release.yml

name: Release

on: workflow_dispatch

env:
  AWS_REGION: us-east-2
  DOCKER_BUILDKIT: 1
  DOCKER_CACHE_PATH: ${{ github.workspace }}/tmp/docker-cache

permissions:
  id-token: write
  contents: read
  actions: read

jobs:
  release:
    name: Release
    runs-on: ubuntu-20.04
    needs: []
    steps:
      - name: Checkout
        # A GitHub Action to checkout a repository.
        # https://github.com/actions/checkout
        uses: actions/checkout@v4
        with:
           token: ${{ secrets.GITHUB_TOKEN }}
           persist-credentials: false

      - name: Inject slug/short variables
        # A GitHub Action to expose the slug values of some GitHub ENV variables
        # https://github.com/rlespinasse/github-slug-action
        uses: rlespinasse/github-slug-action@v3.x

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.DEPLOYER_PRODUCTION_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Create release
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: scribd/semantic-release
        run: |
          docker pull $ECR_REGISTRY/$ECR_REPOSITORY:latest
          docker run --rm \
            -v ${{ github.workspace }}:/src \
            -w /src \
            -e CI=true \
            -e GITHUB_ACTIONS=true \
            -e GITHUB_TOKEN=${{ secrets.SCRIBD_GITHUB_RELEASE_TOKEN }} \
            -e GITHUB_REPOSITORY=${{ github.repository }} \
            -e GITHUB_WORKSPACE=${{ github.workspace }} \
            -e GITHUB_SHA=${{ github.sha }} \
            -e GITHUB_REF=${{ github.ref }} \
            $ECR_REGISTRY/$ECR_REPOSITORY:latest --publish

      - name: Logout of Amazon ECR
        if: always()
        run: docker logout ${{ steps.login-ecr.outputs.registry }}

      - name: Send Slack notification
        if: always()
        uses: scribd/job-notification@v1.3.0
        with:
          token: ${{ secrets.SCRIBD_SLACK_GENERIC_TOKEN_PUBLIC }}
          channel: service-foundations-release