manual-publish.yml

name: Manually Publish Images and Artifacts
on:
  workflow_dispatch:
    inputs:
      dry-run-tmp:
        default: true
        description: 'dry-run-tmp'
        required: false
        type: boolean
      dry-run:
        default: true
        description: 'Skip publishing to DockerHub and Homebrew'
        required: false
        type: boolean
      dry-run-gh:
        default: true
        description: 'Skip publishing to github'
        required: false
        type: boolean
      dry-run-npm:
        default: true
        description: 'Skip publishing to npm'
        required: false
        type: boolean
      tag:
        description: 'Tag to upload binary artifacts to'
        required: true
        type: string

jobs:
  hello-world:
    steps:
      - uses: ./.github/actions/temp
        id: temp
        with:
          dry-run-tmp: ${{ inputs.dry-run-tmp }}

  release-ldcli:
    permissions:
      id-token: write # Needed to obtain Docker tokens
      contents: write # Needed to upload release artifacts
    runs-on: ubuntu-latest
    outputs:
      hashes: ${{ steps.publish.outputs.hashes }}
    steps:
      - uses: actions/checkout@v4
        name: Checkout
        with:
          fetch-depth: 0

      - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.0.1
        name: 'Get Docker token'
        with:
          aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
          ssm_parameter_pairs: '/global/services/docker/public/username = DOCKER_USERNAME, /global/services/docker/public/token = DOCKER_TOKEN'

      - uses: ./.github/actions/publish
        id: publish
        with:
          dry-run: ${{ inputs.dry-run }}
          dry-run-gh: ${{ inputs.dry-run-gh }}
          token: ${{ secrets.GITHUB_TOKEN }}
          homebrew-gh-secret: ${{secrets.HOMEBREW_DEPLOY_KEY}}
          tag: ${{ inputs.tag }}

  release-ldcli-npm:
    runs-on: ubuntu-latest
    if: ${{ inputs.dry-run-npm == false }}
    needs: ['release-ldcli']
    permissions:
      actions: read
      id-token: write
      contents: write
    steps:
      - uses: actions/checkout@v4
        name: Checkout
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v3
        with:
          node-version: 20.x
          registry-url: 'https://registry.npmjs.org'
      - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.0.1
        name: 'Get NPM token'
        with:
          aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
          ssm_parameter_pairs: '/production/common/releasing/npm/token = NODE_AUTH_TOKEN'
      - id: publish-npm
        name: Publish NPM Package
        uses: ./.github/actions/publish-npm
        with:
          dry-run: ${{ inputs.dry-run }}
          prerelease: ${{ inputs.prerelease }}

  release-ldcli-provenance:
    needs: ['release-ldcli']
    permissions:
        actions: read
        id-token: write
        contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0
    with:
        base64-subjects: "${{ needs.release-ldcli.outputs.hashes }}"
        upload-assets: true
        upload-tag-name: ${{ inputs.tag }}
        provenance-name: ${{ format('ldcli_{0}_multiple_provenance.intoto.jsonl', inputs.tag) }}