release_authenticator.yml

name: Release Authenticator
on:
  push:
    branches: [ ruisebas/main ]

permissions:
  id-token: write
  contents: write

jobs:
  print-author:
    runs-on: ubuntu-latest
    steps:
      - name: Dump Author context
        env:
          AUTHOR: ${{ toJson(github.event.head_commit.author) }}
        run: echo "$AUTHOR"

  determine-next-version:
    name: Determine the next release version
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.extract-release-version.outputs.result }}
    if: "${{ github.event.head_commit.author.username == 'github-actions' && startsWith(github.event.head_commit.message, 'chore: Release ') }}"
    steps:
      - name: Extract release version
        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
        id: extract-release-version
        with:
          result-encoding: string
          script: |
            const matches = `${{ github.event.head_commit.message }}`.match(/[0-9]+\.[0-9]+\.[0-9]+/) ?? []
            return matches.length > 0 ? matches[0] : ""

  validate-version-format:
    name: Validate Version Format
    needs: [determine-next-version]
    if: ${{ needs.determine-next-version.outputs.version != '' }}
    runs-on: ubuntu-latest
    steps:
      - run: echo "Releasing new version ${{ needs.determine-next-version.outputs.version }}"

  unit-tests:
    name: Run Unit Tests
    needs: [validate-version-format]
    uses: ./.github/workflows/unit_tests.yml
    with:
      identifier: 'workflow-call-unit-test'

  release:
    environment: Release
    name: Release new Authenticator version
    needs: [unit-tests, determine-next-version]
    runs-on: macos-latest
    env:
      GITHUB_EMAIL: aws-amplify-ops@amazon.com
      GITHUB_USER: aws-amplify-ops
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@8c3f20df09ac63af7b3ae3d7c91f105f857d8497 #v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-session-name: ${{ format('{0}.release', github.run_id) }}
          aws-region: ${{ secrets.AWS_REGION }}
          mask-aws-account-id: true

      - id: retrieve-token
        name: Retrieve Token
        env:
          DEPLOY_SECRET_ARN: ${{ secrets.DEPLOY_SECRET_ARN }}
        run: |
          PAT=$(aws secretsmanager get-secret-value \
          --secret-id "$DEPLOY_SECRET_ARN" \
          | jq -r ".SecretString | fromjson | .Credential")
          echo "token=$PAT" >> $GITHUB_OUTPUT

      - name: Checkout repo
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
        with:
          fetch-depth: 10
          token: ${{steps.retrieve-token.outputs.token}}

      - name: Setup Ruby
        uses: ruby/setup-ruby@22fdc77bf4148f810455b226c90fb81b5cbc00a7 # v1.171.0
        with:
          ruby-version: '3.2.1'
          bundler-cache: true

      - name:  Release Authenticator
        env:
          GH_TOKEN: ${{ github.token }}
        run: bundle exec fastlane perform_release version:${{ needs.determine-next-version.outputs.version }}