Check before publish latest

.github/scripts/is-latest-release.sh

@@ -0,0 +1,48 @@
+#!/bin/sh
+
+# Used in our CIs to publish the latest Docker image.
+
+# Checks if the current tag ($GITHUB_REF) corresponds to the latest release tag on GitHub
+# Returns "true" or "false" (as a string) as a string.
+
+GITHUB_API='https://api.github.com/repos/meilisearch/meilisearch/releases'
+PNAME='meilisearch'
+
+# FUNCTIONS
+
+# Returns the version of the latest stable version of Meilisearch by setting the $latest variable.
+get_latest() {
+    # temp_file is needed because the grep would start before the download is over
+    temp_file=$(mktemp -q /tmp/$PNAME.XXXXXXXXX)
+    latest_release="$GITHUB_API/latest"
+
+    if [ $? -ne 0 ]; then
+        echo "$0: Can't create temp file."
+        exit 1
+    fi
+
+    if [ -z "$GITHUB_PAT" ]; then
+        curl -s "$latest_release" > "$temp_file" || return 1
+    else
+        curl -H "Authorization: token $GITHUB_PAT" -s "$latest_release" > "$temp_file" || return 1
+    fi
+
+    latest="$(cat "$temp_file" | grep '"tag_name":' | cut -d ':' -f2 | tr -d '"' | tr -d ',' | tr -d ' ')"
+
+    rm -f "$temp_file"
+    return 0
+}
+
+# MAIN
+current_tag="$(echo $GITHUB_REF | tr -d 'refs/tags/')"
+get_latest
+
+if [ "$current_tag" != "$latest" ]; then
+    # The current release tag is not the latest
+    echo "false"
+else
+    # The current release tag is the latest
+    echo "true"
+fi
+
+exit 0

.github/workflows/publish-docker-images.yml

@@ -26,15 +26,20 @@ jobs:
       # - a `vX.Y` (without patch version) Docker tag
       # - a `latest` Docker tag
       # For any other tag pushed, this is not considered stable.
-      - name: Define if stable release
+      - name: Define if stable and latest release
         id: check-tag-format
+        env:
+          # To avoid request limit with the .github/scripts/is-latest-release.sh script
+          GITHUB_PATH: ${{ secrets.MEILI_BOT_GH_PAT }}
         run: |
           escaped_tag=$(printf "%q" ${{ github.ref_name }})
+          echo "latest=false" >> $GITHUB_OUTPUT
 
           if [[ ${{ github.event_name }} != 'push' ]]; then
             echo "stable=false" >> $GITHUB_OUTPUT
           elif [[ $escaped_tag =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "stable=true" >> $GITHUB_OUTPUT
+            echo "latest=$(sh .github/scripts/is-latest-release.sh)" >> $GITHUB_OUTPUT
           else
             echo "stable=false" >> $GITHUB_OUTPUT
           fi
@@ -76,7 +81,7 @@ jobs:
             type=ref,event=tag
             type=raw,value=nightly,enable=${{ github.event_name != 'push' }}
             type=semver,pattern=v{{major}}.{{minor}},enable=${{ steps.check-tag-format.outputs.stable == 'true' }}
-            type=raw,value=latest,enable=${{ steps.check-tag-format.outputs.stable == 'true' }}
+            type=raw,value=latest,enable=${{ steps.check-tag-format.outputs.stable == 'true' && steps.check-tag-format.outputs.latest == 'true' }}
 
       - name: Build and push
         uses: docker/build-push-action@v3