release.yml

name: Release Gem + Sync Terraform Provider

# Pushing a v* tag releases it. Only admins can push v* tags (the "Release tags: admins only" ruleset), and the
# publishing jobs run in the release environment, which needs an approval. Publishing jobs don't run the
# repository's code: they get the built gem and the provider changes from the jobs before them.
on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Dry run (no pushes/tags/uploads)'
        required: false
        default: 'false'
        type: choice
        options: ['false', 'true']

permissions:
  contents: read

env:
  DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run == 'true' && 'true' || 'false' }}
  # Empty when a dry run is dispatched from a branch
  TAG_NAME: ${{ github.ref_type == 'tag' && github.ref_name || '' }}

# Not ubuntu-latest: it's moving to Ubuntu 26.04, and ruby/setup-ruby only has the newest Ruby patch releases for it
jobs:
  # Every other job needs this one, so a tag that doesn't match version.rb publishes nothing
  wait_ci:
    name: Validate the tag and wait for CI success
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      actions: read # to read the CI runs for the tagged commit
    outputs:
      version: ${{ steps.ver.outputs.version_tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Determine version and validate tag
        id: ver
        shell: bash
        run: |
          TAG="$TAG_NAME"
          if [[ -z "$TAG" ]]; then
            TAG="v0.0.0-dryrun"
            echo "DRY-RUN: Using placeholder tag $TAG" >&2
          fi
          VERSION_FROM_TAG="${TAG#v}"
          VERSION_RB=$(sed -n 's/^ *VERSION *= *"\([^"]*\)".*/\1/p' lib/log_struct/version.rb)
          echo "version_tag=$VERSION_FROM_TAG" >> "$GITHUB_OUTPUT"
          echo "Resolved tag: $TAG (version $VERSION_FROM_TAG); code version: $VERSION_RB"
          if [[ -z "$VERSION_RB" ]]; then
            echo "::error::Couldn't read VERSION from lib/log_struct/version.rb."
            exit 1
          fi
          if [[ "$DRY_RUN" != "true" && "$VERSION_FROM_TAG" != "$VERSION_RB" ]]; then
            echo "::error::Tag version ($VERSION_FROM_TAG) does not match lib/log_struct/version.rb ($VERSION_RB). Update version.rb before tagging, or run as dry-run."
            exit 1
          fi

      - name: Wait for CI workflow
        env:
          GH_TOKEN: ${{ github.token }}
          SHA: ${{ github.sha }}
        shell: bash
        run: |
          if [[ "$DRY_RUN" == "true" ]]; then
            echo "Dry run: skipping CI wait."
            exit 0
          fi
          if [[ -z "$TAG_NAME" ]]; then
            echo "::error::Releases run from a v* tag. Push the tag, or dispatch a dry run."
            exit 1
          fi
          echo "Waiting for CI to succeed for $SHA ..."
          ATTEMPTS=120
          SLEEP=10
          for i in $(seq 1 $ATTEMPTS); do
            RESP=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs?per_page=50&head_sha=$SHA")
            STATUS=$(echo "$RESP" | jq -r '.workflow_runs[] | select(.name=="CI") | .status' | head -n1)
            CONCLUSION=$(echo "$RESP" | jq -r '.workflow_runs[] | select(.name=="CI") | .conclusion' | head -n1)
            if [[ "$STATUS" == "completed" ]]; then
              if [[ "$CONCLUSION" == "success" ]]; then
                echo "CI succeeded."
                exit 0
              else
                echo "CI completed with conclusion: $CONCLUSION"
                exit 1
              fi
            fi
            echo "CI status: ${STATUS:-not found}; waiting... ($i/$ATTEMPTS)"
            sleep $SLEEP
          done
          echo "Timed out waiting for CI to complete."
          exit 1

  gem:
    name: Build RubyGem
    needs: wait_ci
    runs-on: ubuntu-24.04
    outputs:
      gem_file: ${{ steps.build.outputs.gem_file }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      # No bundler cache in release jobs: a cache is shared with other runs, and gem build needs no bundle
      - name: Setup Ruby
        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
        with:
          ruby-version: '.ruby-version'

      - name: Build gem
        id: build
        env:
          VERSION: ${{ needs.wait_ci.outputs.version }}
        run: |
          gem build logstruct.gemspec
          ls -la ./*.gem
          GEM_FILE="logstruct-${VERSION}.gem"
          ALT_GEM_FILE="logstruct-${VERSION/-/.pre.}.gem"
          if [[ -f "$GEM_FILE" ]]; then
            echo "Using gem file: $GEM_FILE"
          elif [[ -f "$ALT_GEM_FILE" ]]; then
            echo "Using gem file: $ALT_GEM_FILE (RubyGems prerelease normalization)"
            GEM_FILE="$ALT_GEM_FILE"
          elif [[ "$DRY_RUN" == "true" ]]; then
            GEM_FILE=$(find . -maxdepth 1 -name 'logstruct-*.gem' -printf '%f\n' | head -n1)
            echo "DRY-RUN: using $GEM_FILE"
          else
            echo "::error::Expected gem file for version $VERSION not found."
            exit 1
          fi
          echo "gem_file=$GEM_FILE" >> "$GITHUB_OUTPUT"

      - name: Upload the gem
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: gem
          path: ${{ steps.build.outputs.gem_file }}
          if-no-files-found: error
          retention-days: 5

      - name: Gem publish (dry-run)
        if: env.DRY_RUN == 'true'
        env:
          GEM_FILE: ${{ steps.build.outputs.gem_file }}
        run: echo "[DRY-RUN] Would push gem $GEM_FILE to RubyGems"

  publish_gem:
    name: Publish RubyGem
    needs: gem
    if: github.event_name == 'push' || inputs.dry_run != 'true'
    runs-on: ubuntu-24.04
    environment: release
    permissions:
      contents: read
      id-token: write # RubyGems trusted publishing: exchanges this job's OIDC token for a short-lived API key
    steps:
      - name: Download the gem
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: gem

      - name: Setup Ruby
        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
        with:
          ruby-version: ruby

      - name: Configure RubyGems credentials (trusted publishing)
        uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a # v2.1.0

      - name: Publish gem to RubyGems
        env:
          GEM_FILE: ${{ needs.gem.outputs.gem_file }}
        run: gem push "$GEM_FILE"

  provider:
    name: Build Terraform provider catalog
    needs: wait_ci
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      # No bundler cache in release jobs: a cache is shared with other runs
      - name: Setup Ruby
        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
        with:
          ruby-version: '.ruby-version'

      - name: Install gems
        run: bundle install

      - name: Generate docs exports (enums/structs/keys)
        run: scripts/generate_structs.rb

      # A public repository: cloning it needs no token
      - name: Clone terraform-provider-logstruct repository
        run: |
          rm -rf terraform-provider-logstruct
          git clone https://github.com/DocSpring/terraform-provider-logstruct.git terraform-provider-logstruct

      - name: Export provider catalog (embedded Go data)
        run: ruby scripts/export_provider_catalog.rb

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '1.22'
          cache: false

      - name: Compile
        run: |
          cd terraform-provider-logstruct
          go mod tidy
          go build ./...

      - name: Save the provider changes
        run: |
          cd terraform-provider-logstruct
          git add pkg/data/catalog_gen.go pkg/data/catalog.json go.mod go.sum || true
          git diff --cached --binary > ../provider-changes.patch
          if [[ -s ../provider-changes.patch ]]; then
            git --no-pager diff --cached --stat
          else
            echo "No provider changes to commit."
          fi
          if [[ "$DRY_RUN" == "true" ]]; then
            echo "[DRY-RUN] Would commit, push and tag the provider"
          fi

      - name: Upload the provider changes
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: provider-changes
          path: provider-changes.patch
          if-no-files-found: error
          retention-days: 5

  publish_provider:
    name: Push + Tag Provider
    needs: provider
    if: github.event_name == 'push' || inputs.dry_run != 'true'
    runs-on: ubuntu-24.04
    environment: release
    steps:
      - name: Download the provider changes
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: provider-changes

      - name: Commit, push and tag the provider
        env:
          # A deploy key with write access to terraform-provider-logstruct only. Deploy keys don't expire: the PAT
          # this replaced had expired by the 0.2.0 release.
          DEPLOY_KEY: ${{ secrets.TF_PROVIDER_DEPLOY_KEY }}
        run: |
          if [[ -z "$DEPLOY_KEY" ]]; then
            echo "::error::TF_PROVIDER_DEPLOY_KEY isn't set in the release environment."
            exit 1
          fi
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/provider_deploy_key
          chmod 600 ~/.ssh/provider_deploy_key
          # GitHub's published host keys, so the key is only ever offered to github.com
          curl -fsS https://api.github.com/meta | jq -r '.ssh_keys[] | "github.com " + .' > ~/.ssh/github_known_hosts
          export GIT_SSH_COMMAND="ssh -i $HOME/.ssh/provider_deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/github_known_hosts"
          REMOTE=git@github.com:DocSpring/terraform-provider-logstruct.git
          # Stop before changing anything if GitHub doesn't accept the key
          if ! git ls-remote "$REMOTE" HEAD >/dev/null; then
            echo "::error::GitHub didn't accept TF_PROVIDER_DEPLOY_KEY for terraform-provider-logstruct: check the repo's deploy key (with write access) matches the secret."
            exit 1
          fi
          git config --global user.name "DocSpring Bot"
          git config --global user.email "docspring-bot@docspring.com"
          git clone "$REMOTE" terraform-provider-logstruct
          cd terraform-provider-logstruct
          if [[ -s ../provider-changes.patch ]]; then
            git apply --index ../provider-changes.patch
            git commit -m "Sync catalog from logstruct $TAG_NAME"
            git push origin HEAD:main
          else
            echo "No provider changes to commit."
          fi
          if git rev-parse -q --verify "refs/tags/$TAG_NAME" >/dev/null; then
            echo "Tag $TAG_NAME already exists; skipping."
            exit 0
          fi
          git tag -a "$TAG_NAME" -m "Release $TAG_NAME (logstruct sync)"
          git push origin "$TAG_NAME"