publish-install-script.yml

name: Publish Install Scripts to R2

on:
  push:
    branches:
      - main
    paths:
      - 'install/bash/*.sh'
      - 'install/powershell/*.ps1'
  workflow_dispatch:

jobs:
  publish:
    name: Upload to Cloudflare R2
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Upload install scripts to R2
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
        run: |
          aws s3 cp install/bash/install.sh s3://${R2_BUCKET}/install/install.sh \
            --endpoint-url "${R2_ENDPOINT}" \
            --content-type "text/plain"
          echo "✓ install.sh uploaded to R2"

          aws s3 cp install/bash/walkthrough.sh s3://${R2_BUCKET}/install/walkthrough.sh \
            --endpoint-url "${R2_ENDPOINT}" \
            --content-type "text/plain"
          echo "✓ walkthrough.sh uploaded to R2"

          aws s3 cp install/bash/examples.sh s3://${R2_BUCKET}/install/examples.sh \
            --endpoint-url "${R2_ENDPOINT}" \
            --content-type "text/plain"
          echo "✓ examples.sh uploaded to R2"

          aws s3 cp install/powershell/install.ps1 s3://${R2_BUCKET}/install/install.ps1 \
            --endpoint-url "${R2_ENDPOINT}" \
            --content-type "text/plain"
          echo "✓ install.ps1 uploaded to R2"

          aws s3 cp install/powershell/walkthrough.ps1 s3://${R2_BUCKET}/install/walkthrough.ps1 \
            --endpoint-url "${R2_ENDPOINT}" \
            --content-type "text/plain"
          echo "✓ walkthrough.ps1 uploaded to R2"

          aws s3 cp install/powershell/examples.ps1 s3://${R2_BUCKET}/install/examples.ps1 \
            --endpoint-url "${R2_ENDPOINT}" \
            --content-type "text/plain"
          echo "✓ examples.ps1 uploaded to R2"

  # End-of-run notices run in their own job: a failed Slack post fails only this
  # job, and "Re-run failed jobs" re-posts without uploading again.
  notify:
    name: Notify Slack
    needs: publish
    if: ${{ !cancelled() && vars.SLACK_CHANNEL_ID != '' }}
    runs-on: ubuntu-latest
    permissions: {}

    steps:
      - name: Short SHA
        run: echo "SHORT_SHA=${GITHUB_SHA:0:7}" >> "$GITHUB_ENV"

      - name: Notify Slack (failure)
        if: ${{ needs.publish.result == 'failure' }}
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
        with:
          method: chat.postMessage
          token: ${{ secrets.SLACK_BOT_TOKEN }}
          errors: true
          payload: |
            channel: ${{ vars.SLACK_CHANNEL_ID }}
            text: >-
              *Codeplain Client*: Install script deploy to R2 FAILED :x: (`${{ env.SHORT_SHA }}`).
              Users may be getting a stale installer.
              See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.

      - name: Notify Slack (success)
        if: ${{ needs.publish.result == 'success' }}
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
        with:
          method: chat.postMessage
          token: ${{ secrets.SLACK_BOT_TOKEN }}
          errors: true
          payload: |
            channel: ${{ vars.SLACK_CHANNEL_ID }}
            text: >-
              *Codeplain Client*: Install scripts deployed to R2 :white_check_mark:
              (`${{ env.SHORT_SHA }}`, by *${{ github.actor }}*).