publish-bicep.yaml

# ------------------------------------------------------------
# Copyright 2023 The Radius Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#    
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ------------------------------------------------------------

name: Update extensibility provider types
on:
  push:
    branches:
      - main
    tags:
      - v*
  workflow_run:
    workflows: ["Approve Publish Bicep Types"]
    types:
      - completed
    workflow_dispatch:
    inputs: {}

permissions:
      id-token: write
      contents: read
      checks: write

env: 
  # bicep-types ACR url for uploading AWS Bicep types
  BICEP_TYPES_REGISTRY: 'biceptypes.azurecr.io'
  AWS_REGION: us-west-2
  CI_PUBLISH_RELEASE: ${{ github.repository == 'radius-project/bicep-types-aws' && startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
  CI_PUBLISH_LATEST: ${{ github.repository == 'radius-project/bicep-types-aws' && github.ref == 'refs/heads/main' && github.event_name == 'push' }}

jobs:
  build-and-push-bicep-types:
    name: Publish Radius bicep types to ACR
    runs-on: ubuntu-latest
    steps:
      - name: Create check run
        id: create_check_run
        run: |
          response=$(curl -X POST \
            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
            -H "Accept: application/vnd.github.v3+json" \
            https://api.github.com/repos/${{ github.repository }}/check-runs \
            -d '{
              "name": "Publish Radius bicep types to ACR",
              "head_sha": "${{ github.sha }}",
              "status": "in_progress"
            }')
          echo "::set-output name=check_run_id::$(echo $response | jq -r '.id')"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Check out code
        uses: actions/checkout@v4
      - name: Parse release version and set environment variables
        run: python ./.github/scripts/get_release_version.py
      - name: Set up Go ${{ env.GOVER }}
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVER }}
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '18'
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      - name: 'Build aws-type-downloader'
        env:
          GOPROXY: "https://proxy.golang.org"
        working-directory: 'src/aws-type-downloader'
        run: go build .
      - name: Download AWS specs from CloudControl 
        run: |
          cd src/aws-type-downloader && go run main.go --output ../../artifacts/types --clean
      - name: 'Initialize submodule'
        run: | 
          git submodule update --init --recursive
          npm --prefix bicep-types/src/bicep-types ci && npm --prefix bicep-types/src/bicep-types run build; \
      - name: Generate Bicep extensibility types for AWS
        env:
          VERSION: ${{ env.REL_CHANNEL == 'edge' && 'latest' || env.REL_CHANNEL }}
        run: |
          npm --prefix ./src/aws-type-generator install
          npm run --prefix ./src/aws-type-generator start -- --input ../../artifacts/types --output ../../artifacts/bicep --release-version ${{ env.VERSION }}
      - name: Upload AWS Bicep types artifacts
        uses: actions/upload-artifact@v4
        with:
          name: aws-bicep-types
          path: ./artifacts/bicep
          if-no-files-found: error
      - name: 'Login via Azure CLI'
        if: ${{ env.CI_PUBLISH_LATEST == 'true' || env.CI_PUBLISH_RELEASE == 'true' }}
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.BICEPTYPES_CLIENT_ID }}
          tenant-id: ${{ secrets.BICEPTYPES_TENANT_ID }}
          subscription-id: ${{ secrets.BICEPTYPES_SUBSCRIPTION_ID }}
      - name: Setup and verify bicep CLI
        if: ${{ env.CI_PUBLISH_LATEST == 'true' || env.CI_PUBLISH_RELEASE == 'true' }}
        run: |
          curl -Lo bicep https://github.com/Azure/bicep/releases/latest/download/bicep-linux-x64
          chmod +x ./bicep
          sudo mv ./bicep /usr/local/bin/bicep
          bicep --version
      - name: Publish bicep types 
        if: ${{ env.CI_PUBLISH_LATEST == 'true' || env.CI_PUBLISH_RELEASE == 'true' }}
        env: 
          VERSION: ${{ env.REL_CHANNEL == 'edge' && 'latest' || env.REL_CHANNEL }}
        run: |
          bicep publish-extension ./artifacts/bicep/index.json --target br:${{ env.BICEP_TYPES_REGISTRY }}/aws:${{ env.VERSION }} --force
      - name: Update check run
        if: always()
        run: |
          conclusion="success"
          if [ "${{ job.status }}" != "success" ]; then
            conclusion="failure"
          fi
          curl -X PATCH \
            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
            -H "Accept: application/vnd.github.v3+json" \
            https://api.github.com/repos/${{ github.repository }}/check-runs/${{ steps.create_check_run.outputs.check_run_id }} \
            -d '{
              "status": "completed",
              "conclusion": "'$conclusion'"
            }'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}