rust-start-release.yml

# This workflow regenerates `releases/rust/db_esdk/` for a new version
# of the aws-db-esdk crate by running
# DynamoDbEncryption/runtimes/rust/start_release.sh, committing the
# result on a release branch, and opening a PR back to main.
#
# `cargo publish` and `test_published.sh` live in rust-release.yml and
# should be dispatched on the resulting PR's branch before merging.
#
# This workflow does NOT need any crates.io credentials; it only writes
# to the repo (via secrets.GITHUB_TOKEN) and assumes AWS via OIDC for
# the tests that start_release.sh runs.
name: Rust Start Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: "New aws-db-esdk version in N.N.N format (e.g. '1.2.5')."
        required: true
        type: string

permissions: {}

jobs:
  start-release:
    name: Run start_release.sh and open a release PR
    runs-on: ubuntu-22.04
    permissions:
      id-token: write
      contents: write
      pull-requests: write
    env:
      RUST_MIN_STACK: 838860800
    steps:
      - name: Validate version input
        shell: bash
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          set -euo pipefail
          if ! [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::Version '${VERSION}' must be in N.N.N format (e.g. '1.2.5')."
            exit 1
          fi

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-region: us-west-2
          role-to-assume: arn:aws:iam::370957321024:role/GitHub-CI-DDBEC-Dafny-Role-us-west-2
          role-session-name: DDBEC-Rust-Start-Release
          special-characters-workaround: "true"

      - name: Support longpaths on Git checkout
        run: |
          git config --global core.longpaths true

      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Init Submodules
        shell: bash
        run: |
          git submodule update --init --recursive submodules/smithy-dafny
          git submodule update --init --recursive submodules/MaterialProviders

      - name: Setup Rust Toolchain for GitHub CI
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          components: rustfmt, clippy

      - name: Setup Dafny
        uses: ./submodules/MaterialProviders/.github/actions/setup_dafny/
        with:
          dafny-version: 4.10.0

      - name: Setup Java 17 for codegen
        uses: actions/setup-java@v5
        with:
          distribution: "corretto"
          java-version: "17"

      - name: Install Smithy-Dafny codegen dependencies
        uses: ./submodules/MaterialProviders/.github/actions/install_smithy_dafny_codegen_dependencies
        with:
          mpl-submodule-path: ./submodules/MaterialProviders/

      - name: Configure Git
        shell: bash
        run: |
          git config --global user.name "GitHub Actions"
          git config --global user.email "actions@github.com"

      - name: Create release branch
        id: branch
        shell: bash
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          set -euo pipefail
          BRANCH="release/db_esdk/v${VERSION}"
          git checkout -b "${BRANCH}"
          echo "name=${BRANCH}" >> "$GITHUB_OUTPUT"

      - name: Run start_release.sh
        shell: bash
        working-directory: DynamoDbEncryption/runtimes/rust
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: ./start_release.sh "${VERSION}"

      - name: Commit regenerated releases/rust/db_esdk
        shell: bash
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          set -euo pipefail
          # Submodule dirs and other transient state must not be committed.
          git add releases/rust/db_esdk DynamoDbEncryption/runtimes/rust/Cargo.toml
          if git diff --cached --quiet; then
            echo "::error::start_release.sh produced no changes; nothing to release."
            exit 1
          fi
          git commit -m "chore(release): aws-db-esdk v${VERSION}"

      - name: Push release branch
        shell: bash
        env:
          BRANCH: ${{ steps.branch.outputs.name }}
        run: |
          set -euo pipefail
          git push origin "${BRANCH}"

      - name: Open release PR
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BRANCH: ${{ steps.branch.outputs.name }}
          VERSION: ${{ github.event.inputs.version }}
        run: |
          set -euo pipefail
          gh pr create \
            --base main \
            --head "${BRANCH}" \
            --title "chore(release): aws-db-esdk v${VERSION}" \
            --body "Automated release PR generated by \`rust-start-release.yml\` for aws-db-esdk v${VERSION}.

          Reviewer checklist:
          - Update \`CHANGELOG.md\` in the root directory with the changes for this version.
          - If this is a major version bump, update \`SUPPORT_POLICY.rst\` for Rust.
          - After approval, dispatch the \`Rust Release\` workflow on this branch (or after merging) to publish to crates.io and run \`test_published.sh\`.

          Do NOT merge this PR before publishing."