release.yml

name: Release, publish, and deploy
on:
  push:
    branches:
      - main

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: ${{ github.repository }}
  COMMIT_MESSAGE: ${{ github.event.commits[0].message }}

permissions:
  contents: read # for checkout

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write # to be able to publish a GitHub release
      issues: write # to be able to comment on released issues
      pull-requests: write # to be able to comment on released pull requests
      id-token: write # to enable use of OIDC for npm provenance
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
      - name: Install dependencies
        run: yarn install --frozen-lockfile
      - name: Validate current commit
        run: npx commitlint --last --verbose
      - name: Run tests
        run: yarn test
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx semantic-release

  publish:
    runs-on: ubuntu-latest
    needs: release
    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}

      # Install the cosign tool except on PR
      # https://github.com/sigstore/cosign-installer
      - name: Install cosign
        if: github.event_name != 'pull_request'
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
        with:
          cosign-release: 'v2.2.4'

      # Set up BuildKit Docker container builder to be able to build
      # multi-platform images and export cache
      # https://github.com/docker/setup-buildx-action
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0

      # Login against a Docker registry except on PR
      # https://github.com/docker/login-action
      - name: Log into registry ${{ env.REGISTRY }}
        if: github.event_name != 'pull_request'
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Extract metadata (tags, labels) for Docker
      # https://github.com/docker/metadata-action
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Sign the resulting Docker image digest except on PRs.
      # This will only write to the public Rekor transparency log when the Docker
      # repository is public to avoid leaking data.  If you would like to publish
      # transparency data even for private images, pass --force to cosign below.
      # https://github.com/sigstore/cosign
      - name: Sign the published Docker image
        if: ${{ github.event_name != 'pull_request' }}
        env:
          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
          TAGS: ${{ steps.meta.outputs.tags }}
          DIGEST: ${{ steps.build-and-push.outputs.digest }}
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance.
        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

  deploy:
    runs-on: ubuntu-latest
    needs: publish
    steps:
      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.SSH_HOST }}
          username: ${{ secrets.SSH_USERNAME }}
          key: ${{ secrets.SSH_KEY }}
          passphrase: ${{ secrets.SSH_PASSPHRASE }}
          script: |
            cd ${{ secrets.DEPLOY_PATH}}
            echo $GHP_PAT | docker login ghcr.io -u ${{ secrets.GH_USER }} --password-stdin
            docker pull ${{ env.REGISTRY }}/cfbd/cfb-api-v2:main
            docker compose up -d
            docker image prune -f

  discord:
    needs: deploy
    runs-on: ubuntu-latest
    continue-on-error: true
    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
    steps:
      - name: Install dependencies
        run: |
          sudo apt install jq -y
          sudo apt install curl -y
      - name: Get API version
        run: |
          curl https://apinext.collegefootballdata.com/api-docs.json | jq .info.version
          api_version=$(curl https://apinext.collegefootballdata.com/api-docs.json | jq .info.version)
          api_version=${api_version%\"}
          api_version=${api_version#\"}
          echo "api_version=$api_version" >> $GITHUB_ENV
      - name: Send Discord message
        uses: sarisia/actions-status-discord@v1
        with:
          nodetail: true
          title: 'New version of REST API v2 deployed'
          url: 'https://github.com/CFBD/cfb-api-v2'
          content: |
            `${{ env.api_version}}`
            `${{ env.COMMIT_MESSAGE }}`

  buildPython:
    needs: deploy
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: Install dependencies
        run: |
          sudo apt install wget -y
          sudo apt install unzip -y
          sudo apt install jq -y
          sudo apt install curl -y
      - name: Generate library
        id: generate
        run: |
          api_version=$(curl https://apinext.collegefootballdata.com/api-docs.json | jq .info.version)
          api_version=${api_version%\"}
          api_version=${api_version#\"}
          package_version=(${api_version}a1)
          code=$(curl -X POST -H "content-type:application/json" -d '{"openAPIUrl": "https://apinext.collegefootballdata.com/api-docs.json", "options": { "packageName": "cfbd", "projectName": "cfbd", "packageUrl": "https://github.com/CFBD/cfbd-python", "packageVersion": "'"${package_version}"'"}}' https://api.openapi-generator.tech/api/gen/clients/python-pydantic-v1 | jq '. | .code')
          code=${code%\"}
          code=${code#\"}
          wget 'http://api.openapi-generator.tech/api/gen/download/'"${code}"''
          unzip $code
          echo "package_version=$package_version" >> $GITHUB_ENV
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          repository: cfbd/cfbd-python
          token: ${{ secrets.GH_PAT }}
          ref: next
          path: cfbd-python
      - name: Copy and push generated code
        run: |
          sudo yes | cp -a ./python-pydantic-v1-client/. cfbd-python
          cd cfbd-python
          rm .gitlab-ci.yml .travis.yml git_push.sh .github/workflows/python.yml
          sed -i '30,47d' README.md
          sed -i 's/git+https:\/\/\/\/.git/cfbd/g' README.md
          sed -i '18,19d' README.md
          sed -i 's/pip install cfbd/pip install cfbd@'"$package_version"'/g' README.md
          sed -i '38d' setup.py
          echo "Configuring git..."
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if git status --porcelain --
          then
            git add .
            echo "Committing changes ..."
            git commit -am "$COMMIT_MESSAGE"
            echo "Pushing to remote..."
            git push
          fi

  buildTypeScript:
    needs: deploy
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: Install dependencies
        run: |
          sudo apt install wget -y
          sudo apt install jq -y
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
      - name: Install dependencies
        run: yarn install --frozen-lockfile
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          repository: cfbd/cfbd-typescript
          token: ${{ secrets.GH_PAT }}
      - name: Download spec
        run: |
          wget https://apinext.collegefootballdata.com/api-docs.json
      - name: Set version number
        run: |
          api_version=$(cat api-docs.json | jq '. | .info.version')
          api_version=${api_version%\"}
          api_version=${api_version#\"}
          package_version=(${api_version}-alpha.0)
          sed -i '/"version": /c\  "version": "'"$package_version"'",' package.json
      - name: Generate client
        run: |
          npx @hey-api/openapi-ts -i api-docs.json -o src -c @hey-api/client-fetch
          sed -i 's/createConfig()/createConfig({ baseUrl: '\''https:\/\/apinext.collegefootballdata.com'\'' })/g' src/services.gen.ts
      - name: Commit and push changes
        run: |
          echo "Configuring git..."
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if git status --porcelain --
          then
            git add .
            echo "Committing changes ..."
            git commit -am "$COMMIT_MESSAGE"
            echo "Pushing to remote..."
            git push
          fi