Refactor github actions with monorepo support (#783)

* refactor github actions with monorepo support

* Update .github/workflows/release-packages.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update .github/workflows/release-packages.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* updates

* changed order of ci/pr steps

* Update .github/workflows/release-web.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* adding lock file

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

.github/workflows/nightly.yml

@@ -1,91 +1,101 @@
-name: "Nightly Release"
+name: Nightly Release
 
 on:
   schedule:
-    - cron: "0 5 * * *" # Run every day at 5am UTC
+    - cron: "0 5 * * *" # 05:00 UTC daily
+  workflow_dispatch: {}   # allow manual runs too
 
 permissions:
-  contents: write
+  contents: read
   packages: write
 
+env:
+  REGISTRY_IMAGE: ghcr.io/${{ github.repository }}
+
 jobs:
   nightly-build-and-push:
     runs-on: ubuntu-latest
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # Node + pnpm (with built-in cache)
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 22
+          cache: pnpm
+          cache-dependency-path: '**/pnpm-lock.yaml'
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
           version: latest
 
-      - name: Cache pnpm dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.pnpm-store
-            packages/web/node_modules
-          key: ${{ runner.os }}-pnpm-${{ hashFiles('packages/web/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm- 
+      - name: Install deps (root)
+        run: pnpm install --frozen-lockfile
 
       - name: Run tests
         run: pnpm run test
 
-      - name: Install Dependencies
-        working-directory: packages/web
-        run: pnpm install
-
-      - name: Build Package
+      - name: Build web package
         working-directory: packages/web
         run: pnpm run build
 
-      - name: Package Output
+      - name: Package output
         working-directory: packages/web
         run: pnpm run package
 
-      - name: Archive compressed build
+      - name: Upload compressed build (artifact)
         uses: actions/upload-artifact@v4
         with:
-          name: build
+          name: web-build-nightly
           path: packages/web/dist/build.tar
+          if-no-files-found: error
 
-      - name: Get latest release version
-        id: get_release
+      - name: Determine nightly tag
+        id: meta
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          LATEST_TAG=$(curl -sL \
-            -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
-            https://api.github.com/repos/${{ github.repository }}/releases/latest | jq -r ".tag_name")
-          # Fallback to a default if no release is found
-          if [ -z "$LATEST_TAG" ]; then
-            LATEST_TAG="2.6.0"
+          set -euo pipefail
+          DATE="$(date -u +%Y%m%d)"
+          SHORTSHA="$(git rev-parse --short=12 HEAD)"
+          # Try to use latest release tag if it exists; fallback to package version; else date
+          LATEST_TAG="$(gh release view --json tagName --jq .tagName 2>/dev/null || true)"
+          if [ -z "$LATEST_TAG" ] && [ -f packages/web/package.json ]; then
+            LATEST_TAG="v$(jq -r .version packages/web/package.json)"
           fi
-          echo "tag=${LATEST_TAG}" >> $GITHUB_OUTPUT
+          if [ -n "$LATEST_TAG" ] && [ "$LATEST_TAG" != "vnull" ]; then
+            TAG="nightly-${LATEST_TAG}-${SHORTSHA}"
+          else
+            TAG="nightly-${DATE}-${SHORTSHA}"
+          fi
+          echo "tag=$TAG"        >> "$GITHUB_OUTPUT"
+          echo "tags=nightly, $TAG" >> "$GITHUB_OUTPUT"
+          echo "Resolved nightly tags: nightly, $TAG"
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
-      - name: Buildah Build
+      - name: Build Container Image (multi-arch)
         id: build-container
         uses: redhat-actions/buildah-build@v2
         with:
           containerfiles: |
             ./packages/web/infra/Containerfile
-          image: ${{ github.event.repository.full_name }}
-          tags: nightly-${{ steps.get_release.outputs.tag }}-${{ github.sha }}
-
-
+          image: ${{ env.REGISTRY_IMAGE }}
+          tags: ${{ steps.meta.outputs.tags }}
           oci: true
           platforms: linux/amd64, linux/arm64
+          labels: |
+            org.opencontainers.image.source=${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.created=${{ github.run_id }}
 
-      - name: Push To Registry
+      - name: Push To GHCR
         id: push-to-registry
         uses: redhat-actions/push-to-registry@v2
         with:
@@ -95,6 +105,5 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Print image url
+      - name: Print image URL
         run: echo "Image pushed to ${{ steps.push-to-registry.outputs.registry-paths }}"
-