release.yml

# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".

name: release
run-name: ${{ inputs.dry_run && format('[DRY RUN] release by @{0}', github.actor) || '' }}
on:
  push:
    branches:
      - master
  workflow_dispatch:
    inputs:
      dry_run:
        description: Dry run (skip actual publishing)
        required: false
        type: boolean
concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false
jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      latest_commit: ${{ steps.git_remote.outputs.latest_commit }}
      tag_exists: ${{ steps.check_tag_exists.outputs.exists }}
      artifact_id: ${{ steps.upload_artifact.outputs.artifact-id }}
    env:
      CI: "true"
    steps:
      - name: Checkout
        id: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
      - name: Set git identity
        id: set_git_identity
        run: |-
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
      - name: Setup Node.js
        id: setup_node_js
        uses: actions/setup-node@v7.0.0
        with:
          node-version: lts/*
          package-manager-cache: false
      - name: Install dependencies
        id: install_dependencies
        run: npm ci
      - name: release
        id: release
        run: npx projen release
      - name: Check if version has already been tagged
        id: check_tag_exists
        run: |-
          TAG=$(cat dist/releasetag.txt)
          ([ ! -z "$TAG" ] && git ls-remote -q --exit-code --tags origin $TAG && (echo "exists=true" >> $GITHUB_OUTPUT)) || (echo "exists=false" >> $GITHUB_OUTPUT)
          cat $GITHUB_OUTPUT
      - name: Check for new commits
        id: git_remote
        env:
          GITHUB_REF: ${{ github.ref }}
        run: |-
          echo "latest_commit=$(git ls-remote origin -h "$GITHUB_REF" | cut -f1)" >> $GITHUB_OUTPUT
          cat $GITHUB_OUTPUT
        shell: bash
      - name: Backup artifact permissions
        id: backup_artifact_permissions
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
      - name: Upload artifact
        id: upload_artifact
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: build-artifact
          path: dist
          overwrite: true
  release_github:
    name: Publish to GitHub Releases
    needs:
      - release
      - release_npm
      - release_maven
      - release_pypi
      - release_golang
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-node@v7.0.0
        with:
          node-version: lts/*
          package-manager-cache: false
      - name: Download build artifacts
        id: download_build_artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          artifact-ids: ${{ needs.release.outputs.artifact_id }}
          path: dist
      - name: Restore build artifact permissions
        id: restore_build_artifact_permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        id: release
        if: ${{ !inputs.dry_run }}
        env:
          RELEASE_TAG_FILE: dist/releasetag.txt
          CHANGELOG_FILE: dist/changelog.md
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |-
          tag=$(cat "$RELEASE_TAG_FILE") &&
          gh release view "$tag" -R "$GITHUB_REPOSITORY" 2>/dev/null ||
          gh release create "$tag" -R "$GITHUB_REPOSITORY" -F "$CHANGELOG_FILE" -t "$tag" --target "$GITHUB_SHA"
  release_npm:
    name: Publish to npm
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-node@v7.0.0
        with:
          node-version: lts/*
          package-manager-cache: false
      - name: Download build artifacts
        id: download_build_artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          artifact-ids: ${{ needs.release.outputs.artifact_id }}
          path: dist
      - name: Restore build artifact permissions
        id: restore_build_artifact_permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        id: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          path: .repo
      - name: Install Dependencies
        id: install_dependencies
        run: cd .repo && npm ci
      - name: Extract build artifact
        id: extract_build_artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
      - name: Move build artifact out of the way
        id: move_build_artifact_out_of_the_way
        run: mv dist dist.old
      - name: Create js artifact
        id: create_js_artifact
        run: cd .repo && npx projen package:js
      - name: Collect js artifact
        id: collect_js_artifact
        run: mv .repo/dist dist
      - name: Release
        id: release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_CONFIG_PROVENANCE: "true"
          NPM_TRUSTED_PUBLISHER: "true"
          PUBLIB_DRYRUN: ${{ inputs.dry_run }}
        run: npx '-p' 'publib@latest' 'publib-npm'
  release_maven:
    name: Publish to Maven Central
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-java@v6.0.0
        with:
          distribution: corretto
          java-version: "11"
      - uses: actions/setup-node@v7.0.0
        with:
          node-version: lts/*
          package-manager-cache: false
      - name: Download build artifacts
        id: download_build_artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          artifact-ids: ${{ needs.release.outputs.artifact_id }}
          path: dist
      - name: Restore build artifact permissions
        id: restore_build_artifact_permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        id: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          path: .repo
      - name: Install Dependencies
        id: install_dependencies
        run: cd .repo && npm ci
      - name: Extract build artifact
        id: extract_build_artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
      - name: Move build artifact out of the way
        id: move_build_artifact_out_of_the_way
        run: mv dist dist.old
      - name: Create java artifact
        id: create_java_artifact
        run: cd .repo && npx projen package:java
      - name: Collect java artifact
        id: collect_java_artifact
        run: mv .repo/dist dist
      - name: Release
        id: release
        env:
          MAVEN_SERVER_ID: central-ossrh
          MAVEN_GPG_PRIVATE_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          MAVEN_GPG_PRIVATE_KEY_PASSPHRASE: ${{ secrets.MAVEN_GPG_PRIVATE_KEY_PASSPHRASE }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
          MAVEN_STAGING_PROFILE_ID: ${{ secrets.MAVEN_STAGING_PROFILE_ID }}
          PUBLIB_DRYRUN: ${{ inputs.dry_run }}
        run: npx '-p' 'publib@latest' 'publib-maven'
  release_pypi:
    name: Publish to PyPI
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-node@v7.0.0
        with:
          node-version: lts/*
          package-manager-cache: false
      - uses: actions/setup-python@v7.0.0
        with:
          python-version: 3.x
      - name: Download build artifacts
        id: download_build_artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          artifact-ids: ${{ needs.release.outputs.artifact_id }}
          path: dist
      - name: Restore build artifact permissions
        id: restore_build_artifact_permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        id: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          path: .repo
      - name: Install Dependencies
        id: install_dependencies
        run: cd .repo && npm ci
      - name: Extract build artifact
        id: extract_build_artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
      - name: Move build artifact out of the way
        id: move_build_artifact_out_of_the_way
        run: mv dist dist.old
      - name: Create python artifact
        id: create_python_artifact
        run: cd .repo && npx projen package:python
      - name: Collect python artifact
        id: collect_python_artifact
        run: mv .repo/dist dist
      - name: Release
        id: release
        env:
          PYPI_TRUSTED_PUBLISHER: "true"
          PUBLIB_DRYRUN: ${{ inputs.dry_run }}
        run: npx '-p' 'publib@latest' 'publib-pypi'
  release_golang:
    name: Publish to GitHub Go Module Repository
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-node@v7.0.0
        with:
          node-version: lts/*
          package-manager-cache: false
      - uses: actions/setup-go@v7.0.0
        with:
          go-version: ^1.18.0
          cache: false
      - name: Download build artifacts
        id: download_build_artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          artifact-ids: ${{ needs.release.outputs.artifact_id }}
          path: dist
      - name: Restore build artifact permissions
        id: restore_build_artifact_permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        id: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          path: .repo
      - name: Install Dependencies
        id: install_dependencies
        run: cd .repo && npm ci
      - name: Extract build artifact
        id: extract_build_artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
      - name: Move build artifact out of the way
        id: move_build_artifact_out_of_the_way
        run: mv dist dist.old
      - name: Create go artifact
        id: create_go_artifact
        run: cd .repo && npx projen package:go
      - name: Collect go artifact
        id: collect_go_artifact
        run: mv .repo/dist dist
      - name: Release
        id: release
        env:
          GIT_USER_NAME: github-actions[bot]
          GIT_USER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
          GITHUB_TOKEN: ${{ secrets.GO_GITHUB_TOKEN }}
          PUBLIB_DRYRUN: ${{ inputs.dry_run }}
        run: npx '-p' 'publib@latest' 'publib-golang'