auto-release-on-master.yml

name: auto-release

on:
  workflow_dispatch: # to manually force a release on ignore paths
  push:
    branches:
      - master
    paths-ignore:
      - '.github/**'
      - .gitignore
      - CONTRIBUTING.md
      - README.md
      - renovate.json5
      - run-renovate-locally.bash

jobs:
  build:
    name: "ship it"
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          fetch-depth: 0

      - name: Bump version
        id: bump-version
        uses: ietf-tools/semver-action@2415a9e79db34eb828a8dc1d20d4890725737227 # v1
        with:
          token: ${{ github.token }}
          branch: master
          noVersionBumpBehavior: patch
          majorList: major

      # TODO: add caching for cli downloads, see https://github.com/marketplace/actions/cache
      - name: Install bosh-cli
        #See https://github.com/marketplace/actions/install-a-binary-from-github-releases
        uses: jaxxstorm/action-install-gh-release@25d5e2dd555cd74f1fab9ac1e6ea117acde2c0c4 # v1.12.0
        with:
          repo: cloudfoundry/bosh-cli
          tag: v7.7.0
          extension-matching: disable
          chmod: 0755
          rename-to: bosh

          # searching for bosh-cli-7.4.0-linux-amd64 with (linux|x86_64|x64|amd64).*(linux|x86_64|x64|amd64).*.(tar.gz|zip)
          #               bosh-cli-7.4.0-linux-amd64

      - name: Install vendir cli
        #See https://github.com/marketplace/actions/install-a-binary-from-github-releases
        uses: jaxxstorm/action-install-gh-release@25d5e2dd555cd74f1fab9ac1e6ea117acde2c0c4 # v1.12.0
        with:
          repo: carvel-dev/vendir
          tag: v0.42.0
          extension-matching: disable
          chmod: 0755
          rename-to: vendir

      - name: Install yq cli
        #See https://github.com/marketplace/actions/install-a-binary-from-github-releases
        uses: jaxxstorm/action-install-gh-release@25d5e2dd555cd74f1fab9ac1e6ea117acde2c0c4 # v1.12.0
        with:
          repo: mikefarah/yq
          tag: v4.44.3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # reduce potential rate limiting


      - name: vendor-add-blob
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AWS_BOSH_ACCES_KEY_ID: ${{ secrets.AWS_BOSH_ACCES_KEY_ID }}
          AWS_BOSH_SECRET_ACCES_KEY: ${{ secrets.AWS_BOSH_SECRET_ACCES_KEY }}
        run: |
          set -x # enable traces
          #pwd
          #find .
          # configure git
          git config --global user.name "workflows/k9s-package/create-final-bosh-release"
          git config --global user.email "<>"
          git config --global --add safe.directory /github/workspace
          export VENDIR_GITHUB_API_TOKEN="${GITHUB_TOKEN}"
          ./vendor.sh
          echo "State after vendir:"
          tree -s src
          git add vendir.lock
          # FIXME: optimize for idempotency 
          ./addblob.sh
          remote_repo="https://${GITHUB_ACTOR}:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git"
          
          git add config/blobs.yml
          git status
          if git commit -a --dry-run 2>&1 >/dev/null;then 
            git commit -a -m "updating blobs" && \
              git push ${remote_repo} HEAD:${GITHUB_REF_NAME}
          else
            echo "Nothing to commit"
          fi
          echo "Resulting State:" 
          tree -s src
          if [ -d blobs ];then # The blobs dir is only present when a blob is modified or has not yet been published.
            tree -s blobs
          fi

      - name: create bosh release
        id: create-bosh-release
        uses: orange-cloudfoundry/create-bosh-release-action@a2a9c1f8c74ecaf1e317140ac2cda5861eb25b7f # v1.0.4
        with:
          target_branch: ${{github.ref_name}}
          tag_name: ${{ steps.bump-version.outputs.nextStrict}}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AWS_BOSH_ACCES_KEY_ID: ${{ secrets.AWS_BOSH_ACCES_KEY_ID }}
          AWS_BOSH_SECRET_ACCES_KEY: ${{ secrets.AWS_BOSH_SECRET_ACCES_KEY }}

      # see https://github.com/ncipollo/release-action
      - name: create github release
        id: create-github-release
        uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0
        with:
          name: ${{ steps.bump-version.outputs.nextStrict }}
          tag: ${{ steps.create-bosh-release.outputs.tagged_version }}
          draft: false
          allowUpdates: false # > indicates if we should update a release if it already exists.
          generateReleaseNotes: true
          artifacts: ./${{ steps.create-bosh-release.outputs.file }}
          artifactContentType: application/zip
          artifactErrorsFailBuild: true # > indicates if artifact read or upload errors should fail the build.