release.yml

name: Release Artifacts

on:
  push:
    tags:
      - "v*.*.*"

env:
  BUCKET: ${{ vars.RELEASE_BUCKET }} 
  RELEASE_REGION: ${{ vars.RELEASE_REGION }}
  CHANNEL: ${{ vars.DISTRIBUTION_CHANNEL }}
  RELEASES_CLOUDFRONT_ID: ${{ vars.RELEASES_CLOUDFRONT_ID }}

jobs:
  checks:
    uses: ./.github/workflows/checks.yml

  publish:
    uses: ./.github/workflows/publish.yml
    needs:
      - checks
    secrets: inherit

  homebrew:
    uses: ./.github/workflows/homebrew.yml
    needs:
      - publish
    secrets: inherit

  release-artifacts:
    #if: ${{ false }}
    runs-on: ubuntu-latest
    needs:
      - checks
      - publish
      - homebrew
    steps:
      - uses: actions/checkout@v4
      - name: Set environment variables
        run: |
          VERSION=$(cargo pkgid | cut -f2 -d '@')
          echo "SEMVER=$VERSION" >> $GITHUB_ENV
      - name: Fetch release signing key
        run: |
          curl -OL https://releases.saveoursecrets.com/signing-key.pub
      - name: Install cosign
        uses: sigstore/cosign-installer@v3.5.0
      - name: Check cosign install
        run: cosign version
      - name: Install release tools
        uses: jaxxstorm/action-install-gh-release@v1.11.0
        with:
          token: ${{ secrets.GH_RELEASE_DOWNLOAD }}
          repo: saveoursecrets/release-tools
          platform: 'linux'
          arch: 'x86_64'
      - name: Download artifacts
        env:
          AWS_REGION: ${{ env.RELEASE_REGION }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
        run: |
          mkdir -p target/artifacts
          release-artifact download \
            --bucket $BUCKET \
            --directory target/artifacts \
            $CHANNEL/cli/$SEMVER/linux/x86_64/saveoursecrets.zip \
            $CHANNEL/cli/$SEMVER/linux/x86_64/musl/saveoursecrets.zip \
            $CHANNEL/cli/$SEMVER/windows/x86_64/saveoursecrets.zip \
            $CHANNEL/cli/$SEMVER/macos/x86_64/saveoursecrets.zip \
            $CHANNEL/cli/$SEMVER/macos/aarch64/saveoursecrets.zip
      - name: Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: |
            target/artifacts/*
            LICENSE-APACHE
            LICENSE-MIT
            COPYRIGHT
      - name: Update release notes
        env:
          SOS_GH_RELEASE_NOTES_TOKEN: ${{ secrets.SOS_GH_RELEASE_NOTES_TOKEN }}
          AWS_REGION: ${{ env.RELEASE_REGION }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
        run: |
          release-notes \
            --bucket $BUCKET \
            --channel $CHANNEL \
            --collection cli \
            --semver $SEMVER
      - name: Index releases archive
        env:
          AWS_REGION: ${{ vars.RELEASE_REGION }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
        run: |
          index-html s3 \
            --bucket $BUCKET \
            --page-title Releases