Create unified release workflow

3 files changed, 182 insertions, 47 deletions

diff --git a/.github/workflows/bun-npm-release.yml b/.github/workflows/bun-npm-release.yml
deleted file mode 100644
index 25f596b8e..000000000
--- a/.github/workflows/bun-npm-release.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-name: Release bun to npm
-on:
-  release:
-    types:
-      - published
-      - edited # canary only
-  workflow_dispatch:
-    inputs:
-      tag:
-        type: string
-        description: The tag to publish, defaults to 'canary' if empty
-        default: canary
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    if: github.repository_owner == 'oven-sh'
-    defaults:
-      run:
-        working-directory: packages/bun-npm
-    steps:
-      - id: checkout
-        name: Checkout
-        uses: actions/checkout@v3
-      - id: setup-env
-        name: Setup Environment
-        run: |
-          TAG="${{ github.event.inputs.tag }}"
-          TAG="${TAG:-"${{ github.event.release.tag_name }}"}"
-          TAG="${TAG:-"canary"}"
-          echo "Setup tag: ${TAG}"
-          echo "TAG=${TAG}" >> ${GITHUB_ENV}
-      - id: setup-bun
-        name: Setup Bun
-        uses: oven-sh/setup-bun@v0.1.8
-        with:
-          bun-version: canary
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-      - id: bun-install
-        name: Install Dependencies
-        run: bun install
-      - id: bun-run
-        name: Release
-        run: bun run npm -- "${{ env.TAG }}" publish
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/bun-release.yml b/.github/workflows/bun-release.yml
new file mode 100644
index 000000000..30ecaaf1b
--- /dev/null
+++ b/.github/workflows/bun-release.yml
@@ -0,0 +1,99 @@
+name: bun-release
+concurrency: release
+on:
+  release:
+    types:
+      - published
+      - edited # canary only
+  workflow_dispatch:
+    inputs:
+      tag:
+        type: string
+        description: The tag to publish
+        default: canary
+jobs:
+  npm:
+    id: npm
+    name: Release to NPM
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: packages/bun-npm
+    steps:
+      - id: checkout
+        name: Checkout
+        uses: actions/checkout@v3
+      - id: setup-env
+        name: Setup Environment
+        run: |
+          TAG="${{ github.event.inputs.tag }}"
+          TAG="${TAG:-"${{ github.event.release.tag_name }}"}"
+          TAG="${TAG:-"canary"}"
+          echo "Setup tag: ${TAG}"
+          echo "TAG=${TAG}" >> ${GITHUB_ENV}
+      - id: setup-bun
+        name: Setup Bun
+        uses: oven-sh/setup-bun@v0.1.8
+        with:
+          bun-version: canary
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - id: bun-install
+        name: Install Dependencies
+        run: bun install
+      - id: bun-run
+        name: Release
+        run: bun run npm -- "${{ env.TAG }}" publish
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  docker:
+    id: docker
+    name: Release to Dockerhub
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: packages/bun-npm
+    steps:
+      - id: checkout
+        name: Checkout
+        uses: actions/checkout@v3
+      - id: environment
+        name: Setup Environment
+        run: |
+          TAG="${{ github.event.inputs.tag }}"
+          TAG="${TAG:-"${{ github.event.release.tag_name }}"}"
+          TAG="${TAG:-"canary"}"
+          echo "Setup tag: ${TAG}"
+          echo "TAG=${TAG}" >> ${GITHUB_ENV}
+      - id: qemu
+        name: Setup Docker QEMU
+        uses: docker/setup-qemu-action@v2
+      - id: buildx
+        name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          platforms: linux/amd64,linux/arm64
+      - id: metadata
+        name: Setup Docker metadata
+        uses: docker/metadata-action@v4
+        with:
+          images: ${{ secrets.DOCKERHUB_USERNAME }}/bun
+          tags: |
+            type=match,pattern=(bun-v)?(canary|\d.\d.\d),group=2,value=${{ env.TAG }}
+            type=match,pattern=(bun-v)?(canary|\d.\d.\d),group=2,value=${{ env.TAG }}
+            type=match,pattern=(bun-v)?(canary|\d.\d.\d),group=2,value=${{ env.TAG }}
+      - id: login
+        name: Login to Docker
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - id: push
+        name: Push to Docker
+        uses: docker/build-push-action@v3
+        with:
+          context: ./dockerhub
+          file: Dockerfile-debian
+          push: true
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}
diff --git a/dockerhub/Dockerfile-debian b/dockerhub/Dockerfile-debian
new file mode 100644
index 000000000..5eb04f952
--- /dev/null
+++ b/dockerhub/Dockerfile-debian
@@ -0,0 +1,83 @@
+# https://hub.docker.com/_/debian
+# https://hub.docker.com/_/ubuntu
+ARG IMAGE=debian:bullseye-slim
+
+FROM $IMAGE AS base
+
+# https://github.com/oven-sh/bun/releases
+ARG BUN_VERSION=latest
+
+RUN apt-get update -qq \
+    && apt-get install -qq --no-install-recommends \
+      ca-certificates \
+      curl \
+      dirmngr \
+      gpg \
+      gpg-agent \
+      unzip \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* \
+    && arch="$(dpkg --print-architecture)" \
+    && case "${arch##*-}" in \
+      amd64) build="x64-baseline";; \
+      arm64) build="aarch64";; \
+      *) echo "error: unsupported architecture: ($arch)"; exit 1 ;; \
+    esac \
+    && version="$BUN_VERSION" \
+    && case "$version" in \
+      latest | canary | bun-v*) tag="$version"; ;; \ 
+      v*)                       tag="bun-$version"; ;; \
+      *)                        tag="bun-v$version"; ;; \
+    esac \
+    && case "$tag" in \
+      latest) release="latest/download"; ;; \
+      *)      release="download/$tag"; ;; \
+    esac \
+    && curl "https://github.com/oven-sh/bun/releases/$release/bun-linux-$build.zip" \
+      -fsSLO \
+      --compressed \
+      --retry 5 \
+      || (echo "error: unknown release: ($tag)" && exit 1) \
+    && for key in \
+      "F3DCC08A8572C0749B3E18888EAB4D40A7B22B59" \
+    ; do \
+      gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" \
+      || gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \
+    done \
+    && curl "https://github.com/oven-sh/bun/releases/$release/SHASUMS256.txt.asc" \
+      -fsSLO \
+      --compressed \
+      --retry 5 \
+    && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \
+      || (echo "error: failed to verify release: ($tag)" && exit 1) \
+    && grep " bun-linux-$build.zip\$" SHASUMS256.txt | sha256sum -c - \
+      || (echo "error: failed to verify release: ($tag)" && exit 1) \
+    && unzip "bun-linux-$build.zip" \
+    && mv "bun-linux-$build/bun" /usr/local/bin/bun \
+    && rm -f "bun-linux-$build.zip" SHASUMS256.txt.asc SHASUMS256.txt \
+    && chmod +x /usr/local/bin/bun \
+    && ln -s /usr/local/bin/bun /usr/local/bin/bunx \
+    && which bun \
+    && which bunx \
+    && bun --version
+
+FROM $IMAGE
+
+RUN groupadd bun \
+      --gid 1000 \
+    && useradd bun \
+      --uid 1000 \
+      --gid bun \
+      --shell /bin/sh \
+      --create-home
+
+USER 1000:1000
+COPY --from=base --chown=1000:1000 /usr/local/bin/bun /usr/local/bin
+COPY --from=base --chown=1000:1000 /usr/local/bin/bunx /usr/local/bin
+
+RUN which bun \
+    && which bunx \
+    && bun --version
+
+WORKDIR /home/bun/app
+CMD ["bun"]