main.yaml

name: Build
on: [push]

env:
  CI_BUILD_NUM: ${{ github.run_id }}
  CI_BRANCH: ${{ github.ref_name }}

permissions:
  id-token: write
  contents: write  # semantic-release-dry verifies the write permissions
  issues: read # needed by semantic-release
  pull-requests: write # needed by semantic-release

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Use Node.js 24.x
        uses: actions/setup-node@v6
        with:
          node-version: '24.x'
      - run: npm install

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-region: us-east-1
          role-to-assume: ${{ secrets.AWS_CREDENTIALS_ROLE }}
      - name: Fetch AWS Secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with:
          parse-json-secrets: true
          secret-ids: |
            ,/helix/github-action-secrets

      - name: Restore Google Credentials
        run: echo $GOOGLE_CREDS | base64 --decode | tee ~/.helix-google.json | jq -e .client_email

      - run: npm test
      - uses: codecov/codecov-action@v6
        with:
          flags: unittests
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Semantic Release (Dry Run)
        run: npm run semantic-release-dry
        env:
          GITHUB_TOKEN: ${{ github.token }}
          NPM_TOKEN: ${{ secrets.ADOBE_BOT_NPM_TOKEN }}

  release:
    name: Release
    runs-on: ubuntu-latest
    needs: test
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Use Node.js 24.x
        uses: actions/setup-node@v6
        with:
          node-version: '24.x'
      - run: npm install
      - run: npm run semantic-release
        env:
          GITHUB_TOKEN: ${{ github.token }}
          NPM_TOKEN: ${{ secrets.ADOBE_BOT_NPM_TOKEN }}