push.yaml

name: Push

on:
  pull_request:
 
jobs:
  check_permission:
    name: Check permissions
    runs-on: ubuntu-latest
    outputs:
      can-write: ${{ steps.check.outputs.can-write }}
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
    steps:
    - id: check
      run: |
        # If the AWS_ACCESS_KEY_ID secret is MIA we can't run tests
        if [[ -z "$AWS_ACCESS_KEY_ID" ]]; then
            echo "can-write=false" >> $GITHUB_OUTPUT
        else
            echo "can-write=true" >> $GITHUB_OUTPUT
        fi

  tests:
    name: Run tests
    uses: ./.github/workflows/tests.yaml
    secrets: inherit

  upload:
    name: Upload SAM assets
    needs: [tests, check_permission]
    if: needs.check_permission.outputs.can-write == 'true'
    uses: ./.github/workflows/upload.yaml
    permissions:
      id-token: write
    secrets: inherit
    with:
      s3_bucket_prefix: "observeinc-"

  integration:
    name: Run integration tests 
    needs: upload
    uses: ./.github/workflows/integration.yaml
    secrets: inherit
    with:
      s3_bucket_prefix: "observeinc-"
      release_version: ${{ needs.upload.outputs.release_version }}