release.yml

name: release

on:
  push:
    tags:
      - v*.*.*
    branches:
      - main

permissions:
  attestations: write
  contents: write
  id-token: write
  pull-requests: read

jobs:
  release:
    runs-on: ubuntu-latest
    env:
      DOCKER_IMAGE_NAME: docker.elastic.co/observability/apm-agent-nodejs
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: 'v16.20.2'

      - uses: elastic/apm-pipeline-library/.github/actions/docker-login@current
        with:
          registry: docker.elastic.co
          secret: secret/observability-team/ci/docker-registry/prod
          url: ${{ secrets.VAULT_ADDR }}
          roleId: ${{ secrets.VAULT_ROLE_ID }}
          secretId: ${{ secrets.VAULT_SECRET_ID }}

      - run: make -C .ci env

      - run: make -C .ci dist

      - name: Attest Lambda layer zip
        uses: actions/attest-build-provenance@951c0c5f8e375ad4efad33405ab77f7ded2358e4  # v1.1.1
        with:
          subject-path: "${{ github.workspace }}/build/aws/elastic-apm-node-lambda-layer-*.zip"

      - name: Extract metadata (tags, labels)
        id: docker-meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81  # v5.5.1
        with:
          images: ${{ env.DOCKER_IMAGE_NAME }}
          flavor: |
            latest=auto
          tags: |
            # "1.2.3" and "latest" Docker tags on push of git tag "v1.2.3"
            type=semver,pattern={{version}}
            # "edge" Docker tag on git push to default branch
            type=edge

      - name: Build and Push Docker Image
        id: docker-push
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0  # v5.3.0
        with:
          context: .
          file: 'Dockerfile'
          push: true
          tags: ${{ steps.docker-meta.outputs.tags }}
          labels: ${{ steps.docker-meta.outputs.labels }}
          build-args: |
            AGENT_DIR=/build/dist/nodejs

      - name: Attest Docker image
        uses: actions/attest-build-provenance@951c0c5f8e375ad4efad33405ab77f7ded2358e4  # v1.1.1
        with:
          subject-name: "${{ env.DOCKER_IMAGE_NAME }}"
          subject-digest: ${{ steps.docker-push.outputs.digest }}
          push-to-registry: true

      - name: Extract metadata (tags, labels) (wolfi)
        id: docker-meta-wolfi
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81  # v5.5.1
        with:
          images: ${{ env.DOCKER_IMAGE_NAME }}
          flavor: |
            latest=auto
            suffix=-wolfi
          tags: |
            # "1.2.3" and "latest" Docker tags on push of git tag "v1.2.3"
            type=semver,pattern={{version}}
            # "edge" Docker tag on git push to default branch
            type=edge

      - name: Build and Push Docker Image (wolfi)
        id: docker-push-wolfi
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0  # v5.3.0
        with:
          context: .
          file: 'Dockerfile.wolfi'
          push: true
          tags: ${{ steps.docker-meta-wolfi.outputs.tags }}
          labels: ${{ steps.docker-meta-wolfi.outputs.labels }}
          build-args: |
            AGENT_DIR=/build/dist/nodejs

      - name: Attest Docker image (wolfi)
        uses: github-early-access/generate-build-provenance@main
        with:
          subject-name: "${{ env.DOCKER_IMAGE_NAME }}"
          subject-digest: ${{ steps.docker-push-wolfi.outputs.digest }}
          push-to-registry: true

      - name: Read AWS vault secrets
        uses: hashicorp/vault-action@v3.0.0
        with:
          url: ${{ secrets.VAULT_ADDR }}
          method: approle
          roleId: ${{ secrets.VAULT_ROLE_ID }}
          secretId: ${{ secrets.VAULT_SECRET_ID }}
          secrets: |
            secret/observability-team/ci/service-account/apm-aws-lambda access_key_id | AWS_ACCESS_KEY_ID ;
            secret/observability-team/ci/service-account/apm-aws-lambda secret_access_key | AWS_SECRET_ACCESS_KEY

      - name: Publish AWS lambda (only for tag release)
        if: startsWith(github.ref, 'refs/tags')
        run: make -C .ci publish-in-all-aws-regions create-arn-file
        env:
          GH_TOKEN: ${{ github.token }}

      - name: create github release (only for tag release)
        run: make -C .ci github-release
        if: startsWith(github.ref, 'refs/tags')
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Read NPM vault secrets
        uses: hashicorp/vault-action@v3.0.0
        with:
          url: ${{ secrets.VAULT_ADDR }}
          method: approle
          roleId: ${{ secrets.VAULT_ROLE_ID }}
          secretId: ${{ secrets.VAULT_SECRET_ID }}
          secrets: |
            secret/jenkins-ci/npmjs/elasticmachine token | NPMJS_TOKEN ;
            totp/code/npmjs-elasticmachine code | TOTP_CODE

      - name: npm publish (only for tag release)
        if: startsWith(github.ref, 'refs/tags')
        run: |-
          echo "//registry.npmjs.org/:_authToken=${{ env.NPMJS_TOKEN }}" > .npmrc
          npm publish --otp=${{ env.TOTP_CODE }} --provenance

      - if: ${{ always() && startsWith(github.ref, 'refs/tags') }}
        uses: elastic/apm-pipeline-library/.github/actions/notify-build-status@current
        with:
          vaultUrl: ${{ secrets.VAULT_ADDR }}
          vaultRoleId: ${{ secrets.VAULT_ROLE_ID }}
          vaultSecretId: ${{ secrets.VAULT_SECRET_ID }}
          slackChannel: "#apm-agent-node"
          message: '[${{ github.repository }}] Release *${{ github.ref_name }}*'