build.yml

name: Terraform Provider CI

on:
  push:
    branches:
      - main

  pull_request:

  workflow_dispatch:
    inputs:
      dryRun:
        description: 'Dry-Run'
        default: 'true'
        required: false

env:
  # Currently no way to detect automatically
  DEFAULT_BRANCH: main
  GO_VERSION: 1.20.5 # renovate: datasource=golang-version depName=golang
  NODE_VERSION: 18
  DRY_RUN: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      # full checkout for semantic-release
      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
        with:
          fetch-depth: 0
      - name: Set up go ${{env.GO_VERSION}}
        uses: actions/setup-go@v4
        with:
          go-version: ${{env.GO_VERSION}}
      -
        name: Tests
        run: |
          go mod tidy
          go test -v ./...
        env:
          CGO_ENABLED: 0

  release:
    needs: [build]
    if: github.repository == 'ibm-hyper-protect/terraform-provider-hpcr' && github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write
      issues: write
      pull-requests: write
      packages: write

    steps:
      # full checkout for semantic-release
      - name: Full checkout
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
        with:
          fetch-depth: 0

      - name: Set up Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Set up go ${{env.GO_VERSION}}
        uses: actions/setup-go@v4
        with:
          go-version: ${{env.GO_VERSION}}

      - name: Install goreleaser
        uses: goreleaser/goreleaser-action@v5
        with:
          version: latest
          install-only: true

      -
        name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@v6
        id: import_gpg
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.PASSPHRASE }}

      # The dry-run evaluation is only made for non PR events. Manual trigger w/dryRun true, main branch and any tagged branches will set DRY run to false
      - name: Check dry run
        run: |
          if [[ "${{github.event_name}}" == "workflow_dispatch" && "${{ github.event.inputs.dryRun }}" != "true"  ]]; then
              echo "DRY_RUN=false" >> $GITHUB_ENV
          elif [[ "${{github.ref}}" == "refs/heads/${{env.DEFAULT_BRANCH}}" ]]; then
            echo "DRY_RUN=false" >> $GITHUB_ENV
          elif [[ "${{github.ref}}" =~ ^refs/heads/v[0-9]+(\.[0-9]+)?$ ]]; then
            echo "DRY_RUN=false" >> $GITHUB_ENV
          fi

      - name: Semantic Release
        run: |
          npx -p @semantic-release/changelog -p @semantic-release/exec -p @semantic-release/git -p conventional-changelog-conventionalcommits semantic-release --dry-run ${{env.DRY_RUN}}
        env:
          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}