infisical/.github/workflows/release_build_infisical_cli.yml

name: Build and release CLI

on:
  workflow_dispatch:

  push:
    # run only against tags
    tags:
      - "infisical-cli/v*.*.*"

permissions:
  contents: write

jobs:
  cli-integration-tests:
    name: Run tests before deployment
    uses: ./.github/workflows/run-cli-tests.yml
    secrets:
      CLI_TESTS_UA_CLIENT_ID: ${{ secrets.CLI_TESTS_UA_CLIENT_ID }}
      CLI_TESTS_UA_CLIENT_SECRET: ${{ secrets.CLI_TESTS_UA_CLIENT_SECRET }}
      CLI_TESTS_SERVICE_TOKEN: ${{ secrets.CLI_TESTS_SERVICE_TOKEN }}
      CLI_TESTS_PROJECT_ID: ${{ secrets.CLI_TESTS_PROJECT_ID }}
      CLI_TESTS_ENV_SLUG: ${{ secrets.CLI_TESTS_ENV_SLUG }}
      CLI_TESTS_USER_EMAIL: ${{ secrets.CLI_TESTS_USER_EMAIL }}
      CLI_TESTS_USER_PASSWORD: ${{ secrets.CLI_TESTS_USER_PASSWORD }}
      CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE: ${{ secrets.CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE }}

  npm-release:
    runs-on: ubuntu-latest
    env:
      working-directory: ./npm
    needs:
      - cli-integration-tests
      - goreleaser
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Extract version
        run: |
          VERSION=$(echo ${{ github.ref_name }} | sed 's/infisical-cli\/v//')
          echo "Version extracted: $VERSION"
          echo "CLI_VERSION=$VERSION" >> $GITHUB_ENV

      - name: Print version
        run: echo ${{ env.CLI_VERSION }}

      - name: Setup Node
        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
        with:
          node-version: 20
          cache: "npm"
          cache-dependency-path: ./npm/package-lock.json
      - name: Install dependencies
        working-directory: ${{ env.working-directory }}
        run: npm install --ignore-scripts

      - name: Set NPM version
        working-directory: ${{ env.working-directory }}
        run: npm version ${{ env.CLI_VERSION }} --allow-same-version --no-git-tag-version

      - name: Setup NPM
        working-directory: ${{ env.working-directory }}
        run: |
          echo 'registry="https://registry.npmjs.org/"' > ./.npmrc
          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ./.npmrc

          echo 'registry="https://registry.npmjs.org/"' > ~/.npmrc
          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Pack NPM
        working-directory: ${{ env.working-directory }}
        run: npm pack

      - name: Publish NPM
        working-directory: ${{ env.working-directory }}
        run: npm publish --tarball=./infisical-sdk-${{github.ref_name}} --access public --registry=https://registry.npmjs.org/
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  goreleaser:
    runs-on: ubuntu-latest
    needs: [cli-integration-tests]
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: 🐋 Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: 🔧 Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - run: git fetch --force --tags
      - run: echo "Ref name ${{github.ref_name}}"
      - uses: actions/setup-go@v3
        with:
          go-version: ">=1.19.3"
          cache: true
          cache-dependency-path: cli/go.sum
      - name: Setup for libssl1.0-dev
        run: |
          echo 'deb http://security.ubuntu.com/ubuntu bionic-security main' | sudo tee -a /etc/apt/sources.list
          sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
          sudo apt update
          sudo apt-get install -y libssl1.0-dev
      - name: OSXCross for CGO Support
        run: |
          mkdir ../../osxcross
          git clone https://github.com/plentico/osxcross-target.git ../../osxcross/target
      - uses: goreleaser/goreleaser-action@v4
        with:
          distribution: goreleaser-pro
          version: v1.26.2-pro
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GO_RELEASER_GITHUB_TOKEN }}
          POSTHOG_API_KEY_FOR_CLI: ${{ secrets.POSTHOG_API_KEY_FOR_CLI }}
          FURY_TOKEN: ${{ secrets.FURYPUSHTOKEN }}
          AUR_KEY: ${{ secrets.AUR_KEY }}
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
      - uses: actions/setup-python@v4
      - run: pip install --upgrade cloudsmith-cli
      - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252
        with:
          ruby-version: "3.3" # Not needed with a .ruby-version, .tool-versions or mise.toml
          bundler-cache: true # runs 'bundle install' and caches installed gems automatically
      - name: Install deb-s3
        run: gem install deb-s3
      - name: Configure GPG Key
        run: echo -n "$GPG_SIGNING_KEY" | base64 --decode | gpg --batch --import
        env:
          GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
          GPG_SIGNING_KEY_PASSPHRASE: ${{ secrets.GPG_SIGNING_KEY_PASSPHRASE }}
      - name: Publish to CloudSmith
        run: sh cli/upload_to_cloudsmith.sh
        env:
          CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
          INFISICAL_CLI_S3_BUCKET: ${{ secrets.INFISICAL_CLI_S3_BUCKET }}
          INFISICAL_CLI_REPO_SIGNING_KEY_ID: ${{ secrets.INFISICAL_CLI_REPO_SIGNING_KEY_ID }}
          AWS_ACCESS_KEY_ID: ${{ secrets.INFISICAL_CLI_REPO_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.INFISICAL_CLI_REPO_AWS_SECRET_ACCESS_KEY }}
      - name: Invalidate Cloudfront cache
        run: aws cloudfront create-invalidation --distribution-id $CLOUDFRONT_DISTRIBUTION_ID --paths '/deb/dists/stable/*'
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.INFISICAL_CLI_REPO_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.INFISICAL_CLI_REPO_AWS_SECRET_ACCESS_KEY }}
          CLOUDFRONT_DISTRIBUTION_ID: ${{ secrets.INFISICAL_CLI_REPO_CLOUDFRONT_DISTRIBUTION_ID }}