make-release.yml

name: Make Release

# RELEASE PROCESS
#
# === Automated activities ===
# 1. [Quality check] run unit tests, linting, examples, layer, doc snippets
# 2. [Release] publish all packages to npmjs.org using the latest git commit using OIDC authentication with automatic provenance attestations
# 3. [Create tag] create a new git tag using released version, i.e. v1.13.1
# 4. [Publish layer] build and package layer, kick off the workflow for beta and prod deployment, including canary tests
# 5. [Publish layer] update documentation with the latest layer ARN version of the prod deployment
# 6. [Publish layer] create PR to merge the updated documentation
#
# === Manual activities ===
# 1. Kick off `make-version` workflow to bump and review the version changes and changelog for each package
# 2. Merge the PR created by `make-version` workflow
# 3. Kick off this workflow to make the release
# 4. Merge the PR created by the `publish_layer` workflow to update the documentation
# 5. Update draft release notes with the latest changes and publish the release on GitHub

on: workflow_dispatch

permissions:
  contents: read

concurrency:
  group: on-release-publish


jobs:
  run-unit-tests:
    uses: ./.github/workflows/reusable-run-linting-check-and-unit-tests.yml
  # This job publishes the packages to npm.
  # It uses the latest git commit sha as the version and uses OIDC authentication for secure
  # and passwordless publishing to npmjs.org with automatic provenance attestations.
  # We don't bump the version because we do that in the `make-version` workflow.
  # It also sets the RELEASE_VERSION output to be used by the next job to create a git tag.
  publish-npm:
    needs: run-unit-tests
    permissions:
      id-token: write # Needed for OIDC authentication & provenance with npm trusted publishing
    environment: Release
    runs-on: ubuntu-latest
    outputs:
      RELEASE_VERSION: ${{ steps.set-release-version.outputs.RELEASE_VERSION }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          ref: ${{ github.sha }}
      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: 24
          cache: "npm"
          registry-url: 'https://registry.npmjs.org'
      - name: Setup dependencies
        uses: aws-powertools/actions/.github/actions/cached-node-modules@29979bc5339bf54f76a11ac36ff67701986bb0f0
      - name: Publish to npm
        run: |
          npm publish --workspaces
      - name: Set release version
        id: set-release-version
        run: |
          VERSION=$(cat packages/commons/package.json | jq .version -r)
          echo RELEASE_VERSION="$VERSION" >> "$GITHUB_OUTPUT"
  
  # This job creates a new git tag using the released version (v1.18.1)
  create_tag: 
    needs: [publish-npm]
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          ref: ${{ github.sha }}
      - name: Git client setup
        run: | 
          git config --global user.name 'aws-powertools-bot'
          git config --global user.email '151832416+aws-powertools-bot@users.noreply.github.com'
          git config remote.origin.url >&-
      - name: Create git tag
        run : |
          git tag -a v${{ needs.publish-npm.outputs.RELEASE_VERSION }} -m "Release v${{ needs.publish-npm.outputs.RELEASE_VERSION }}"
          git push origin v${{ needs.publish-npm.outputs.RELEASE_VERSION }}
   
  # NOTE: Watch out for the depth limit of 4 nested workflow_calls.
  # publish_layer -> reusable_deploy_layer_stack -> reusable_update_layer_arn_docs
  publish_layer:
    needs: publish-npm
    secrets:
      # We use "inherit" because need to propagate the secrets to the reusable workflow, secrets are already scoped by using GitHub's deployment environments to mitigate the risk of secret exposure.
      inherit
    permissions:
      id-token: write
      contents: write
      pages: write
      pull-requests: write
    uses: ./.github/workflows/publish_layer.yml
    with:
      latest_published_version: ${{ needs.publish-npm.outputs.RELEASE_VERSION }}