release.yml

name: Release

on:
  workflow_dispatch: {}
  schedule:
    - cron: "0 18 * * 2" # Tuesdays at 10 am PST, 11 am PDT

jobs:
  determine_release:
    name: "Determine if release is needed"
    runs-on: ubuntu-latest
    permissions:
      id-token: write # Authenticate to npm registry using OIDC
      contents: read
    timeout-minutes: 15
    outputs:
      pending_version_number: ${{ steps.versiondetails.outputs.pendingversion }}
      pending_version_available: ${{ steps.versiondetails.outputs.pendingversionavailable }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: "Check secrets"
        run: |
          if [ -z "${{ secrets.INTEG_TEST_ROLE_ARN }}" ]; then echo "Secret missing: INTEG_TEST_ROLE_ARN" && exit 1; fi
          if [ -z "${{ secrets.INTEG_TEST_REGION }}" ]; then echo "Secret missing: INTEG_TEST_REGION" && exit 1; fi
          if [ -z "${{ secrets.INTEG_TEST_AWS_ACCOUNT_ID }}" ]; then echo "Secret missing: INTEG_TEST_AWS_ACCOUNT_ID" && exit 1; fi

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'
      - name: Install commit-and-tag-version
        run: |
          npm install -g commit-and-tag-version@^12.5.0

      - name: Configure git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Check for new commits to release
        run: |
          CURRENT_VERSION=$(cat VERSION)
          COMMITS_TO_RELEASE=$(git log --pretty=oneline v$CURRENT_VERSION..HEAD | wc -l)

          echo Current version: v$CURRENT_VERSION
          echo Commits to release: $COMMITS_TO_RELEASE

          echo "CURRENT_VERSION=${CURRENT_VERSION}" >> $GITHUB_ENV
          echo "COMMITS_TO_RELEASE=${COMMITS_TO_RELEASE}" >> $GITHUB_ENV

      - name: Check if no release needed
        if: ${{ env.COMMITS_TO_RELEASE == 0 }}
        run: |
          echo No changes to release!
          echo Current release: $CURRENT_VERSION

      - name: Determine new version number
        if: ${{ env.COMMITS_TO_RELEASE != 0 }}
        run: |
          commit-and-tag-version

          NEW_VERSION=$(cat VERSION)
          RELEASE_COMMIT_ID=$(git rev-parse HEAD)

          echo "NEW_VERSION=${NEW_VERSION}" >> $GITHUB_ENV
          echo "RELEASE_COMMIT_ID=${RELEASE_COMMIT_ID}" >> $GITHUB_ENV

      - name: Check if version was bumped
        if: ${{ env.COMMITS_TO_RELEASE != 0 && env.NEW_VERSION == env.CURRENT_VERSION }}
        run: |
          echo No changes to release!
          echo Current release: $CURRENT_VERSION

      - name: "Show pending version details"
        if: ${{ env.COMMITS_TO_RELEASE != 0 && env.NEW_VERSION != env.CURRENT_VERSION }}
        id: versiondetails
        shell: bash
        run: |
          echo New version: v$NEW_VERSION
          echo Commit ID: $RELEASE_COMMIT_ID
          echo Previous version: v$CURRENT_VERSION
          echo Changes to be released:
          git log --pretty=oneline v$CURRENT_VERSION..v$NEW_VERSION

          git show v$NEW_VERSION

          echo "pendingversion=${NEW_VERSION}" >> $GITHUB_OUTPUT
          echo "pendingversionavailable=true" >> $GITHUB_OUTPUT

  run_unit_tests:
    name: "Run unit tests"
    needs: determine_release
    if: needs.determine_release.outputs.pending_version_available == 'true'
    permissions:
      contents: read
    uses: ./.github/workflows/unit-tests.yml

  run_integration_tests:
    name: "Run integration tests"
    needs: determine_release
    if: needs.determine_release.outputs.pending_version_available == 'true'
    permissions:
      id-token: write
      contents: read
    secrets:
      INTEG_TEST_ROLE_ARN: ${{ secrets.INTEG_TEST_ROLE_ARN }}
      INTEG_TEST_REGION: ${{ secrets.INTEG_TEST_REGION }}
      INTEG_TEST_AWS_ACCOUNT_ID: ${{ secrets.INTEG_TEST_AWS_ACCOUNT_ID }}
    uses: ./.github/workflows/integ-tests.yml

  vulnerability_scan:
    name: "Scan for vulnerabilities"
    needs: determine_release
    if: needs.determine_release.outputs.pending_version_available == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Scan for vulnerabilities
        run: ./scripts/scan-vulnerabilities.sh --lockfile=./src/python/uv.lock

  npm_audit:
    name: "Audit NPM dependencies"
    needs: determine_release
    if: needs.determine_release.outputs.pending_version_available == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      - name: Audit src/typescript
        run: npm ci && npm audit --audit-level critical
        working-directory: ./src/typescript

  release_new_version:
    name: "Release the new version"
    needs: [determine_release, run_unit_tests, run_integration_tests, vulnerability_scan, npm_audit]
    if: needs.determine_release.outputs.pending_version_available == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write
      id-token: write
    steps:
      # Install tools
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true
      - name: "Set up Python"
        uses: actions/setup-python@v5
        with:
          python-version-file: "src/python/.python-version"
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"
      - name: Install commit-and-tag-version
        run: |
          npm install -g commit-and-tag-version@^12.5.0
      - name: Configure git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      # Create the version bump commit and tag
      - name: Tag new version and update changelog
        env:
          PENDING_VERSION: ${{needs.determine_release.outputs.pending_version_number}}
        run: |
          commit-and-tag-version

          NEW_VERSION=$(cat VERSION)
          RELEASE_COMMIT_ID=$(git rev-parse HEAD)

          echo "PENDING_VERSION=${PENDING_VERSION}" >> $GITHUB_ENV
          echo "NEW_VERSION=${NEW_VERSION}" >> $GITHUB_ENV
          echo "RELEASE_COMMIT_ID=${RELEASE_COMMIT_ID}" >> $GITHUB_ENV

      - name: Confirm version number
        if: ${{ env.PENDING_VERSION != env.NEW_VERSION }}
        run: |
          echo Pending release and actual release numbers do not match
          echo Pending release: $PENDING_VERSION
          echo Actual release: $NEW_VERSION
          exit 1

      # Publish new version to GitHub
      - name: Push new version to GitHub
        run: |
          git push origin HEAD:main
          git push origin v$NEW_VERSION
        working-directory: ./

      - name: Create GitHub release
        uses: softprops/action-gh-release@v2
        with:
          name: v${{ env.NEW_VERSION }}
          tag_name: v${{ env.NEW_VERSION }}
          target_commitish: ${{ env.RELEASE_COMMIT_ID }}
          body: See the [changelog](CHANGELOG.md) for details about the changes included in this release.

      # Publish new version to npm and PyPi
      - name: Build Typescript library and publish to NPM
        run: |
          cp ../../README.md .
          npm ci
          npm publish --access public
        working-directory: ./src/typescript

      - name: Build Python library
        run: |
          cp ../../README.md .
          uv build
          ls dist/
        working-directory: ./src/python

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: ./src/python/dist