diff --git a/.github/workflows/production-tag.yml b/.github/workflows/production-tag.yml new file mode 100644 index 000000000..0777459a6 --- /dev/null +++ b/.github/workflows/production-tag.yml @@ -0,0 +1,129 @@ +name: Create Production Tag + +on: + workflow_dispatch: + pull_request: + workflow_run: + workflows: ['Continuous Integration'] + types: [completed] + branches: [main] + +concurrency: + group: production-tag + cancel-in-progress: true + +env: + SLACK_CHANNEL: C06DSBT7CBW #status-next-build + DSVA_SCHEDULE_ENABLED: true + +jobs: + create-production-tag: + name: Create Production Tag + runs-on: ubuntu-latest + # Run the workflow unless it was triggered by CI and that failed + if: ${{ !(github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'failure') }} + outputs: + RELEASE_NAME: ${{ steps.export-release-name.outputs.RELEASE_NAME }} + permissions: + id-token: write + contents: write + + steps: + - name: Cancel workflow due to DSVA schedule, unless this is a manual build + if: ${{ github.event_name != 'workflow_dispatch' && env.DSVA_SCHEDULE_ENABLED != 'true' }} + uses: andymckay/cancel-action@b9280e3f8986d7a8e91c7462efc0fa318010c8b1 # v0.3 + + - name: Configure AWS Credentials + uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0 + with: + role-to-assume: ${{ vars.AWS_ASSUME_ROLE }} + aws-region: us-gov-west-1 + + - name: Get bot token from Parameter Store + uses: department-of-veterans-affairs/action-inject-ssm-secrets@d8e6de3bde4dd728c9d732baef58b3c854b8c4bb # latest + with: + ssm_parameter: /devops/VA_VSP_BOT_GITHUB_TOKEN + env_variable_name: VA_VSP_BOT_GITHUB_TOKEN + + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version-file: .nvmrc + + - name: Install Npm Dependencies + run: | + yarn set version 3.6.1 + HUSKY=0 yarn install --immutable + + - name: Get current ref + id: get-current-ref + run: echo REF=$(git rev-parse HEAD) >> $GITHUB_OUTPUT + + - name: Get latest tag + id: get-latest-tag + run: echo LATEST_TAG_VERSION=$(git fetch --all --tags > /dev/null && git tag -l | sort -V --reverse | head -n 1) >> $GITHUB_OUTPUT + + - name: Get next tag version + run: | + next_increment=$(( $(echo ${{ steps.get-latest-tag.outputs.LATEST_TAG_VERSION }} | cut -d'.' -f3) + 1)) + echo "NEW_TAG=$(echo ${{ steps.get-latest-tag.outputs.LATEST_TAG_VERSION }} | sed -E "s/\.[0-9]+/.$next_increment/2")" >> $GITHUB_ENV + + - name: Create next tag + uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3 + with: + timeout_seconds: 30 + max_attempts: 3 + command: git tag ${{ env.NEW_TAG }} ${{ steps.get-current-ref.outputs.REF }} && git push --no-verify origin ${{ env.NEW_TAG }} + new_command_on_retry: git tag ${{ env.NEW_TAG }} ${{ steps.get-current-ref.outputs.REF }} && git push --no-verify origin ${{ env.NEW_TAG }} + + + - name: Create release + uses: ncipollo/release-action@a2e71bdd4e7dab70ca26a852f29600c98b33153e # v1.12.0 + with: + tag: ${{ env.NEW_TAG }} + name: next-build/${{ env.new_NEW_TAG }} + token: ${{ env.VA_VSP_BOT_GITHUB_TOKEN }} + commit: ${{ steps.get-current-ref.outputs.REF }} + + - name: Export new release name + id: export-release-name + run: | + echo RELEASE_NAME=${{ env.NEW_TAG }} >> $GITHUB_OUTPUT + + notify-success: + name: Notify Success + runs-on: ubuntu-latest + needs: create-production-tag + + steps: + - name: Checkout + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + + - name: Notify Slack + uses: department-of-veterans-affairs/platform-release-tools-actions/slack-notify@8c496a4b0c9158d18edcd9be8722ed0f79e8c5b4 # main + continue-on-error: true + with: + payload: '{"attachments": [{"color": "#07711E","blocks": [{"type": "section","text": {"type": "mrkdwn","text": "Successfully tagged new next-build release: ${{ needs.create-production-tag.outputs.RELEASE_NAME }}"}}]}]}' + channel_id: ${{ env.SLACK_CHANNEL }} + aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + + notify-failure: + name: Notify Failure + runs-on: ubuntu-latest + if: ${{ failure() || cancelled() }} + needs: create-production-tag + + steps: + - name: Checkout + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + + - name: Notify Slack + if: ${{ env.DSVA_SCHEDULE_ENABLED == 'true' }} + uses: department-of-veterans-affairs/platform-release-tools-actions/slack-notify@8c496a4b0c9158d18edcd9be8722ed0f79e8c5b4 # main + continue-on-error: true + with: + payload: '{"attachments": [{"color": "#D33834","blocks": [{"type": "section","text": {"type": "mrkdwn","text": ">!here< New next-build release could not be tagged!: "}}]}]}' + channel_id: ${{ env.SLACK_CHANNEL }} + aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}