netboot.xyz/.github/workflows/release-candidate.yml

name: release-candidate

on:
  push:
    branches:
      - RC
  workflow_dispatch:

env:
  DISCORD_HOOK_URL: ${{ secrets.DISCORD_HOOK_URL }}
  GITHUB_SHA: ${{ github.sha }}

jobs:
  rc-build:
    name: Build Release Candidate
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    steps:
    - uses: actions/checkout@v4
      with:
        ref: RC

    - name: Retrieve Certs
      run: |
        ./script/retrieve_certs
      env:
        GIT_USER: ${{ secrets.GIT_USER }}
        GIT_AUTH: ${{ secrets.GIT_AUTH }}
        GIT_URL: ${{ secrets.GIT_URL }}
        CERTS_KEY: ${{ secrets.CERTS_KEY }}

    - name: Set Release Tag
      run: echo "release_tag=$(cat version.txt)-RC" >> $GITHUB_ENV

    - name: Build RC release
      run: |
        ./script/build_release rc

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ secrets.AWS_ROLE_STAGING }}
        aws-region: ${{ secrets.AWS_ACCESS_REGION }}

    - name: Deploy RC to release-candidate bucket
      run: |
        aws s3 sync --no-progress --acl public-read s3out s3://${{ secrets.AWS_S3_BUCKET_STAGING }}/${{ env.release_tag }}

    - name: Deploy RC to rolling bucket
      run: |
        aws s3 sync --no-progress --acl public-read s3out-latest s3://${{ secrets.AWS_S3_BUCKET_STAGING }}/rc

    - name: Deploy RC version file
      run: |
        aws s3 sync --no-progress --acl public-read s3outver s3://${{ secrets.AWS_S3_BUCKET_STAGING }}

    - name: Invalidate Cloudfront
      run: |
        aws cloudfront create-invalidation --distribution-id ${{ secrets.CLOUDFRONT_DIST_ID_STAGING }} --paths "/rc/*" "/rc/ipxe/*" "/rc/sigs/*"

    - name: Tag RC Release
      run: |
        ./script/tag ${{ env.release_tag }}

    - name: Extract release notes
      id: extract-release-notes
      uses: ffurrer2/extract-release-notes@v2

    - name: Create RC Release and Upload Assets
      uses: svenstaro/upload-release-action@v2
      with:
        file: githubout/*
        file_glob: true
        overwrite: true
        prerelease: true
        release_name: ${{ env.release_tag }}
        repo_token: ${{ secrets.GITHUB_TOKEN }}
        tag: ${{ env.release_tag }}
        body: ${{ steps.extract-release-notes.outputs.release_notes }}

    - name: Notify Discord on failure
      if: failure()
      run: |
        ./script/message failure

    - name: Notify Discord on completion
      if: success()
      run: |
        ./script/message rc-push