release.yml

name: Release

on:
  workflow_dispatch: 
    
permissions: {}

concurrency:
  group: release-drafter

jobs:
  
  release-drafter:
    outputs:
      tag_name: ${{ steps.release-drafter.outputs.tag_name }}
    permissions:
      contents: write
      pull-requests: read
    runs-on: ubuntu-latest
    steps:
      - name: Verify branch
        run: |
          if [[ "${GITHUB_REF}" != refs/heads/main ]]; then
            echo "This workflow is only allowed to run on the main branch."
            exit 1
          fi
      - uses: release-drafter/release-drafter@693d20e7c1ce1a81d3a41962f85914253b518449 # v7.3.1
        id: release-drafter
        env:
          GITHUB_TOKEN: ${{ github.token }}
        with:
          commitish: ${{ github.sha }}
      - name: Create tag
        uses: actions/github-script@v9
        with:
          script: |
            github.rest.git.createRef({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: 'refs/tags/${{ steps.release-drafter.outputs.tag_name }}',
              sha: context.sha
            })
  
  containers:
    needs: 
      - release-drafter
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      full-version: ${{ steps.bootstrap.outputs.full-version }}
      major-version: ${{ steps.bootstrap.outputs.major-version }}

    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.release-drafter.outputs.tag_name }}
          persist-credentials: false
      - name: Bootstrap Action Workspace
        id: bootstrap
        uses: ./.github/actions/bootstrap
        
      - name: Login to GitHub Container Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish Containers
        run: ./build.sh publishcontainers
        
  build-link-index-lambda:
    needs: 
      - release-drafter
    uses: ./.github/workflows/build-link-index-updater-lambda.yml
    with:
      ref: ${{ needs.release-drafter.outputs.tag_name }}

  build-changelog-scrubber-lambda:
    needs:
      - release-drafter
    uses: ./.github/workflows/build-changelog-scrubber-lambda.yml
    with:
      ref: ${{ needs.release-drafter.outputs.tag_name }}

  deploy-link-index-updater-lambda-prod:
    environment: 
      name: link-index-updater-prod
    runs-on: ubuntu-latest
    needs:
      - build-link-index-lambda
      - release-drafter
    permissions:
      contents: write
      id-token: write
    env: 
      ZIP_FILE: link-index-updater-lambda.zip
    steps:

      - name: Download bootstrap binary
        uses: actions/download-artifact@v8
        with: 
          name: link-index-updater-lambda-binary

      - name: Create zip
        run: |
          zip -j "${ZIP_FILE}" ./bootstrap

      - uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
        with:
          role-to-assume: arn:aws:iam::197730964718:role/elastic-docs-v3-link-index-updater-deployer
          aws-region: us-east-2
      
      - name: Upload Lambda function
        run: |
          aws lambda update-function-code \
            --function-name elastic-docs-v3-link-index-updater \
            --zip-file "fileb://${ZIP_FILE}"
      
      - name: Attach Distribution to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ needs.release-drafter.outputs.tag_name }}
          REPO: ${{ github.repository }}
        run: gh release upload --repo "$REPO" "$TAG_NAME" "${ZIP_FILE}"

  deploy-changelog-scrubber-lambda-prod:
    environment:
      name: changelog-scrubber-prod
    runs-on: ubuntu-latest
    needs:
      - build-changelog-scrubber-lambda
      - release-drafter
    permissions:
      contents: write
      id-token: write
    env:
      ZIP_FILE: changelog-scrubber-lambda.zip
    steps:

      - name: Download bootstrap binary
        uses: actions/download-artifact@v8
        with:
          name: changelog-scrubber-lambda-binary

      - name: Create zip
        run: |
          zip -j "${ZIP_FILE}" ./bootstrap

      - uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
        with:
          role-to-assume: arn:aws:iam::197730964718:role/elastic-docs-v3-changelog-scrubber-deployer
          aws-region: us-east-1

      - name: Upload Lambda function
        run: |
          aws lambda update-function-code \
            --function-name elastic-docs-v3-changelog-scrubber \
            --zip-file "fileb://${ZIP_FILE}"

      - name: Attach Distribution to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ needs.release-drafter.outputs.tag_name }}
          REPO: ${{ github.repository }}
        run: gh release upload --repo "$REPO" "$TAG_NAME" "${ZIP_FILE}"

  release:
    needs: 
      - release-drafter
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest, windows-latest, macos-latest, macos-latest-large ]
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
      attestations: write
      id-token: write
    outputs:
      full-version: ${{ steps.bootstrap.outputs.full-version }}
      major-version: ${{ steps.bootstrap.outputs.major-version }}

    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.release-drafter.outputs.tag_name }}
          persist-credentials: false
      - name: 'Windows only, set TEMP to the same drive'
        if: ${{ matrix.os == 'windows-latest' }}
        #  temporary waiting for https://github.com/parcel-bundler/parcel/pull/10095 to fix
        run: |
          mkdir "D:\\Temp"
          echo "TEMP=D:\\Temp" >> $env:GITHUB_ENV

      - name: Bootstrap Action Workspace
        id: bootstrap
        uses: ./.github/actions/bootstrap

      - name: Publish Binaries
        run: ./build.sh publishzip
        shell: bash
        
      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: |
            .artifacts/publish/docs-builder/release/*.zip

      - name: Attach Distribution to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ needs.release-drafter.outputs.tag_name }}
        run: |
          gh release upload "$TAG_NAME" .artifacts/publish/docs-builder/release/*.zip
        shell: bash

  publish-release:
    needs:
      - release
      - containers
      - release-drafter
      - deploy-link-index-updater-lambda-prod
      - deploy-changelog-scrubber-lambda-prod
    runs-on: ubuntu-latest
    permissions: 
      contents: write
    steps:
      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ needs.release-drafter.outputs.tag_name }}
          REPO: ${{ github.repository }}
        run: |
          gh release edit "$TAG_NAME" --draft=false --latest --repo "$REPO"