flow-deploy-release-artifact.yaml

##
# Copyright (C) 2023-2024 Hedera Hashgraph, LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
##

name: 'Deploy Release Artifact'
on:
  workflow_dispatch:
    inputs:
      dry-run-enabled:
        description: 'Perform Dry Run'
        type: boolean
        required: false
        default: false

defaults:
  run:
    shell: bash

permissions:
  id-token: write
  checks: write
  statuses: write
  pull-requests: write
  contents: write
  issues: write
  actions: read

jobs:
  prepare-release:
    name: Release / Prepare
    runs-on: hiero-cli-linux-medium
    outputs:
      version: ${{ steps.tag.outputs.version }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          token: ${{ secrets.GH_ACCESS_TOKEN }}
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20

      - name: Install Semantic Release
        run: |
          npm install -g semantic-release@21.0.7 @semantic-release/git@10.0.1 @semantic-release/exec@6.0.3 gradle-semantic-release-plugin@1.7.6
          npm install -g conventional-changelog-conventionalcommits@6.1.0 @commitlint/cli@17.6.6 @commitlint/config-conventional@17.6.6
          npm install -g marked-mangle@1.0.1 marked-gfm-heading-id@3.0.4 semantic-release-conventional-commits@3.0.0

      - name: Calculate Next Version
        env:
          GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
          GIT_AUTHOR_NAME: ${{ secrets.GIT_USER_NAME }}
          GIT_AUTHOR_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
          GIT_COMMITTER_NAME: ${{ secrets.GIT_USER_NAME }}
          GIT_COMMITTER_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
        run: npx semantic-release --dry-run

      - name: Extract Version
        id: tag
        run: |
          [[ "${{ github.event.inputs.dry-run-enabled }}" == true && ! -f VERSION ]] && echo -n "0.0.0-latest" > VERSION
          echo "version=$(cat VERSION | tr -d '[:space:]')" >> ${GITHUB_OUTPUT}

  safety-checks:
    name: Release
    uses: ./.github/workflows/zxc-compile-code.yaml
    with:
      custom-job-label: 'Safety Checks'
      enable-unit-tests: true
      enable-integration-tests: true
      enable-code-style-check: true
    secrets:
      integration-tests-network: ${{ secrets.INTEGRATION_TESTS_NETWORK }}
      integration-tests-operator-id: ${{ secrets.INTEGRATION_TESTS_OPERATOR_ID }}
      integration-tests-operator-key: ${{ secrets.INTEGRATION_TESTS_OPERATOR_KEY }}

  create-github-release:
    name: Github / Release
    runs-on: hiero-cli-linux-medium
    needs:
      - prepare-release
      - safety-checks
    outputs:
      npm-artifact-name: ${{ steps.set-publish-data.outputs.artifact-name }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          token: ${{ secrets.GH_ACCESS_TOKEN }}
          fetch-depth: 0

      - name: Install GnuPG Tools
        run: |
          if ! command -v gpg2 >/dev/null 2>&1; then
            echo "::group::Updating APT Repository Indices"
              sudo apt update
            echo "::endgroup::"
            echo "::group::Installing GnuPG Tools"
              sudo apt install -y gnupg2
            echo "::endgroup::"
          fi

      - name: Import GPG key
        id: gpg_key
        uses: step-security/ghaction-import-gpg@69c854a83c7f79463f8bdf46772ab09826c560cd # v6.3.1
        with:
          gpg_private_key: ${{ secrets.GPG_KEY_CONTENTS }}
          passphrase: ${{ secrets.GPG_KEY_PASSPHRASE }}
          git_config_global: true
          git_user_signingkey: true
          git_commit_gpgsign: true
          git_tag_gpgsign: false

      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20

      - name: Setup JQ
        uses: dcarbone/install-jq-action@b7ef57d46ece78760b4019dbc4080a1ba2a40b45 # v3.2.0
        with:
          version: 1.7

      - name: Setup JFrog CLI
        uses: jfrog/setup-jfrog-cli@c32bf10843e4071112c4ea3abf622d3b27cd8c17 # v4.7.0
        env:
          JF_URL: ${{ vars.JF_URL }}
          JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }}

      - name: Show JFrog Config
        run: jfrog config show

      - name: Verify JFrog Connectivity
        run: jfrog rt ping

      - name: Setup JFrog NPM Repository
        run: |
          jf npmc --server-id-resolve setup-jfrog-cli-server --server-id-deploy setup-jfrog-cli-server --repo-resolve hedera-cli-npm-release --repo-deploy hedera-cli-npm-release
          echo "::group::JFrog NPM Repository Configuration"
            cat .jfrog/projects/npm.yaml
          echo "::endgroup::"

      - name: Install Semantic Release
        run: |
          npm install -g semantic-release@21.0.7 @semantic-release/git@10.0.1 @semantic-release/exec@6.0.3 gradle-semantic-release-plugin@1.7.6
          npm install -g conventional-changelog-conventionalcommits@6.1.0 @commitlint/cli@17.6.6 @commitlint/config-conventional@17.6.6
          npm install -g marked-mangle@1.0.1 marked-gfm-heading-id@3.0.4 semantic-release-conventional-commits@3.0.0

      - name: Install Dependencies
        run: jf npm ci

      - name: Compile Code
        run: npm run build

      - name: GH Auth Status (with ENV)
        env:
          GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
          GIT_AUTHOR_NAME: ${{ secrets.GIT_USER_NAME }}
          GIT_AUTHOR_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
          GIT_COMMITTER_NAME: ${{ secrets.GIT_USER_NAME }}
          GIT_COMMITTER_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
        run: gh auth status

      - name: Publish Semantic Release
        env:
          GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
          GIT_AUTHOR_NAME: ${{ secrets.GIT_USER_NAME }}
          GIT_AUTHOR_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
          GIT_COMMITTER_NAME: ${{ secrets.GIT_USER_NAME }}
          GIT_COMMITTER_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
        if: ${{ github.event.inputs.dry-run-enabled != 'true' && !cancelled() && !failure() }}
        run:
          npx semantic-release

      - name: Update Version for Dry Run
        if: ${{ github.event.inputs.dry-run-enabled == 'true' }}
        run: |
          npm version ${{ needs.prepare-release.outputs.version }} --no-git-tag-version

      - name: Set Publish Data
        id: set-publish-data
        run: |
          VERSION=$(jq -r '.version' './package.json')
          CLI_NPM_PACKAGE_NAME="hiero-ledger-hiero-cli-${VERSION}.tgz"
          echo "artifact-name=${CLI_NPM_PACKAGE_NAME}" >> $GITHUB_OUTPUT

      # Needed since semantic release dry-run won't pack the tarball
      - name: Pack for Dry Run
        if: ${{ github.event.inputs.dry-run-enabled == 'true' }}
        run: |
          npm pack --pack-destination ./dist


      - name: Verify Release
        run: |
          echo "Expected package name: ${{ steps.set-publish-data.outputs.artifact-name }}"
          echo "Dist dir files:"
          ls -la ./dist

  #     # Upload the artifact
  #     - name: Upload Hiero CLI Package Artifact
  #       uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
  #       with:
  #         name: cli-npm-package
  #         path: ./dist/${{ steps.set-publish-data.outputs.artifact-name }}
  #         if-no-files-found: error

  #     - name: Deploy to JFrog Registry
  #       if: ${{ github.event.inputs.dry-run-enabled != 'true' && !cancelled() && !failure() }}
  #       run: jf npm publish

  # # Add a publishing job for Hiero CLI to npmjs
  # publish-npm-package:
  #   name: Publish Hiero CLI NPM Package
  #   runs-on: ubuntu-latest
  #   needs:
  #     - create-github-release
  #   steps:
  #     - name: Harden Runner
  #       uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
  #       with:
  #         egress-policy: audit

  #     - name: Checkout Code
  #       uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
  #       with:
  #         fetch-depth: 1

  #     - name: Setup Node
  #       uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
  #       with:
  #         node-version: 22
  #         registry-url: 'https://registry.npmjs.org'

  #     - name: Install NPM latest
  #       run: npm install -g npm@11.7.0

  #     - name: Download Hiero CLI NPM Package Artifact
  #       uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
  #       with:
  #         name: cli-npm-package

  #     - name: Publish Hiero CLI NPM Package
  #       run: |
  #         args="--access=public"
  #         if [[ "${{ inputs.dry-run-enabled }}" == "true" ]]; then
  #           args="${args} --dry-run"
  #         fi

  #         package="${{ needs.create-github-release.outputs.npm-artifact-name }}"
  #         echo "::group::Publishing package: ${package} with args: ${args}"
  #         npm publish ${package} ${args}
  #         echo "::endgroup::"