - name: Build and push dev image (PHP 8.4 + composer deps)
+      - name: Build dev image (PHP 8.4 + composer deps)
         uses: docker/build-push-action@v5
         with:
           context: .
           file: Dockerfile.dev
           target: dev
-          push: true
+          load: true
-          tags: ${{ env.DEV_IMAGE }}
+          tags: graph-dev:ci
           cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev
           cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev,mode=max
 
+      - name: Run tests in dev image
+        run: |
+          cid=$(docker create graph-dev:ci sh -c "
+            composer install --no-interaction &&
+            vendor/bin/phpunit --testdox &&
+            composer phpstan
+          ")
+          docker cp . "$cid":/app
+          rc=0
+          docker start -a "$cid" || rc=$?
+          docker rm "$cid" > /dev/null
+          exit $rc
+
   build-prod:
     needs: build-dev
     runs-on: ubuntu-latest
@@ -48,6 +60,13 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Log in to Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
       - name: Build prod image (final target)
         uses: docker/build-push-action@v5
         with:
@@ -55,21 +74,5 @@ jobs:
           file: Dockerfile
           target: final
           push: false
-
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-prod
-  test:
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-prod,mode=max
-    needs: build-dev
-    runs-on: ubuntu-latest
-    container:
-      image: ${{ env.DEV_IMAGE }}
-      credentials:
-        username: ${{ gitea.actor }}
-        password: ${{ secrets.REGISTRY_TOKEN }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Run tests
-        run: |
-          composer install --no-interaction
-          vendor/bin/phpunit --testdox
-          composer phpstan

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Removed a leftover `composer dump-env prod` call in the prod Docker build stage — the command doesn't exist in this project's Composer setup and broke every image build
+
 ## [0.2.0] - 2026-07-12
 
 ### Added