template-pre-release.yaml

#
# This workflow helps to create a release candidate branch and a pre-release tag.
# It also allows to update the dev version.
#
# HOW TO USE:
#
# To call this reusable workflow, copy the code between === lines to a new workflow file,
# uncomment and adjust "uses" as needed (use the latest tag available).
# ======================================================================
#
# name: Pre-Release of XXX component
#
# on:
#     workflow_dispatch:
#         inputs:
#             new-version:
#                 description: 'New version to be set. (1.0.1)'
#                 type: string
#                 required: true
#             release-date:
#                 description: 'Release date. (YYYY-MM-DD)'
#                 type: string
#                 required: true
#             new-dev-release:
#                 description: 'Set the new dev version. (1.0.1)'
#                 type: string
#                 required: false
#
#jobs:
#      create-release-candidate:
#         uses: OutSystems/ui-components.github-reusable-workflows/.github/workflows/pre-release.yaml@CommitHash #v?.?.?
#         with:
#             new-version: ${{ inputs.new-version }}
#             release-date: ${{ inputs.release-date }}
#             new-dev-release: ${{ inputs.new-dev-release }}
#
# ======================================================================
#
name: Pre-Release

on:
    workflow_call:
        inputs:
            new-version:
                description: 'New version to be set. (1.0.1)'
                type: string
                required: true
            release-date:
                description: 'Release date. (YYYY-MM-DD)'
                type: string
                required: true
            new-dev-release:
                description: 'Set the new dev version. (1.0.1)'
                type: string
                required: false
        secrets:
            GPG_PRIVATE_KEY:
                description: 'GPG private key'
                required: true
            OSUI_AZURE_CLIENT_ID:
                description: 'Azure Client ID for authentication'
                required: true
            OSUI_AZURE_TENANT_ID:
                description: 'Azure Tenant ID for authentication'
                required: true
            OSUI_AZURE_SUBSCRIPTION_ID:
                description: 'Azure Subscription ID for authentication'
                required: true

jobs:
    run-lint-on-dev:
        name: Run lint on dev branch
        runs-on: ubuntu-latest
        permissions:
            contents: read

        if: ${{ inputs.new-version }}
        steps:
            - name: 📥 Checkout into dev
              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
              with:
                  ref: dev

            - name: 📦 Install project dependencies
              run: npm install

            - name: 🏗️ Run build
              run: npm run build

    cleanup-existing-rc:
        needs: run-lint-on-dev
        name: Cleanup existing rc branch and tag
        runs-on: ubuntu-latest
        permissions:
            id-token: write
            contents: read

        if: ${{ inputs.new-version }}
        steps:
            - name: 📥 Checkout repository
              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

            - name: 🔐 Azure login
              #uses: OutSystems/rd.github-reusable-workflows/.github/actions/az-login@9d497d1c5bc6e355aa8f4663539e6b75c212f6b4 #v2.0.7
              uses: ./.github/actions/az-login
              with:
                  client-id: ${{ secrets.OSUI_AZURE_CLIENT_ID }}
                  tenant-id: ${{ secrets.OSUI_AZURE_TENANT_ID }}
                  subscription-id: ${{ secrets.OSUI_AZURE_SUBSCRIPTION_ID }}

            - name: 🔑 Get GitHub Token
              id: get-github-token
              #uses: OutSystems/rd.github-reusable-workflows/.github/actions/az-keyvault-get@9d497d1c5bc6e355aa8f4663539e6b75c212f6b4 #v2.0.7
              uses: ./.github/actions/az-keyvault-get
              with:
                  key-name: o11odc-github-gitpersonal-token-prd

            - name: 📥 Checkout with token
              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
              with:
                  token: ${{ steps.get-github-token.outputs.az-keyvault-value }}

            - name: 🗑️ Delete existing branch rc${{ inputs.new-version }} if exists
              run: |
                  if git ls-remote --exit-code --heads origin rc${{ inputs.new-version }}; then
                      echo "Branch rc${{ inputs.new-version }} exists. Deleting..."
                      git push origin --delete rc${{ inputs.new-version }}
                  else
                      echo "Branch rc${{ inputs.new-version }} does not exist."
                  fi

            - name: 🗑️ Delete existing tag v${{ inputs.new-version }} if exists
              run: |
                  if git ls-remote --exit-code --tags origin refs/tags/v${{ inputs.new-version }}; then
                      echo "Tag v${{ inputs.new-version }} exists. Deleting..."
                      git push origin --delete refs/tags/v${{ inputs.new-version }}
                  else
                      echo "Tag v${{ inputs.new-version }} does not exist."
                  fi

    create-rc:
        needs: cleanup-existing-rc
        name: Create rc branch
        runs-on: ubuntu-latest
        permissions:
            id-token: write
            contents: read

        if: ${{ inputs.new-version }}
        steps:
            - name: 📥 Checkout repository
              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

            - name: 🔐 Azure login
              #uses: OutSystems/rd.github-reusable-workflows/.github/actions/az-login@9d497d1c5bc6e355aa8f4663539e6b75c212f6b4 #v2.0.7
              uses: ./.github/actions/az-login
              with:
                  client-id: ${{ secrets.OSUI_AZURE_CLIENT_ID }}
                  tenant-id: ${{ secrets.OSUI_AZURE_TENANT_ID }}
                  subscription-id: ${{ secrets.OSUI_AZURE_SUBSCRIPTION_ID }}

            - name: 🔑 Get GitHub Token
              id: get-github-token
              #uses: OutSystems/rd.github-reusable-workflows/.github/actions/az-keyvault-get@9d497d1c5bc6e355aa8f4663539e6b75c212f6b4 #v2.0.7
              uses: ./.github/actions/az-keyvault-get
              with:
                  key-name: o11odc-github-gitpersonal-token-prd

            - name: 📥 Checkout into dev
              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
              with:
                  ref: dev
                  token: ${{ steps.get-github-token.outputs.az-keyvault-value }}

            - name: 🔄 Create branch rc${{ inputs.new-version }}
              run: |
                  git checkout -b rc${{ inputs.new-version }}
                  git push -u origin rc${{ inputs.new-version }}

    set-tag:
        needs: create-rc
        name: Set tag
        runs-on: ubuntu-latest
        permissions:
            id-token: write
            contents: read

        if: ${{ inputs.new-version }}
        steps:
            - name: 📥 Checkout repository
              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

            - name: 🔐 Azure login
              #uses: OutSystems/rd.github-reusable-workflows/.github/actions/az-login@9d497d1c5bc6e355aa8f4663539e6b75c212f6b4 #v2.0.7
              uses: ./.github/actions/az-login
              with:
                  client-id: ${{ secrets.OSUI_AZURE_CLIENT_ID }}
                  tenant-id: ${{ secrets.OSUI_AZURE_TENANT_ID }}
                  subscription-id: ${{ secrets.OSUI_AZURE_SUBSCRIPTION_ID }}

            - name: 🔑 Get GitHub Token
              id: get-github-token
              #uses: OutSystems/rd.github-reusable-workflows/.github/actions/az-keyvault-get@9d497d1c5bc6e355aa8f4663539e6b75c212f6b4 #v2.0.7
              uses: ./.github/actions/az-keyvault-get
              with:
                  key-name: o11odc-github-gitpersonal-token-prd

            - name: 📥 Checkout into rc${{ inputs.new-version }}
              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
              with:
                  ref: rc${{ inputs.new-version }}
                  fetch-depth: 0
                  token: ${{ steps.get-github-token.outputs.az-keyvault-value }}

            - name: 🔖 Set tag
              run: |
                  git tag v${{ inputs.new-version }} HEAD
                  git push origin --tags

    set-pre-release:
        needs: set-tag
        name: Set pre-release
        runs-on: ubuntu-latest
        permissions:
            id-token: write
            contents: read

        if: ${{ inputs.new-version }}
        steps:
            - name: 📥 Checkout repository
              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

            - name: 🔐 Azure login
              #uses: OutSystems/rd.github-reusable-workflows/.github/actions/az-login@9d497d1c5bc6e355aa8f4663539e6b75c212f6b4 #v2.0.7
              uses: ./.github/actions/az-login
              with:
                  client-id: ${{ secrets.OSUI_AZURE_CLIENT_ID }}
                  tenant-id: ${{ secrets.OSUI_AZURE_TENANT_ID }}
                  subscription-id: ${{ secrets.OSUI_AZURE_SUBSCRIPTION_ID }}

            - name: 🔑 Get GitHub Token
              id: get-github-token
              #uses: OutSystems/rd.github-reusable-workflows/.github/actions/az-keyvault-get@9d497d1c5bc6e355aa8f4663539e6b75c212f6b4 #v2.0.7
              uses: ./.github/actions/az-keyvault-get
              with:
                  key-name: o11odc-github-gitpersonal-token-prd

            - name: 📦 Create release
              id: create_release
              uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
              with:
                  tag_name: v${{ inputs.new-version }}
                  name: Release of version ${{ inputs.new-version }} (${{ inputs.release-date }})
                  body: |
                      ### What's New
                      - First
                      - ...

                      ### Fixed Issues and Improvements
                      - First
                      - ...

                  draft: false
                  prerelease: true
                  token: ${{ steps.get-github-token.outputs.az-keyvault-value }}

    update-dev-version:
        needs: create-rc
        name: Update dev version
        runs-on: ubuntu-latest
        permissions:
            id-token: write
            contents: write
            pull-requests: write

        # This job creates a branch from dev, updates the version, commits the changes,
        # and creates a PR into dev. This is required because the bot does not have
        # permissions to commit directly to the dev branch.
        if: ${{ inputs.new-version && inputs.new-dev-release }}
        steps:
            - name: 📥 Checkout repository
              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

            - name: 🔐 Azure login
              #uses: OutSystems/rd.github-reusable-workflows/.github/actions/az-login@9d497d1c5bc6e355aa8f4663539e6b75c212f6b4 #v2.0.7
              uses: ./.github/actions/az-login
              with:
                  client-id: ${{ secrets.OSUI_AZURE_CLIENT_ID }}
                  tenant-id: ${{ secrets.OSUI_AZURE_TENANT_ID }}
                  subscription-id: ${{ secrets.OSUI_AZURE_SUBSCRIPTION_ID }}

            - name: 🔑 Get GitHub Token
              id: get-github-token
              #uses: OutSystems/rd.github-reusable-workflows/.github/actions/az-keyvault-get@9d497d1c5bc6e355aa8f4663539e6b75c212f6b4 #v2.0.7
              uses: ./.github/actions/az-keyvault-get
              with:
                  key-name: o11odc-github-gitpersonal-token-prd
          
            - name: 📥 Checkout into dev
              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
              with:
                  ref: dev
                  token: ${{ steps.get-github-token.outputs.az-keyvault-value }}

            # Create a new branch from dev for the version update.
            # If the branch already exists (e.g., workflow was run twice), checkout the existing branch
            # instead of creating a duplicate. This makes the workflow idempotent.
            - name: 🔄 Create branch chore/update-dev-version-${{ inputs.new-dev-release }}
              run: |
                  if git ls-remote --exit-code --heads origin chore/update-dev-version-${{ inputs.new-dev-release }}; then
                      echo "Branch chore/update-dev-version-${{ inputs.new-dev-release }} already exists. Checking out..."
                      git fetch origin chore/update-dev-version-${{ inputs.new-dev-release }}
                      git checkout chore/update-dev-version-${{ inputs.new-dev-release }}
                  else
                      echo "Creating new branch chore/update-dev-version-${{ inputs.new-dev-release }}"
                      git checkout -b chore/update-dev-version-${{ inputs.new-dev-release }}
                      git push -u origin chore/update-dev-version-${{ inputs.new-dev-release }}
                  fi
              env:
                  GITHUB_TOKEN: ${{ steps.get-github-token.outputs.az-keyvault-value }}

            - name: 🕸️ Install project dependencies
              run: npm install

            - name: 🔖 Update dev version into v${{ inputs.new-dev-release }}
              run: |
                  npm run gta-update-version --newVersion=${{ inputs.new-dev-release }}
             
            # 14 May 2025 - rug
            # Currently Azure Key Vault does not support multi-line secrets, so we are using a secret instead.
            # - name: Get GPG key from Azure Key Vault
            #   id: GetGPGKey
            #   uses: OutSystems/rd.github-reusable-workflows/.github/actions/az-keyvault-get@9d497d1c5bc6e355aa8f4663539e6b75c212f6b4 #v2.0.7
            #   with:
            #       key-name: o11odc-github-gpg-key-prd

            - name: 🔑 Get GPG Passphrase from Azure Key Vault
              id: GetGPGPassphrase
              #uses: OutSystems/rd.github-reusable-workflows/.github/actions/az-keyvault-get@9d497d1c5bc6e355aa8f4663539e6b75c212f6b4 #v2.0.7
              uses: ./.github/actions/az-keyvault-get
              with:
                  key-name: o11odc-github-gpg-passphrase-prd

            # Commit the version changes to the branch with GPG signing.
            # The signed-commit action will stage, commit, and push the changes.
            - name: 🔏 Sign and commit version increment to branch chore/update-dev-version-${{ inputs.new-dev-release }}
              #uses: OutSystems/rd.github-reusable-workflows/.github/actions/signed-commit@9d497d1c5bc6e355aa8f4663539e6b75c212f6b4 #v2.0.7
              uses: ./.github/actions/signed-commit
              with:
                  commit-branch: chore/update-dev-version-${{ inputs.new-dev-release }}
                  commit-message: 'Updated into v${{ inputs.new-dev-release }} [skip ci]'
                  commit-new-files: true
                  gpg-priv-key: ${{ secrets.GPG_PRIVATE_KEY }}
                  # gpg-priv-key: ${{ steps.GetGPGKey.outputs.az-keyvault-value }}
                  gpg-pass-phrase: ${{ steps.GetGPGPassphrase.outputs.az-keyvault-value }}

            # Create a pull request from the chore/update-dev-version-${{ inputs.new-dev-release }} branch into dev.
            # Since the commit is already pushed to the remote branch, we use GitHub CLI to create a PR.
            - name: 🔀 Create pull request
              run: |
                  gh pr create \
                    --base dev \
                    --draft \
                    --head chore/update-dev-version-${{ inputs.new-dev-release }} \
                    --title "Update version into v${{ inputs.new-dev-release }} [skip ci]" \
                    --body "$(cat <<EOF
                  This PR updates the dev version into v${{ inputs.new-dev-release }}.

                  This PR was automatically created by the Pre-Release workflow.
                  EOF
                  )"
              env:
                  GH_TOKEN: ${{ steps.get-github-token.outputs.az-keyvault-value }}