release.yml

# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".

name: release
on:
  push:
    branches:
      - main
  workflow_dispatch: {}
jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      latest_commit: ${{ steps.git_remote.outputs.latest_commit }}
      tag_exists: ${{ steps.check_tag_exists.outputs.exists }}
    env:
      CI: "true"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set git identity
        run: |-
          git config user.name "github-actions"
          git config user.email "github-actions@github.com"
      - name: GitHub Packages authorization
        env:
          NPM_TOKEN: ${{ secrets.ALL_PACKAGE_READ_TOKEN }}
        run: |-
          cat > ~/.npmrc <<EOF
          //npm.pkg.github.com/:_authToken=${NPM_TOKEN}
          @time-loop:registry=https://npm.pkg.github.com/
          EOF
      - name: Make cdk-ecr-deployment sane
        run: export FORCE_PREBUILT_LAMBDA=1
      - name: Setup pnpm
        uses: pnpm/action-setup@v3
        with:
          version: "9"
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20.11.1
      - name: Install dependencies
        run: pnpm i --frozen-lockfile
      - name: release
        run: npx projen release
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          directory: coverage
      - name: Check if version has already been tagged
        id: check_tag_exists
        run: |-
          TAG=$(cat dist/dist/releasetag.txt)
          ([ ! -z "$TAG" ] && git ls-remote -q --exit-code --tags origin $TAG && (echo "exists=true" >> $GITHUB_OUTPUT)) || (echo "exists=false" >> $GITHUB_OUTPUT)
          cat $GITHUB_OUTPUT
      - name: Check for new commits
        id: git_remote
        run: |-
          echo "latest_commit=$(git ls-remote origin -h ${{ github.ref }} | cut -f1)" >> $GITHUB_OUTPUT
          cat $GITHUB_OUTPUT
      - name: Backup artifact permissions
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
      - name: Upload artifact
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4
        with:
          name: build-artifact
          path: dist
          overwrite: true
  release_github:
    name: Publish to GitHub Releases
    needs:
      - release
      - release_npm
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: 20.11.1
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Prepare Repository
        run: mv dist .repo
      - name: Collect GitHub Metadata
        run: mv .repo/dist dist
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_REF: ${{ github.sha }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_REF 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
  release_npm:
    name: Publish to npm
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: 20.11.1
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: GitHub Packages authorization
        env:
          NPM_TOKEN: ${{ secrets.ALL_PACKAGE_READ_TOKEN }}
        run: |-
          cat > ~/.npmrc <<EOF
          //npm.pkg.github.com/:_authToken=${NPM_TOKEN}
          @time-loop:registry=https://npm.pkg.github.com/
          EOF
      - name: Make cdk-ecr-deployment sane
        run: export FORCE_PREBUILT_LAMBDA=1
      - name: Setup pnpm
        uses: pnpm/action-setup@v3
        with:
          version: "9"
      - name: Prepare Repository
        run: mv dist .repo
      - name: Install Dependencies
        run: cd .repo && pnpm i --frozen-lockfile
      - name: Remove ~/.npmrc file for release
        run: rm ~/.npmrc || true
      - name: Create js artifact
        run: cd .repo && npx projen package:js
      - name: Collect js Artifact
        run: mv .repo/dist dist
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: npm.pkg.github.com
          NPM_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx -p publib@latest publib-npm
  send_release_event:
    name: Send Release Event
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      CI: "true"
    if: needs.release.outputs.latest_commit == github.sha
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-artifact
          path: dist
      - name: Get version
        id: event_metadata
        run: echo "release_tag=$(cat dist/releasetag.txt)" >> $GITHUB_OUTPUT
      - name: Send Datadog event
        uses: Glennmen/datadog-event-action@fb18624879901f1ff0c3c7e1e102179793bfe948
        with:
          datadog_api_key: ${{ secrets.DD_PROJEN_RELEASE_API_KEY }}
          datadog_us: true
          event_title: Released @time-loop/cdk-service-quotas-metric-publisher version ${{ steps.event_metadata.outputs.release_tag }}
          event_text: Released @time-loop/cdk-service-quotas-metric-publisher version ${{ steps.event_metadata.outputs.release_tag }}
          event_priority: normal
          event_tags: "['project:@time-loop/cdk-service-quotas-metric-publisher','release:true','version:${{ steps.event_metadata.outputs.release_tag }}','actor:${{ github.actor }}']"
  send_release_event_to_slack:
    name: Send Release Alert to Slack
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: needs.release.outputs.latest_commit == github.sha
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-artifact
          path: dist
      - name: Get version
        id: event_metadata
        run: echo "release_tag=$(cat dist/releasetag.txt)" >> $GITHUB_OUTPUT
      - name: Send Slack webhook event
        uses: rtCamp/action-slack-notify@12e36fc18b0689399306c2e0b3e0f2978b7f1ee7
        env:
          SLACK_TITLE: ${{ github.repository }}@${{ steps.event_metadata.outputs.release_tag }} released!
          SLACK_MESSAGE: "View the release notes here: https://github.com/${{ github.repository }}/releases/tag/${{ steps.event_metadata.outputs.release_tag }}"
          SLACK_WEBHOOK: ${{ secrets.PROJEN_RELEASE_SLACK_WEBHOOK }}
          SLACK_FOOTER: ""
          SLACK_COLOR: success
          MSG_MINIMAL: "true"