feat(ci): add workflow to publish releases when a new tag is created

Author: Antonis Kalipetis

.github/workflows/release.yml

@@ -0,0 +1,105 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+    branches:
+      - feature/automated-release
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: ./go.mod
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.4"
+          extensions: curl, openssl, phar, zlib
+          tools: composer:v2
+
+      - name: Get Composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache Composer dependencies
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('legacy/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install legacy dependencies
+        run: cd legacy && composer install --no-interaction
+
+      - name: Get PHP version from Makefile
+        id: php-version
+        run: echo "version=$(grep '^PHP_VERSION' Makefile | cut -d= -f2 | tr -d ' ')" >> $GITHUB_OUTPUT
+
+      - name: Cache PHP binaries
+        uses: actions/cache@v4
+        id: php-cache
+        with:
+          path: internal/legacy/archives/php_*
+          key: php-binaries-${{ steps.php-version.outputs.version }}
+
+      - name: Download all PHP binaries
+        if: steps.php-cache.outputs.cache-hit != 'true'
+        run: make download-php
+
+      - name: Write signing keys to files
+        run: |
+          echo "${{ secrets.RSA_SIGNING_KEY }}" > /tmp/rsa-signing-key.pem
+          openssl rsa -in /tmp/rsa-signing-key.pem -pubout -out /tmp/rsa-signing-key.pub
+          echo "${{ secrets.GPG_SIGNING_KEY }}" | base64 -d > /tmp/gpg-signing-key.asc
+
+      - name: Build release (tag)
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NFPM_RSA_SIGNING_KEY_FILE: /tmp/rsa-signing-key.pem
+          NFPM_GPG_SIGNING_KEY_FILE: /tmp/gpg-signing-key.asc
+          CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
+        run: make release
+
+      - name: Build snapshot (branch)
+        if: "!startsWith(github.ref, 'refs/tags/')"
+        env:
+          NFPM_RSA_SIGNING_KEY_FILE: /tmp/rsa-signing-key.pem
+          NFPM_GPG_SIGNING_KEY_FILE: /tmp/gpg-signing-key.asc
+        run: make snapshot
+
+      - name: Install repogen
+        run: go install github.com/ralt/repogen/cmd/repogen@latest
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: eu-west-1
+
+      - name: Upload packages to repository
+        env:
+          GPG_PRIVATE_KEY_FILE: /tmp/gpg-signing-key.asc
+          RSA_PRIVATE_KEY_FILE: /tmp/rsa-signing-key.pem
+          RSA_PUBLIC_KEY_FILE: /tmp/rsa-signing-key.pub
+        run: bash ./repogen.sh
+
+      - name: Clean up signing keys
+        if: always()
+        run: rm -f /tmp/rsa-signing-key.pem /tmp/rsa-signing-key.pub /tmp/gpg-signing-key.asc