pipeline.yml

name: 'Frodo CLI Release Pipeline'

on:
  pull_request:
    branches:
      - 'main'
    paths-ignore:
      - '**/README.md'
      - '**/CODE_OF_CONDUCT.md'
      - 'docs/**'
  push:
    branches:
      - 'main'
    paths-ignore:
      - '**/pipeline.yml'
      - '**/README.md'
      - '**/CODE_OF_CONDUCT.md'
      - 'docs/**'
  workflow_dispatch:

env:
  NODE_VERSION: 18

jobs:
  build:
    name: 'Build'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          # Need to specify ref and repository for PRs from forked repos
          ref: ${{ github.event.pull_request.head.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: 'Prepare Version Bump'
        id: version-bump
        uses: 'phips28/gh-action-bump-version@master'
        with:
          major-wording: 'NO MAJOR RELEASES IN THIS BRANCH! Capped at 1.x to avoid version collisions.'
          minor-wording: 'MINOR RELEASE'
          patch-wording: 'PATCH RELEASE'
          rc-wording: ''
          tag-prefix: 'v'
          default: prerelease
          preid: ''
          bump-policy: 'ignore'
          skip-commit: 'true'
          skip-tag: 'true'
          skip-push: 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: 'Version From Tag'
        id: version-from-tag
        run: echo "version=$(echo '${{ steps.version-bump.outputs.newTag }}' | sed 's/v//')" >> "$GITHUB_OUTPUT"

      - name: Build frodo-cli esm
        run: npm run transpile-esm

      - name: Build frodo-cli cjs
        run: npm run transpile-cjs

      - name: Lint
        run: npm run lint

      - name: Type Check
        run: npx tsc

      - name: Security Audit
        run: npm audit --omit=dev

      - uses: actions/upload-artifact@v3
        with:
          name: build
          path: |
            package.json
            package-lock.json
            esm
            cjs

    outputs:
      newTag: ${{ steps.version-bump.outputs.newTag }}
      newVersion: ${{ steps.version-from-tag.outputs.version }}
      preRelease: ${{ contains(steps.version-bump.outputs.newTag, '-') }}

  smoke-tests:
    name: 'Smoke Tests'
    needs: build
    # You must use a Linux environment when using service containers or container jobs
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [20, 18, 16]
        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/

    # Service containers to run with `smoke-tests`
    services:
      # Label used to access the service container
      squid:
        image: ubuntu/squid
        ports:
          # Maps tcp port 3128 on the host to the same port in the service container
          - 3128:3128

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          # Need to specify ref and repository for PRs from forked repos
          ref: ${{ github.event.pull_request.head.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v3
        with:
          # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      # Update npm for older node versions to avoid errors with npm ci due to newer package-lock.json format
      # TODO: conditionally update npm when it is older than the required version
      - name: Update npm
        run: npm install -g npm

      - uses: actions/download-artifact@v3
        with:
          name: build

      - name: Install dependencies
        run: npm ci

      - name: Install frodo-cli globally
        run: npm i -g

      - name: CLI Help Tests
        run: npm test

      - name: Version Test
        run: frodo -v

      - name: Direct Tests
        env:
          FIDC_TENANT_URL: ${{ secrets.FIDC_TENANT_URL }}
          FIDC_TENANT_ADMIN_USERNAME: ${{ secrets.FIDC_TENANT_ADMIN_USERNAME }}
          FIDC_TENANT_ADMIN_PASSWORD: ${{ secrets.FIDC_TENANT_ADMIN_PASSWORD }}
        run: |
          frodo conn add "$FIDC_TENANT_URL" "$FIDC_TENANT_ADMIN_USERNAME" "$FIDC_TENANT_ADMIN_PASSWORD"
          frodo info "$FIDC_TENANT_URL"

      - name: Proxy Tests
        env:
          HTTPS_PROXY: 'http://127.0.0.1:3128'
          FIDC_TENANT_URL: ${{ secrets.FIDC_TENANT_URL }}
          FIDC_TENANT_ADMIN_USERNAME: ${{ secrets.FIDC_TENANT_ADMIN_USERNAME }}
          FIDC_TENANT_ADMIN_PASSWORD: ${{ secrets.FIDC_TENANT_ADMIN_PASSWORD }}
        run: |
          frodo conn add "$FIDC_TENANT_URL" "$FIDC_TENANT_ADMIN_USERNAME" "$FIDC_TENANT_ADMIN_PASSWORD"
          frodo info "$FIDC_TENANT_URL"

  release:
    if: github.event_name != 'pull_request'
    needs: [build, linux-binary-release, linux-arm64-binary-release, macos-binary-release, npm-release, windows-binary-release]
    name: 'Release'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - uses: actions/download-artifact@v3
        with:
          name: build

      - uses: actions/download-artifact@v3
        with:
          name: dist

      - name: 'Github SHA'
        id: github-sha
        run: echo ${{ github.sha }} > Release.txt

      - name: Update Changelog
        uses: thomaseizinger/keep-a-changelog-new-release@1.3.0
        with:
          tag: ${{ needs.build.outputs.newTag }}

      - name: 'Output Changelog'
        run: cat CHANGELOG.md

      - name: 'Release Header'
        id: release-header
        run: echo "header=$(echo `grep '## \\[${{ needs.build.outputs.newVersion }}] -' CHANGELOG.md | sed 's/## //' | sed 's/\\[//' | sed 's/]//'`)" >> "$GITHUB_OUTPUT"

      - name: 'Extract Release Notes'
        id: extract-release-notes
        uses: 'dahlia/submark@main'
        with:
          input-file: 'CHANGELOG.md'
          heading-level: 2
          heading-title-text: '${{ steps.release-header.outputs.header }}'
          ignore-case: true
          omit-heading: true

      - name: Commit updated changelog and version
        id: commit-changelog
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add CHANGELOG.md package.json
          git commit --message "Updated changelog and version for release ${{ needs.build.outputs.newTag }}"
          git push

      - name: Release
        uses: softprops/action-gh-release@v1
        with:
          name: Frodo CLI ${{ needs.build.outputs.newVersion }}
          tag_name: ${{ needs.build.outputs.newTag }}
          body: ${{ steps.extract-release-notes.outputs.output-text }}
          prerelease: ${{ needs.build.outputs.preRelease }}
          generate_release_notes: ${{ contains(needs.build.outputs.newTag, '-') }}
          files: |
            CHANGELOG.md
            LICENSE
            Release.txt
            frodo-linux-${{ needs.build.outputs.newVersion }}.zip
            frodo-macos-${{ needs.build.outputs.newVersion }}.zip
            frodo-macos-${{ needs.build.outputs.newVersion }}.dmg
            frodo-win-${{ needs.build.outputs.newVersion }}.zip
            frodo-linux-arm64-${{ needs.build.outputs.newVersion }}.zip
          token: ${{ secrets.GITHUB_TOKEN }}

  npm-release:
    if: github.event_name != 'pull_request'
    # npm-release only needs the build job but since it is inconvenient to unpublish an npm we want this job to run last
    needs: [build, linux-binary-release, linux-arm64-binary-release, macos-binary-release, windows-binary-release]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - uses: actions/download-artifact@v3
        with:
          name: build

      - name: Install dependencies
        run: npm ci

      - name: Pre-Release
        if: ${{ fromJSON(needs.build.outputs.preRelease) }}
        uses: JS-DevTools/npm-publish@v1
        with:
          access: public
          tag: 'next'
          token: ${{ secrets.NPM_ACCESS_TOKEN }}

      - name: Release
        if: ${{ ! fromJSON(needs.build.outputs.preRelease) }}
        uses: JS-DevTools/npm-publish@v1
        with:
          access: public
          token: ${{ secrets.NPM_ACCESS_TOKEN }}

      - name: Add next tag
        if: ${{ ! fromJSON(needs.build.outputs.preRelease) }}
        run: |
          export INPUT_TOKEN=${{ secrets.NPM_ACCESS_TOKEN }}
          npm whoami
          npm dist-tag add @rockcarver/frodo-cli@${{ needs.build.outputs.newVersion }} next

  homebrew-formula-update:
    if: github.event_name != 'pull_request'
    name: Bump Homebrew formula
    needs: [build, npm-release]
    runs-on: ubuntu-latest
    steps:
      - uses: mislav/bump-homebrew-formula-action@v2
        if: ${{ ! fromJSON(needs.build.outputs.preRelease) }}
        with:
          formula-name: frodo-cli
          formula-path: Formula/frodo-cli.rb
          homebrew-tap: rockcarver/homebrew-frodo-cli
          push-to: rockcarver/homebrew-frodo-cli
          tag-name: ${{ needs.build.outputs.newTag }}
          download-url: https://github.com/rockcarver/frodo-cli.git
        env:
          COMMITTER_TOKEN: ${{ secrets.PAT_HOMEBREW_FORMULA_REPO }}

  macos-binary-release:
    needs: [build, smoke-tests]
    runs-on: macos-latest
    timeout-minutes: 15
    steps:
      - name: Install the Apple certificate
        env:
          DEVELOPMENT_CERTIFICATE_DATA: ${{ secrets.DEVELOPMENT_CERTIFICATE_DATA }}
          DEVELOPMENT_CERTIFICATE_PASSPHRASE: ${{ secrets.DEVELOPMENT_CERTIFICATE_PASSPHRASE }}
          INTERMEDIATE_CERTIFICATE_DATA: ${{ secrets.INTERMEDIATE_CERTIFICATE_DATA }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          # create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          INTERMEDIATE_CERTIFICATE_PATH=$RUNNER_TEMP/intermediate_certificate.p12
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

          # import certificates from secrets
          echo -n "$DEVELOPMENT_CERTIFICATE_DATA" | base64 --decode --output $CERTIFICATE_PATH
          echo -n "$INTERMEDIATE_CERTIFICATE_DATA" | base64 --decode --output $INTERMEDIATE_CERTIFICATE_PATH

          # create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # import certificate to keychain
          security import $CERTIFICATE_PATH -P "$DEVELOPMENT_CERTIFICATE_PASSPHRASE" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          #security import $INTERMEDIATE_CERTIFICATE_PATH -P "$DEVELOPMENT_CERTIFICATE_PASSPHRASE" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

      - uses: actions/download-artifact@v3
        with:
          name: build

      - uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run dist-pkg

      #
      # Fail early on failing tests.
      #
      - name: 'Test'
        run: |
          ./frodo -v
          ./frodo journey -h
          ./frodo journey export -h

      - name: Install gon via HomeBrew for code signing and app notarization
        run: |
          brew tap mitchellh/gon
          brew install mitchellh/gon/gon

      - name: Notorize
        env:
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
        run: |
          cat > entitlements.plist <<DELIM
          <dict>
            <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
            <true/>
          </dict>
          DELIM
          cat > ./gon.json <<DELIM
          {
            "source" : ["./frodo"],
            "bundle_id" : "rockcarver.frodo.cli",
            "apple_id": {
              "username" : "${{ secrets.AC_USERNAME }}",
              "password":  "@env:AC_PASSWORD"
            },
            "sign" :{
              "application_identity" : "Developer ID Application: Volker Scheuber (AV6L99G8W9)",
              "entitlements_file" : "entitlements.plist"
            },
            "dmg" :{
              "output_path":  "frodo-macos-${{ needs.build.outputs.newVersion }}.dmg",
              "volume_name":  "frodo"
            },
            "zip" :{
              "output_path" : "frodo-macos-${{ needs.build.outputs.newVersion }}.zip"
            }
          }
          DELIM
          gon -log-level=debug -log-json gon.json

      - uses: actions/upload-artifact@v3
        with:
          name: dist
          path: frodo-macos-${{ needs.build.outputs.newVersion }}.zip

      - uses: actions/upload-artifact@v3
        with:
          name: dist
          path: frodo-macos-${{ needs.build.outputs.newVersion }}.dmg

  linux-binary-release:
    needs: [build, smoke-tests]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v3
        with:
          name: build

      - uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run dist-pkg

      #
      # Fail early on failing tests.
      #
      - name: 'Test'
        run: |
          ./frodo -v
          ./frodo journey -h
          ./frodo journey export -h

      - name: Archive distribution binary
        run: zip -Z bzip2 frodo-linux-${{ needs.build.outputs.newVersion }}.zip frodo

      - uses: actions/upload-artifact@v3
        with:
          name: dist
          path: frodo-linux-${{ needs.build.outputs.newVersion }}.zip

  linux-arm64-binary-release:
    needs: [build, smoke-tests]
    runs-on: self-hosted
    steps:
      - uses: actions/download-artifact@v3
        with:
          name: build

      - uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run dist-pkg

      #
      # Fail early on failing tests.
      #
      - name: 'Test'
        run: |
          ./frodo -v
          ./frodo journey -h
          ./frodo journey export -h

      - name: Archive distribution binary
        run: zip -Z bzip2 frodo-linux-arm64-${{ needs.build.outputs.newVersion }}.zip . -i frodo

      - uses: actions/upload-artifact@v3
        with:
          name: dist
          path: frodo-linux-arm64-${{ needs.build.outputs.newVersion }}.zip

  windows-binary-release:
    needs: [build, smoke-tests]
    runs-on: windows-latest
    steps:
      - uses: actions/download-artifact@v3
        with:
          name: build

      - uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run dist-pkg

      #
      # Fail early on failing tests.
      #
      - name: 'Test'
        run: |
          ./frodo.exe -v
          ./frodo.exe journey -h
          ./frodo.exe journey export -h

      - name: Archive distribution binary
        run: 7z a -tzip frodo-win-${{ needs.build.outputs.newVersion }}.zip frodo.exe

      - uses: actions/upload-artifact@v3
        with:
          name: dist
          path: frodo-win-${{ needs.build.outputs.newVersion }}.zip