release-please.yml

name: Run Release Please

on:
  push:
    branches:
      - main

jobs:
  release-please:
    runs-on: ubuntu-latest
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      - uses: google-github-actions/release-please-action@v4
        id: release
        with:
          token: ${{secrets.GITHUB_TOKEN}}

  release-ldcli:
    permissions:
      id-token: write # Needed to obtain Docker tokens
      contents: write # Needed to upload release artifacts
    needs: [ release-please ]
    if: ${{ needs.release-please.outputs.release_created == 'true' }}
    runs-on: ubuntu-latest
    outputs:
      hashes: ${{ steps.publish.outputs.hashes }}
    steps:
      - uses: actions/checkout@v4
        name: Checkout
        with:
          fetch-depth: 0

      - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.0.1
        name: 'Get Docker token'
        with:
          aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
          ssm_parameter_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN'

      - uses: ./.github/actions/publish
        id: publish
        with:
          dry-run: 'false'
          token: ${{ secrets.GITHUB_TOKEN }}
          homebrew-gh-secret: ${{secrets.HOMEBREW_DEPLOY_KEY}}
          tag: ${{ needs.release-please.outputs.tag_name }}

  release-ldcli-npm:
    runs-on: ubuntu-latest
    needs: ['release-please', 'release-ldcli']
    permissions:
      id-token: write
      contents: write
    if: ${{ needs.release-please.outputs.release_created == 'true' }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v3
        with:
          node-version: 20.x
          registry-url: 'https://registry.npmjs.org'
      - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.0.1
        name: 'Get NPM token'
        with:
          aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
          ssm_parameter_pairs: '/production/common/releasing/npm/token = NODE_AUTH_TOKEN'
      - id: publish-npm
        name: Publish NPM Package
        uses: ./.github/actions/publish-npm
        with:
          dry-run: 'false'
          prerelease: 'false'

  release-ldcli-provenance:
    needs: ['release-please', 'release-ldcli']
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0
    with:
      base64-subjects: "${{ needs.release-ldcli.outputs.hashes }}"
      upload-assets: true
      upload-tag-name: ${{ needs.release-please.outputs.tag_name }}
      provenance-name: ${{ format('ldcli_{0}_multiple_provenance.intoto.jsonl', needs.release-please.outputs.tag_name) }}