release.yml

name: release

on:
  push:
    tags:
      - v*.*.*

permissions:
  contents: write
  pull-requests: read

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: 'v16.20.2'

      - uses: elastic/apm-pipeline-library/.github/actions/docker-login@current
        with:
          registry: docker.elastic.co
          secret: secret/observability-team/ci/docker-registry/prod
          url: ${{ secrets.VAULT_ADDR }}
          roleId: ${{ secrets.VAULT_ROLE_ID }}
          secretId: ${{ secrets.VAULT_SECRET_ID }}

      - run: make -C .ci env

      - run: make -C .ci dist

      - run: make -C .ci push-docker

      - name: Read AWS vault secrets
        uses: hashicorp/vault-action@v2.8.0
        with:
          url: ${{ secrets.VAULT_ADDR }}
          method: approle
          roleId: ${{ secrets.VAULT_ROLE_ID }}
          secretId: ${{ secrets.VAULT_SECRET_ID }}
          secrets: |
            secret/observability-team/ci/service-account/apm-aws-lambda access_key_id | AWS_ACCESS_KEY_ID ;
            secret/observability-team/ci/service-account/apm-aws-lambda secret_access_key | AWS_SECRET_ACCESS_KEY

      - name: Publish AWS lambda
        run: make -C .ci publish-in-all-aws-regions create-arn-file
        env:
          GH_TOKEN: ${{ github.token }}

      - run: make -C .ci github-release
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Read NPM vault secrets
        uses: hashicorp/vault-action@v2.8.0
        with:
          url: ${{ secrets.VAULT_ADDR }}
          method: approle
          roleId: ${{ secrets.VAULT_ROLE_ID }}
          secretId: ${{ secrets.VAULT_SECRET_ID }}
          secrets: |
            secret/jenkins-ci/npmjs/elasticmachine token | NPMJS_TOKEN ;
            totp/code/npmjs-elasticmachine code | TOTP_CODE

      - name: npm publish
        run: |-
          echo "//registry.npmjs.org/:_authToken=${{ env.NPMJS_TOKEN }}" > .npmrc
          npm publish --otp=${{ env.TOTP_CODE }}

      - if: always()
        uses: elastic/apm-pipeline-library/.github/actions/notify-build-status@current
        with:
          vaultUrl: ${{ secrets.VAULT_ADDR }}
          vaultRoleId: ${{ secrets.VAULT_ROLE_ID }}
          vaultSecretId: ${{ secrets.VAULT_SECRET_ID }}
          slackChannel: "#apm-agent-node"
          message: '[${{ github.repository }}] Release *${{ github.ref_name }}*'