release.yml

name: Release
on:
  push:
    branches:
      - main
      - next
      - develop
      - release/**
  workflow_dispatch:

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions: write-all
    steps:
      - name: Checkout
        uses: RDXWorks-actions/checkout@main
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: RDXWorks-actions/setup-node@main
        with:
          node-version: '20.x'

      - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main
        with:
          role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-radix-dapp-toolkit-secrets-read-access'
          app_name: 'dapp-toolkit'
          step_name: 'npm'
          secret_prefix: 'GH'
          secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/radixdlt/radix-dapp-toolkit/npm-token-A52rl3'
          parse_json: true

      - name: Authenticate with private NPM package
        run: echo "//registry.npmjs.org/:_authToken=${{ env.GH_NPMJS_TOKEN }}" > ~/.npmrc
      
      - name: Install dependencies
        run: npm ci
      
      - name: Build
        run: npm run build

      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ env.GH_NPMJS_TOKEN }}
        run: |
          cd packages/dapp-toolkit
          npx semantic-release | tee out
          echo "RELEASE_VERSION=$(grep 'Created tag ' out | awk -F 'Created tag ' '{print $2}')" >> $GITHUB_ENV

      # Snyk SBOM
      - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main
        with:
          role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access'
          app_name: 'radix-dapp-toolkit'
          step_name: 'snyk-sbom'
          secret_prefix: 'SNYK'
          secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/snyk-credentials-rXRpuX'
          parse_json: true

      - name: Generate SBOM
        uses: RDXWorks-actions/snyk-actions/node@master
        with:
          args: --all-projects --org=${{ env.SNYK_PROJECTS_ORG_ID }} --format=cyclonedx1.4+json > sbom.json
          command: sbom

      - name: Upload SBOM
        uses: RDXWorks-actions/upload-release-assets@c94805dc72e4b20745f543da0f62eaee7722df7a
        with:
          files: sbom.json
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          release-tag: ${{ env.RELEASE_VERSION }}