release.yml

name: Release Packages
on:
  # pull_request:
  #   branches: [main]
  #   paths:
  #     - '**'
  #     - '!**/README.md'
  release:
    types: [published]
jobs:
  install-deps:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/configure-nodejs
        with:
          lookup-only: 'true' # We only want to lookup from the cache - if a hit, this job does nothing

  version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.get_version.outputs.version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Get version from git tag
        id: get_version
        run: echo "version=$(git describe --tags $(git rev-list --tags --max-count=1))" >> $GITHUB_OUTPUT

      - name: Output version
        run: echo "The version is ${{ steps.get_version.outputs.version }}"

  #
  # CDK Construct
  #
  release:
    name: Build CDK Construct
    needs: [install-deps, version]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      latest_commit: ${{ steps.git_remote.outputs.latest_commit }}
      tag_exists: ${{ steps.check_tag_exists.outputs.exists }}
    env:
      CI: 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set git identity
        run: |-
          git config user.name "github-actions"
          git config user.email "github-actions@github.com"
      - uses: ./.github/actions/configure-nodejs
      - name: Build All TypeScript
        run: yarn build
      # - name: Run Lint
      #   run: yarn lint
      - name: Run Node Tests
        env:
          NODE_ENV: test
        working-directory: src/cdk-construct
        run: yarn test
      - name: Prepare the Release
        working-directory: src/cdk-construct
        run: npx projen release
      - name: Check if version has already been tagged
        id: check_tag_exists
        working-directory: src/cdk-construct
        run: |-
          TAG=$(cat dist/releasetag.txt)
          ([ ! -z "$TAG" ] && git ls-remote -q --exit-code --tags origin $TAG && (echo "exists=true" >> $GITHUB_OUTPUT)) || (echo "exists=false" >> $GITHUB_OUTPUT)
          cat $GITHUB_OUTPUT
      # - name: Apply Version to Everything (Deployer / Datalib)
      #   run: |
      #     echo "Version is ${{needs.version.outputs.version }}"
      #     node scripts/version.js ${{needs.version.outputs.version }}
      - name: Check for new commits
        id: git_remote
        run: |-
          echo "latest_commit=$(git ls-remote origin -h ${{ github.ref }} | cut -f1)" >> $GITHUB_OUTPUT
          cat $GITHUB_OUTPUT
      - name: Backup artifact permissions
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        working-directory: src/cdk-construct
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
      - name: Upload CDK Construct Artifact
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: build-artifact
          path: src/cdk-construct/dist
          overwrite: true

  release_github:
    name: Publish to GitHub Releases
    needs:
      - release
      - release_npm
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: 18.x
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_REF: ${{ github.sha }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_REF 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi

  release_npm:
    name: Publish to npm
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: 18.x
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo/src/cdk-construct
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create js artifact
        run: cd .repo/src/cdk-construct/ && npx projen package:js
      - name: Collect js artifact
        run: mv .repo/src/cdk-construct/dist dist
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_TOKEN: ${{ secrets.NPMJSORG_PUBLISH_TOKEN }} # publib requires NPM_TOKEN as an env var
        run: npx -p publib@latest publib-npm