release.yaml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:

env:
  S3_BUCKET_PREFIX: observeinc

jobs:
  permission_check:
    runs-on: ubuntu-latest
    outputs:
      can-write: ${{ steps.check.outputs.can-write }}
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
    steps:
    - id: check
      run: |
        # If the AWS_ACCESS_KEY_ID secret is MIA we can't run tests
        if [[ -z "$AWS_ACCESS_KEY_ID" ]]; then
            echo "can-write=false" >> $GITHUB_OUTPUT
        else
            echo "can-write=true" >> $GITHUB_OUTPUT
        fi

  tests:
    needs: permission_check
    uses: ./.github/workflows/tests-integration.yaml
    if: needs.permission_check.outputs.can-write == 'true'
    secrets: inherit

  fetch-regions:
    runs-on: ubuntu-latest
    needs: permission_check
    if: needs.permission_check.outputs.can-write == 'true'
    permissions:
      id-token: write
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
    - name: Setup AWS credentials
      uses: aws-actions/configure-aws-credentials@v4.0.2
      with:
        role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
        aws-region: us-west-2

    - name: AWS Info
      run: aws sts get-caller-identity

    - name: Fetch available AWS regions
      id: fetch-regions
      run: |
        regions=$(aws ec2 describe-regions --query "Regions[].RegionName" --output text | tr '\t' '\n' | jq -R -s -c 'split("\n")[:-1]')
        echo "Regions: $regions"
        echo "regions_json=$regions" >> "$GITHUB_ENV"
    
    - name: Set Matrix for aws-release job
      id: set-matrix
      run: echo "matrix=${regions_json}" >> "$GITHUB_OUTPUT"

  github-release:
    needs: [tests, permission_check]
    runs-on: ubuntu-latest
    if: >
      (needs.permission_check.outputs.can-write == 'true' && github.event_name == 'push') || 
      (github.event_name == 'workflow_dispatch' && needs.tests.result == 'success')
    outputs:
      version: ${{ steps.release-version.outputs.VERSION }}
    steps:
    - name: checkout
      uses: actions/checkout@v4

    - name: github release (beta)
      if: github.event_name == 'push'
      id: prerelease
      uses: ahmadnassri/action-semantic-release@v2
      with:
        config: ${{ github.workspace }}/.releaserc.json
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: github release (stable)
      if: github.event_name == 'workflow_dispatch'
      id: fullrelease
      uses: ahmadnassri/action-semantic-release@v2
      with:
        config: ${{ github.workspace }}/.releaserc-release.json
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Set version for aws-release job
      id: release-version
      run: |
        echo "VERSION=${{ env.VERSION }}" >> "$GITHUB_OUTPUT"
      env:
        VERSION: ${{ (steps.prerelease.outputs.release-version != '') && steps.prerelease.outputs.release-version || steps.fullrelease.outputs.release-version }}
      
  aws-release:
    needs: [fetch-regions, github-release, tests]
    runs-on: ubuntu-latest
    if: |
      github.actor != 'dependabot[bot]' &&
      needs.github-release.outputs.version != ''
    strategy:
      matrix:
        region: ${{fromJson(needs.fetch-regions.outputs.matrix)}}
    permissions:
      contents: write
      id-token: write
      pull-requests: write

    steps:
    - name: checkout
      uses: actions/checkout@v4

    - uses: actions/setup-go@v5
      with:
        go-version-file: 'go.mod'

    - name: build
      run: make sam-build-all

    - name: Setup AWS credentials
      uses: aws-actions/configure-aws-credentials@v4.0.2
      with:
        role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
        aws-region: us-west-2

    - name: AWS Info
      run: aws sts get-caller-identity

    - name: aws sam release (versioned)
      run: make release-all
      env:
        VERSION: ${{ needs.github-release.outputs.VERSION }}
        AWS_REGION: ${{ matrix.region }}

    - name: aws sam release (beta)
      if: github.event_name == 'push'
      run: make release-all
      env:
        VERSION: beta
        AWS_REGION: ${{ matrix.region }}

    - name: aws sam release (stable)
      if: github.event_name == 'workflow_dispatch'
      run: make release-all
      env:
        VERSION: latest
        AWS_REGION: ${{ matrix.region }}

    - name: delete pre-releases
      uses: dev-drprasad/delete-older-releases@v0.3.3
      with:
        keep_latest: 0
        delete_tags: true
        delete_prerelease_only: true
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}