netboot.xyz/.github/workflows/release.yml

name: release

on:
  push:
    branches:
      - master

env:
  DISCORD_HOOK_URL: ${{ secrets.DISCORD_HOOK_URL }}
  GITHUB_SHA: ${{ github.sha }}

jobs:
  release:
    name: Build Release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    steps:
    - uses: actions/checkout@v4
      with:
        ref: master

    - name: Retrieve Certs
      run: |
        ./script/retrieve_certs
      env:
        GIT_USER: ${{ secrets.GIT_USER }}
        GIT_AUTH: ${{ secrets.GIT_AUTH }}
        GIT_URL: ${{ secrets.GIT_URL }}
        CERTS_KEY: ${{ secrets.CERTS_KEY }}

    - name: Set Release Tag
      run: echo "release_tag=$(cat version.txt)" >> $GITHUB_ENV

    - name: Build release
      run: |
        ./script/build_release release

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ secrets.AWS_ROLE_PROD }}
        aws-region: ${{ secrets.AWS_ACCESS_REGION }}

    - name: Deploy master to release bucket
      run: |
        aws s3 sync --no-progress --acl public-read s3out s3://${{ secrets.AWS_S3_BUCKET_PROD }}/${{ env.release_tag }}

    - name: Deploy master to rolling bucket
      run: |
        aws s3 sync --no-progress --acl public-read s3out-latest s3://${{ secrets.AWS_S3_BUCKET_PROD }}

    - name: Invalidate Cloudfront
      run: |
        aws cloudfront create-invalidation --distribution-id ${{ secrets.CLOUDFRONT_DIST_ID_PROD }} --paths "/*" "/ipxe/*" "/sigs/*"

    - name: Tag Release
      run: |
        ./script/tag ${{ env.release_tag }}

    - name: Extract release notes
      id: extract-release-notes
      uses: ffurrer2/extract-release-notes@v2

    - name: Create Release and Upload Assets
      uses: svenstaro/upload-release-action@v2
      with:
        file: githubout/*
        file_glob: true
        overwrite: true
        prerelease: false
        release_name: ${{ env.release_tag }}
        repo_token: ${{ secrets.GITHUB_TOKEN }}
        tag: ${{ env.release_tag }}
        body: ${{ steps.extract-release-notes.outputs.release_notes }}

    - name: Notify Discord on failure
      if: failure()
      run: |
        ./script/message failure

    - name: Notify Discord on completion
      if: success()
      run: |
        ./script/message live-push