release.yml

# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".

name: release
on:
  push:
    branches:
      - main
  workflow_dispatch: {}
concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false
jobs:
  release:
    runs-on: custom-linux-medium
    permissions:
      contents: write
    outputs:
      latest_commit: ${{ steps.git_remote.outputs.latest_commit }}
      tag_exists: ${{ steps.check_tag_exists.outputs.exists }}
    env:
      CI: "true"
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0
      - name: Set git config safe.directory
        run: git config --global --add safe.directory $(pwd)
      - name: Set git identity
        run: |-
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
      - name: Setup Node.js
        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
        with:
          node-version: 20.9.0
      - name: Install dependencies
        run: yarn install --check-files --frozen-lockfile
      - name: release
        run: npx projen release
      - name: Check if version has already been tagged
        id: check_tag_exists
        run: |-
          if [ ! -f dist/releasetag.txt ]; then (echo "exists=true" >> $GITHUB_OUTPUT) && exit 0; fi
          TAG=$(cat dist/releasetag.txt)
          ([ ! -z "$TAG" ] && git ls-remote -q --exit-code --tags origin $TAG && (echo "exists=true" >> $GITHUB_OUTPUT)) || (echo "exists=false" >> $GITHUB_OUTPUT)
          cat $GITHUB_OUTPUT
      - name: Check for new commits
        id: git_remote
        run: |-
          echo "latest_commit=$(git ls-remote origin -h ${{ github.ref }} | cut -f1)" >> $GITHUB_OUTPUT
          cat $GITHUB_OUTPUT
        shell: bash
      - name: Backup artifact permissions
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
      - name: Upload artifact
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: build-artifact
          path: dist
          overwrite: true
  deprecate:
    name: Deprecate the package in package managers if needed
    needs:
      - release
      - release_npm
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: Setup Node.js
        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
        with:
          node-version: 20.9.0
      - name: Install
        run: yarn install
      - name: Check deprecation status
        id: check_status
        run: |-
          IS_DEPRECATED=$(cat package.json | jq .cdktf.isDeprecated -r)
          echo "is_deprecated=$IS_DEPRECATED"
          echo "is_deprecated=$IS_DEPRECATED" >> $GITHUB_OUTPUT
      - name: Deprecate the package on NPM
        if: steps.check_status.outputs.is_deprecated == 'true' || steps.check_status.outputs.is_deprecated == true
        env:
          NPM_REGISTRY: registry.npmjs.org
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |-
          npm set "//$NPM_REGISTRY/:_authToken=$NPM_TOKEN"
          npm deprecate @cdktf/provider-aws "See https://cdk.tf/imports for details on how to continue to use the aws provider in your CDK for Terraform (CDKTF) projects by generating the bindings locally."
  release_github:
    name: Publish to GitHub Releases
    needs: release
    runs-on: custom-linux-medium
    permissions:
      contents: write
      issues: write
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
        with:
          node-version: 20.9.0
      - name: Download build artifacts
        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
        with:
          name: build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_SHA 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
      - name: Extract Version
        id: extract-version
        if: ${{ failure() }}
        run: echo "VERSION=$(cat dist/version.txt)" >> $GITHUB_OUTPUT
        shell: bash
      - name: Create Issue
        if: ${{ failure() }}
        uses: imjohnbo/issue-bot@572eed14422c4d6ca37e870f97e7da209422f5bd
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          labels: failed-release
          title: Publishing v${{ steps.extract-version.outputs.VERSION }} to GitHub Releases failed
          body: See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
  release_npm:
    name: Publish to npm
    needs: release
    runs-on: custom-linux-medium
    permissions:
      contents: read
      issues: write
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
        with:
          node-version: 20.9.0
      - name: Download build artifacts
        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
        with:
          name: build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create js artifact
        run: cd .repo && npx projen package:js
      - name: Collect js artifact
        run: mv .repo/dist dist
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx -p publib@latest publib-npm
      - name: Extract Version
        id: extract-version
        if: ${{ failure() }}
        run: echo "VERSION=$(cat dist/version.txt)" >> $GITHUB_OUTPUT
        shell: bash
      - name: Create Issue
        if: ${{ failure() }}
        uses: imjohnbo/issue-bot@572eed14422c4d6ca37e870f97e7da209422f5bd
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          labels: failed-release
          title: Publishing v${{ steps.extract-version.outputs.VERSION }} to npm failed
          body: See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
  release_maven:
    name: Publish to Maven Central
    needs: release
    runs-on: custom-linux-medium
    permissions:
      contents: read
      issues: write
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12
        with:
          distribution: corretto
          java-version: "11"
      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
        with:
          node-version: 20.9.0
      - name: Download build artifacts
        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
        with:
          name: build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create java artifact
        run: cd .repo && npx projen package:java
      - name: Collect java artifact
        run: mv .repo/dist dist
      - name: Release
        env:
          MAVEN_ENDPOINT: https://hashicorp.oss.sonatype.org
          MAVEN_GPG_PRIVATE_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          MAVEN_GPG_PRIVATE_KEY_PASSPHRASE: ${{ secrets.MAVEN_GPG_PRIVATE_KEY_PASSPHRASE }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
          MAVEN_STAGING_PROFILE_ID: ${{ secrets.MAVEN_STAGING_PROFILE_ID }}
          MAVEN_OPTS: --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.text=ALL-UNNAMED --add-opens=java.desktop/java.awt.font=ALL-UNNAMED
        run: npx -p publib@latest publib-maven
      - name: Extract Version
        id: extract-version
        if: ${{ failure() }}
        run: echo "VERSION=$(cat dist/version.txt)" >> $GITHUB_OUTPUT
        shell: bash
      - name: Create Issue
        if: ${{ failure() }}
        uses: imjohnbo/issue-bot@572eed14422c4d6ca37e870f97e7da209422f5bd
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          labels: failed-release
          title: Publishing v${{ steps.extract-version.outputs.VERSION }} to Maven Central failed
          body: See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
  release_pypi:
    name: Publish to PyPI
    needs: release
    runs-on: custom-linux-medium
    permissions:
      contents: read
      issues: write
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
        with:
          node-version: 20.9.0
      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38
        with:
          python-version: 3.x
      - name: Download build artifacts
        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
        with:
          name: build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create python artifact
        run: cd .repo && npx projen package:python
      - name: Collect python artifact
        run: mv .repo/dist dist
      - name: Release
        env:
          TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }}
          TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
        run: npx -p publib@latest publib-pypi
      - name: Extract Version
        id: extract-version
        if: ${{ failure() }}
        run: echo "VERSION=$(cat dist/version.txt)" >> $GITHUB_OUTPUT
        shell: bash
      - name: Create Issue
        if: ${{ failure() }}
        uses: imjohnbo/issue-bot@572eed14422c4d6ca37e870f97e7da209422f5bd
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          labels: failed-release
          title: Publishing v${{ steps.extract-version.outputs.VERSION }} to PyPI failed
          body: See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
  release_nuget:
    name: Publish to NuGet Gallery
    needs: release
    runs-on: custom-linux-medium
    permissions:
      contents: read
      issues: write
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
        with:
          node-version: 20.9.0
      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9
        with:
          dotnet-version: 6.x
      - name: Download build artifacts
        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
        with:
          name: build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create dotnet artifact
        run: cd .repo && npx projen package:dotnet
      - name: Collect dotnet artifact
        run: mv .repo/dist dist
      - name: Release
        env:
          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
        run: npx -p publib@latest publib-nuget
      - name: Extract Version
        id: extract-version
        if: ${{ failure() }}
        run: echo "VERSION=$(cat dist/version.txt)" >> $GITHUB_OUTPUT
        shell: bash
      - name: Create Issue
        if: ${{ failure() }}
        uses: imjohnbo/issue-bot@572eed14422c4d6ca37e870f97e7da209422f5bd
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          labels: failed-release
          title: Publishing v${{ steps.extract-version.outputs.VERSION }} to NuGet Gallery failed
          body: See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
  release_golang:
    name: Publish to GitHub Go Module Repository
    needs: release
    runs-on: custom-linux-medium
    permissions:
      contents: read
      issues: write
    if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
    steps:
      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
        with:
          node-version: 20.9.0
      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b
        with:
          go-version: ^1.18.0
      - name: Download build artifacts
        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
        with:
          name: build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create go artifact
        run: cd .repo && npx projen package:go
      - name: Setup Copywrite tool
        uses: hashicorp/setup-copywrite@32638da2d4e81d56a0764aa1547882fc4d209636
      - name: Copy copywrite hcl file
        run: cp .repo/.copywrite.hcl .repo/dist/go/.copywrite.hcl
      - name: Add headers using Copywrite tool
        run: cd .repo/dist/go && copywrite headers
      - name: Remove copywrite hcl file
        run: rm -f .repo/dist/go/.copywrite.hcl
      - name: Remove some text from the README that doesn't apply to Go
        run: |-
          sed -i 's/# CDKTF prebuilt bindings for/# CDKTF Go bindings for/' .repo/dist/go/*/README.md
          sed -i -e '/## Deprecated Packages/,/### Go/!b' -e '/### Go/!d;p; s/### Go/## Go Package/' -e 'd' .repo/dist/go/*/README.md
          sed -i 's/### Go/## Deprecated Package/' .repo/dist/go/*/README.md
          sed -i -e '/API.typescript.md/,/You can also visit a hosted version/!b' -e 'd' .repo/dist/go/*/README.md
          sed -i 's|Find auto-generated docs for this provider here:|Find auto-generated docs for this provider [here](https://github.com/cdktf/cdktf-provider-aws/blob/main/docs/API.go.md).|' .repo/dist/go/*/README.md
          sed -i -e '/### Provider Version/,/The provider version can be adjusted/!b' -e 'd' .repo/dist/go/*/README.md
      - name: Copy the README file to the parent directory
        run: cp .repo/dist/go/*/README.md .repo/dist/go/README.md
      - name: Mark the Go module as deprecated
        run: "find '.repo/dist/go' -mindepth 2 -maxdepth 4 -type f -name 'go.mod' | xargs sed -i '1s|^|// Deprecated: HashiCorp is no longer publishing new versions of the prebuilt provider for aws.\\n// Previously-published versions of this prebuilt provider will still continue to be available as installable Go modules,\\n// but these will not be compatible with newer versions of CDK for Terraform and are not eligible for commercial support.\\n// You can continue to use the aws provider in your CDK for Terraform projects with newer versions of CDKTF,\\n// but you will need to generate the bindings locally. See https://cdk.tf/imports for details.\\n|'"
      - name: Collect go Artifact
        run: mv .repo/dist dist
      - name: Release
        env:
          GIT_USER_NAME: CDK for Terraform Team
          GIT_USER_EMAIL: github-team-tf-cdk@hashicorp.com
          GITHUB_TOKEN: ${{ secrets.GO_GITHUB_TOKEN }}
        run: npx -p publib@latest publib-golang
      - name: Extract Version
        id: extract-version
        if: ${{ failure() }}
        run: echo "VERSION=$(cat dist/version.txt)" >> $GITHUB_OUTPUT
        shell: bash
      - name: Create Issue
        if: ${{ failure() }}
        uses: imjohnbo/issue-bot@572eed14422c4d6ca37e870f97e7da209422f5bd
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          labels: failed-release
          title: Publishing v${{ steps.extract-version.outputs.VERSION }} to GitHub Go Module Repository failed
          body: See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}