test-and-release.yaml

name: Test and Release

on:
  push:
  workflow_dispatch:

permissions:
  id-token: write
  contents: write
  issues: write
  actions: write

env:
  CI: 1
  FORCE_COLOR: 3

jobs:
  test-and-release:
    runs-on: ubuntu-24.04

    timeout-minutes: 60

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "22.x"
          cache: "npm"

      - name: Install dependencies
        run: npm ci --no-audit

      - name: Check TypeScript
        run: npx tsc

      - name: Check source code with eslint
        run: npx eslint .

      - name: Check if source code is properly formatted
        run: npx prettier -c ./

      - name: Run Unit Tests
        run: npm test

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          # The role is set up via https://github.com/bifravst/ci
          # secrets.AWS_ACCOUNT_ID_CI is an organization secret
          role-to-assume: |
            arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_CI }}:role/${{ github.repository_owner }}-ci-${{ github.event.repository.name }}
          # vars.AWS_REGION_CI is an organization variable
          aws-region: ${{ vars.AWS_REGION_CI }}

      - name: Generate Stack ID
        run: |
          RANDOM_STRING=`node -e "const crypto = require('crypto'); process.stdout.write(crypto.randomBytes(Math.ceil(8 * 0.5)).toString('hex').slice(0, 8));"`
          echo "STACK_NAME=ppr-${RANDOM_STRING}" >> $GITHUB_ENV

      - name: Deploy solution stack
        run: npx cdk deploy --require-approval never

      - name: Run End-to-End Tests
        run: |
          set -o pipefail
          npx tsx ./feature-runner/run-features.ts | npx tsx ./feature-runner/console-reporter.ts

      - name: Semantic release
        if: github.ref == 'refs/heads/saga'
        id: semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx semantic-release

      - name: Trigger release workflow
        if: steps.semantic-release.outcome == 'success'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh workflow run cd.yaml

      - name: Clean up End-to-End test resources
        if: always()
        run: |
          npx cdk destroy -f