release.yml

name: Release build
on:
  push:
    branches:
      - main
      - v1
  workflow_dispatch:

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      actions: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
        with:
          node-version: 22
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - name: Build dist
        working-directory: lambdas
        run: yarn install --frozen-lockfile && yarn run test && yarn dist
      - name: Get installation token
        uses: actions/create-github-app-token@136412a57a7081aa63c935a2cc2918f76c34f514 # v1.11.2
        id: token
        with:
          app-id: ${{ vars.RELEASER_APP_ID }}
          private-key: ${{ secrets.RELEASER_APP_PRIVATE_KEY }}
      - name: Extract branch name
        id: branch
        shell: bash
        run: echo "name=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT
      - name: Release
        id: release
        uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3
        with:
          target-branch: ${{ steps.branch.outputs.name }}
          release-type: terraform-module
          token: ${{ steps.token.outputs.token }}
      - name: Attest
        if: ${{ steps.release.outputs.releases_created == 'true' }}
        id: attest
        uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0
        with:
          subject-path: '${{ github.workspace }}/lambdas/functions/**/*.zip'
      - name: Update release notes with attestation
        if: ${{ steps.release.outputs.releases_created == 'true' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ github.event.inputs.version }}
          TAG_NAME: ${{ steps.release.outputs.tag_name }}
          ATTESTATION_URL: ${{ steps.attest.outputs.attestation-url }}
        run: |
          version="${VERSION}"
          tag_name="${TAG_NAME}"
          attestation_url="${ATTESTATION_URL}"
          gh release view $version --json body -q '.body' > new-release-notes.md
          echo "## Attestation" >> new-release-notes.md
          echo "Attestation url: $attestation_url" >> new-release-notes.md
          echo "Verify the artifacts by running \`gh attest verify <name_of_artifact> --repo ${{ github.repository }}\`" >> new-release-notes.md
          gh release edit $tag_name -F new-release-notes.md -t $tag_name
      - name: Upload release assets
        if: ${{ steps.release.outputs.releases_created == 'true' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ steps.release.outputs.tag_name }}
        run: |
          tag_name="${TAG_NAME}"
          for f in $(find . -name '*.zip'); do
            gh release upload $tag_name $f
          done