release.yaml

name: release
on:
  push:
    tags:
      - v*.*.*
  workflow_dispatch:

permissions:
  contents: write
  id-token: write

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
  PROVIDER: port
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
  PYPI_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
  PYPI_USERNAME: "__token__"
  PUBLISH_PYPI: true
  PUBLISH_NPM: true
jobs:
  publish_binary:
    name: publish
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # tag=v4.1.1
      - name: Unshallow clone for tags
        run: git fetch --prune --unshallow --tags
      - name: Install Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # tag=v5.0.0
        with:
          go-version: ${{matrix.goversion}}
      - name: Install pulumictl
        uses: jaxxstorm/action-install-gh-release@71d17cb091aa850acb2a1a4cf87258d183eb941b # tag=v1.11.0
        with:
          repo: pulumi/pulumictl
      - name: Set PreRelease Version
        run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)" >> $GITHUB_ENV
      - uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
      - uses: anchore/sbom-action/download-syft@b6a39da80722a2cb0ef5d197531764a89b5d48c3 # v0.15.8
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # tag=v5.0.0
        with:
          args: -p 3 release --rm-dist
          version: latest
      - name: Create tag
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # tag=v7.0.1
        with:
          script: |
            github.rest.git.createRef({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: 'refs/tags/sdk/${{ github.ref_name }}',
              sha: context.sha
            })
    strategy:
      fail-fast: true
      matrix:
        goversion:
          - '1.20'
  publish_sdk:
    name: Publish SDKs
    runs-on: ubuntu-latest
    needs: publish_binary
    steps:
      - name: Checkout Repo
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # tag=v4.1.1
      - name: Unshallow clone for tags
        run: git fetch --prune --unshallow --tags
      - name: Install Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # tag=v5.0.0
        with:
          go-version: ${{ matrix.goversion }}
      - name: Install pulumictl
        uses: jaxxstorm/action-install-gh-release@71d17cb091aa850acb2a1a4cf87258d183eb941b # tag=v1.11.0
        with:
          repo: pulumi/pulumictl
      - name: Install Pulumi CLI
        uses: pulumi/action-install-pulumi-cli@b374ceb6168550de27c6eba92e01c1a774040e11 # tag=v2.0.0
      - name: Setup Node
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # tag=v4.0.2
        with:
          node-version: ${{matrix.nodeversion}}
          registry-url: ${{env.NPM_REGISTRY_URL}}
      - name: Setup Python
        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # tag=v5.0.0
        with:
          python-version: ${{matrix.pythonversion}}
      - name: Build SDK
        run: make build_${{ matrix.language }}
      - name: Check worktree clean
        run: |
          git update-index -q --refresh
          if ! git diff-files --quiet; then
              >&2 echo "error: working tree is not clean, aborting!"
              git status
              git diff
              exit 1
          fi
      - if: ${{ matrix.language == 'python' && env.PUBLISH_PYPI == 'true' }}
        name: Publish package to PyPI
        uses: pypa/gh-action-pypi-publish@e53eb8b103ffcb59469888563dc324e3c8ba6f06 # tag=v1.8.12
        with:
          user: ${{ env.PYPI_USERNAME }}
          password: ${{ env.PYPI_PASSWORD }}
          packages_dir: ${{github.workspace}}/sdk/python/bin/dist
      - if: ${{ matrix.language == 'nodejs' && env.PUBLISH_NPM == 'true' }}
        uses: JS-DevTools/npm-publish@4b07b26a2f6e0a51846e1870223e545bae91c552 # tag=v3.0.1
        with:
          access: "public"
          token: ${{ env.NPM_TOKEN }}
          package: ${{github.workspace}}/sdk/nodejs/bin/package.json
          provenance: true
    strategy:
      fail-fast: false
      matrix:
        language:
          - nodejs
          - python
          - go
        nodeversion:
          - 16.x
        pythonversion:
          - "3.9"
        goversion:
          - '1.20'