build_and_release_registry.yaml

name: "Build And Release Registry"

on:
  push:
    branches-ignore:
      - "**"
    tags:
      - v*

concurrency:
  group: build-and-release-registry-${{ github.event.repository.name }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

env:
  disable_action: ${{ secrets.DISABLE_ACTION }}
  registry_name: ${{ secrets.HEX_REGISTRY_NAME || 'artifix' }}
  auth_keys_str: ${{ secrets.HEX_REGISTRY_AUTH_KEYS || '' }}

jobs:
  apply-terraform:
    runs-on: ubuntu-latest
    steps:
      - name: Git clone the repository
        if: ${{ env.disable_action != 'YES' }}
        uses: actions/checkout@v4
      - name: Install terraform
        if: ${{ env.disable_action != 'YES' }}
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.10.4
      - name: Configure AWS Credentials
        if: ${{ env.disable_action != 'YES' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ secrets.AWS_IAM_ROLE_ARN }}
      - name: Terraform Init
        if: ${{ env.disable_action != 'YES' }}
        id: init
        shell: sh
        run: |
          terraform init \
            -backend-config="region=${{ secrets.TERRAFORM_BACKEND_S3_REGION }}" \
            -backend-config="bucket=${{ secrets.TERRAFORM_BACKEND_S3_BUCKET }}" \
            -backend-config="key=${{ secrets.TERRAFORM_BACKEND_S3_KEY }}"
        working-directory: terraform
      - name: Terraform Format
        if: ${{ env.disable_action != 'YES' }}
        id: fmt
        shell: sh
        run: terraform fmt -check
        working-directory: terraform
      - name: Terraform Validate
        if: ${{ env.disable_action != 'YES' }}
        id: validate
        shell: sh
        run: terraform validate -no-color
        working-directory: terraform
      - name: Terraform Apply
        if: ${{ env.disable_action != 'YES' }}
        id: apply
        shell: sh
        working-directory: terraform
        run: |
          terraform apply \
            -var-file=../vars.tfvars \
            -var="auth_keys_str=${{ env.auth_keys_str }}" \
            -no-color \
            -auto-approve \
            -input=false
      - name: Set up Elixir
        if: ${{ env.disable_action != 'YES' }}
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
  discover-packages:
    runs-on: ubuntu-latest
    outputs:
      package_dirs: ${{ steps.get-dirs.outputs.dirs }}
      has_packages: ${{ steps.get-dirs.outputs.has_packages }}
    steps:
      - name: Git clone the repository
        uses: actions/checkout@v4
      # Get directories and remove the "packages/" prefix for cleaner job names
      - name: Get all package directories
        id: get-dirs
        shell: bash
        run: |
          if [ ! -d "packages" ]; then
            echo "packages directory not found, creating it"
            mkdir -p packages
          fi

          PACKAGE_COUNT=$(find packages -mindepth 1 -maxdepth 1 -type d | wc -l)

          if [ "$PACKAGE_COUNT" -gt 0 ]; then
            echo "Found packages"
            DIRS=$(find packages -mindepth 1 -maxdepth 1 -type d | sed 's/packages\///' | jq -R -s -c 'split("\n")[:-1]')
            HAS_PACKAGES='true'
          else
            echo "No packages found"
            DIRS='[]'
            HAS_PACKAGES='false'
          fi

          echo "has_packages=$HAS_PACKAGES" >> $GITHUB_OUTPUT
          echo "dirs=$DIRS" >> $GITHUB_OUTPUT
          echo "Has packages? $(echo $HAS_PACKAGES)"
          echo "Found directories: $(echo $DIRS)"
  no-packages-found:
    needs: [discover-packages]
    if: needs.discover-packages.outputs.has_packages == 'false'
    runs-on: ubuntu-latest
    steps:
      - name: No packages found
        run: |
          echo "No packages found in the packages directory."
          echo "Tests were skipped as there is nothing to test."
  build-registry-tarballs:
    needs: [discover-packages]
    runs-on: ubuntu-latest
    if: needs.discover-packages.outputs.has_packages == 'true'
    strategy:
      fail-fast: false
      max-parallel: 10
      matrix:
        package: ${{ fromJson(needs.discover-packages.outputs.package_dirs) }}
    steps:
      - name: Git clone the repository
        uses: actions/checkout@v4
      - name: Set up Elixir
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
      - name: Build Package for Hex
        working-directory: packages/${{ matrix.package }}
        run: mix hex.build
      - name: Upload Tarball Artifact
        uses: actions/upload-artifact@v4
        with:
          name: build-${{ github.sha }}-${{ matrix.package }}
          path: packages/${{ matrix.package }}/${{ matrix.package }}-*.tar
          if-no-files-found: error
  build-registry:
    needs: [build-registry-tarballs]
    runs-on: ubuntu-latest
    steps:
      - name: Git clone the repository
        uses: actions/checkout@v4
      - name: Set up Elixir
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict
      - name: Install terraform
        if: ${{ env.disable_action != 'YES' }}
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.10.4
      - name: Configure AWS Credentials
        if: ${{ env.disable_action != 'YES' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ secrets.AWS_IAM_ROLE_ARN }}
      - name: Create public directory
        run: mkdir -p public
      - name: Terraform Init
        if: ${{ env.disable_action != 'YES' }}
        working-directory: terraform
        id: init
        shell: sh
        run: |
          terraform init \
            -backend-config="region=${{ secrets.TERRAFORM_BACKEND_S3_REGION }}" \
            -backend-config="bucket=${{ secrets.TERRAFORM_BACKEND_S3_BUCKET }}" \
            -backend-config="key=${{ secrets.TERRAFORM_BACKEND_S3_KEY }}"
      - name: Terraform Refresh
        if: ${{ env.disable_action != 'YES' }}
        working-directory: terraform
        id: refresh
        shell: sh
        run: |
          terraform refresh \
            -var-file=../vars.tfvars \
            -var="auth_keys_str=${{ env.auth_keys_str }}" \
            -input=false
      - name: Sync from AWS Bucket
        working-directory: terraform
        if: ${{ env.disable_action != 'YES' }}
        run: aws s3 sync s3://$(terraform output -raw s3_registry_bucket_name) ../public/
      - name: Create private key file
        run: |
          echo "${{ secrets.HEX_REGISTRY_PRIVATE_KEY }}" > private_key.pem
          chmod 600 private_key.pem
      - name: Build Initial Registry
        run: mix hex.registry build public --name=${{ env.registry_name }} --private-key=private_key.pem
      - name: Download all built tarball artifacts
        uses: actions/download-artifact@v4
        with:
          path: public/tarballs
          pattern: build-${{ github.sha }}-*
          merge-multiple: true
      - name: Build Registry With Packages
        run: mix hex.registry build public --name=${{ env.registry_name }} --private-key=private_key.pem
      - name: Upload Tarball Artifact
        uses: actions/upload-artifact@v4
        with:
          name: registry-${{ github.sha }}
          path: public
          if-no-files-found: error
  upload-registry:
    needs: [apply-terraform, build-registry]
    runs-on: ubuntu-latest
    steps:
      - name: Git clone the repository
        uses: actions/checkout@v4
      - name: Install terraform
        if: ${{ env.disable_action != 'YES' }}
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.10.4
      - name: Download Built Registry
        uses: actions/download-artifact@v4
        with:
          path: public
          name: registry-${{ github.sha }}
      - name: Configure AWS Credentials
        if: ${{ env.disable_action != 'YES' }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ secrets.AWS_IAM_ROLE_ARN }}
      - name: Terraform Init
        if: ${{ env.disable_action != 'YES' }}
        working-directory: terraform
        id: init
        shell: sh
        run: |
          terraform init \
            -backend-config="region=${{ secrets.TERRAFORM_BACKEND_S3_REGION }}" \
            -backend-config="bucket=${{ secrets.TERRAFORM_BACKEND_S3_BUCKET }}" \
            -backend-config="key=${{ secrets.TERRAFORM_BACKEND_S3_KEY }}"
      - name: Terraform Refresh
        if: ${{ env.disable_action != 'YES' }}
        working-directory: terraform
        id: refresh
        shell: sh
        run: |
          terraform refresh \
            -var-file=../vars.tfvars \
            -var="auth_keys_str=${{ env.auth_keys_str }}" \
            -input=false
      - name: Sync to AWS Bucket
        working-directory: terraform
        if: ${{ env.disable_action != 'YES' }}
        run: aws s3 sync ../public s3://$(terraform output -raw s3_registry_bucket_name)
      - name: Invalidate Cache in CloudFront
        working-directory: terraform
        if: ${{ env.disable_action != 'YES' }}
        run: |
          cdn_id=$(terraform output -raw cloudfront_distribution_id)
          echo "Invalidating The $cdn_id CDN"
          invalidation_id=$(aws cloudfront create-invalidation --distribution-id $cdn_id --paths '/*' | jq -r '.Invalidation.Id')
          echo "Waiting For The $invalidation_id Invalidation To Complete For The $cdn_id CDN"
          aws cloudfront wait invalidation-completed --id $invalidation_id --distribution-id $cdn_id && echo "Invalidation $invalidation_id Completed For The $cdn_id CDN"