release.yml

name: Release Gem + Sync Terraform Provider

on:
  release:
    types: [published]
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Dry run (no pushes/tags/uploads)'
        required: false
        default: 'false'
        type: choice
        options: ['false', 'true']

permissions:
  contents: read

jobs:
  wait_ci:
    name: Wait for CI success on tag
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Determine tag and SHA
        id: ref
        shell: bash
        run: |
          TAG="${{ github.ref_type == 'tag' && github.ref_name || github.event.release.tag_name }}"
          if [[ -z "$TAG" ]]; then
            echo "No tag from event; using placeholder for dry-run if applicable" >&2
            TAG="v0.0.0-dryrun"
          fi
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            SHA="${{ github.sha }}"
          else
            SHA=$(git rev-list -n1 "$TAG" || true)
          fi
          echo "tag=$TAG" >> $GITHUB_OUTPUT
          echo "sha=$SHA" >> $GITHUB_OUTPUT

      - name: Install jq
        run: sudo apt-get update && sudo apt-get install -y jq

      - name: Wait for CI workflow
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          # Skip wait for manual dry-run
          if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ github.event.inputs.dry_run }}" == "true" ]]; then
            echo "Dry-run dispatch: skipping CI wait."
            exit 0
          fi
          SHA="${{ steps.ref.outputs.sha }}"
          if [[ -z "$SHA" ]]; then
            echo "No SHA resolved; skipping CI wait."
            exit 0
          fi
          echo "Waiting for CI to succeed for $SHA ..."
          ATTEMPTS=120
          SLEEP=10
          for i in $(seq 1 $ATTEMPTS); do
            RESP=$(curl -s -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
              "https://api.github.com/repos/${{ github.repository }}/actions/runs?per_page=50&head_sha=$SHA")
            STATUS=$(echo "$RESP" | jq -r '.workflow_runs[] | select(.name=="CI") | .status' | head -n1)
            CONCLUSION=$(echo "$RESP" | jq -r '.workflow_runs[] | select(.name=="CI") | .conclusion' | head -n1)
            if [[ "$STATUS" == "completed" ]]; then
              if [[ "$CONCLUSION" == "success" ]]; then
                echo "CI succeeded."
                exit 0
              else
                echo "CI completed with conclusion: $CONCLUSION"
                exit 1
              fi
            fi
            echo "CI status: ${STATUS:-not found}; waiting... ($i/$ATTEMPTS)"
            sleep $SLEEP
          done
          echo "Timed out waiting for CI to complete."
          exit 1

  gem:
    name: Publish RubyGem
    needs: wait_ci
    runs-on: ubuntu-latest
    env:
      DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true' && 'true' || 'false' }}
      TAG_NAME: ${{ github.ref_type == 'tag' && github.ref_name || github.event.release.tag_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '.ruby-version'
          bundler-cache: true

      - name: Determine version and validate tag
        id: ver
        shell: bash
        run: |
          TAG="${TAG_NAME:-}"
          if [[ -z "$TAG" ]]; then
            echo "No tag resolved; using release event tag." >&2
            TAG="${{ github.event.release.tag_name }}"
          fi
          if [[ -z "$TAG" ]]; then
            if [[ "$DRY_RUN" == "true" ]]; then
              TAG="v0.0.0-dryrun"
              echo "DRY-RUN: Using placeholder tag $TAG" >&2
            else
              echo "Error: Could not determine tag name from event." >&2
              exit 1
            fi
          fi
          VERSION_FROM_TAG="${TAG#v}"
          VERSION_RB=$(ruby -e 'print File.read("lib/log_struct/version.rb")[/VERSION\s*=\s*"([^"]+)"/,1]')
          echo "tag=$TAG" >> $GITHUB_OUTPUT
          echo "version_tag=$VERSION_FROM_TAG" >> $GITHUB_OUTPUT
          echo "version_rb=$VERSION_RB" >> $GITHUB_OUTPUT
          echo "Resolved tag: $TAG (version $VERSION_FROM_TAG); code version: $VERSION_RB"
          if [[ "$DRY_RUN" != "true" && "$VERSION_FROM_TAG" != "$VERSION_RB" ]]; then
            echo "::error::Tag version ($VERSION_FROM_TAG) does not match lib/log_struct/version.rb ($VERSION_RB). Update version.rb before tagging, or run as dry-run."
            exit 1
          fi

      - name: Build gem
        run: |
          gem build logstruct.gemspec
          ls -la *.gem

      - name: Publish gem to RubyGems
        if: env.DRY_RUN != 'true'
        env:
          RUBYGEMS_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }}
        run: |
          if [[ -z "$RUBYGEMS_API_KEY" ]]; then
            echo '::error::RUBYGEMS_API_KEY secret is missing.'
            exit 1
          fi
          mkdir -p ~/.gem
          umask 077
          cat > ~/.gem/credentials <<EOF
          ---
          :rubygems_api_key: $RUBYGEMS_API_KEY
          EOF
          VERSION="${{ steps.ver.outputs.version_tag }}"
          GEM_FILE="logstruct-${VERSION}.gem"
          ALT_VERSION="${VERSION/-/.pre.}"
          ALT_GEM_FILE="logstruct-${ALT_VERSION}.gem"
          if [[ -f "$GEM_FILE" ]]; then
            echo "Using gem file: $GEM_FILE"
          elif [[ -f "$ALT_GEM_FILE" ]]; then
            echo "Using gem file: $ALT_GEM_FILE (RubyGems prerelease normalization)"
            GEM_FILE="$ALT_GEM_FILE"
          else
            CANDIDATE=$(ls -1t logstruct-*.gem 2>/dev/null | head -n1 || true)
            if [[ -n "$CANDIDATE" ]]; then
              echo "Falling back to: $CANDIDATE"
              GEM_FILE="$CANDIDATE"
            else
              echo "::error::Expected gem file for version $VERSION not found."
              ls -la *.gem || true
              exit 1
            fi
          fi
          gem push "$GEM_FILE"

      - name: Gem publish (dry-run)
        if: env.DRY_RUN == 'true'
        run: |
          VERSION="${{ steps.ver.outputs.version_tag }}"
          ALT_VERSION="${VERSION/-/.pre.}"
          CANDIDATE="logstruct-${VERSION}.gem"
          if [[ ! -f "$CANDIDATE" && -f "logstruct-${ALT_VERSION}.gem" ]]; then
            CANDIDATE="logstruct-${ALT_VERSION}.gem"
          fi
          echo "[DRY-RUN] Would push gem $CANDIDATE to RubyGems"

  provider:
    name: Sync + Tag Provider
    needs: wait_ci
    runs-on: ubuntu-latest
    env:
      DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true' && 'true' || 'false' }}
      TAG_NAME: ${{ github.ref_type == 'tag' && github.ref_name || github.event.release.tag_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '.ruby-version'
          bundler-cache: true

      - name: Determine version and validate tag
        id: ver
        shell: bash
        run: |
          TAG="${TAG_NAME:-}"
          if [[ -z "$TAG" ]]; then
            echo "No tag resolved; using release event tag." >&2
            TAG="${{ github.event.release.tag_name }}"
          fi
          if [[ -z "$TAG" ]]; then
            if [[ "$DRY_RUN" == "true" ]]; then
              TAG="v0.0.0-dryrun"
              echo "DRY-RUN: Using placeholder tag $TAG" >&2
            else
              echo "Error: Could not determine tag name from event." >&2
              exit 1
            fi
          fi
          VERSION_FROM_TAG="${TAG#v}"
          VERSION_RB=$(ruby -e 'print File.read("lib/log_struct/version.rb")[/VERSION\s*=\s*"([^"]+)"/,1]')
          echo "tag=$TAG" >> $GITHUB_OUTPUT
          echo "version_tag=$VERSION_FROM_TAG" >> $GITHUB_OUTPUT
          echo "version_rb=$VERSION_RB" >> $GITHUB_OUTPUT
          echo "Resolved tag: $TAG (version $VERSION_FROM_TAG); code version: $VERSION_RB"
          if [[ "$DRY_RUN" != "true" && "$VERSION_FROM_TAG" != "$VERSION_RB" ]]; then
            echo "::error::Tag version ($VERSION_FROM_TAG) does not match lib/log_struct/version.rb ($VERSION_RB). Update version.rb before tagging, or run as dry-run."
            exit 1
          fi

      - name: Generate docs exports (enums/structs/keys)
        run: scripts/generate_structs.rb

      - name: Clone terraform-provider-logstruct repository
        env:
          PUSH_TOKEN: ${{ secrets.TF_PROVIDER_GITHUB_TOKEN }}
        run: |
          git config --global user.name "DocSpring Bot"
          git config --global user.email "docspring-bot@docspring.com"
          rm -rf terraform-provider-logstruct
          git clone https://x-access-token:${PUSH_TOKEN}@github.com/DocSpring/terraform-provider-logstruct.git terraform-provider-logstruct

      - name: Export provider catalog (embedded Go data)
        run: ruby scripts/export_provider_catalog.rb

      - name: Build provider to validate catalog
        uses: actions/setup-go@v5
        with:
          go-version: '1.22'

      - name: Compile
        run: |
          cd terraform-provider-logstruct
          go mod tidy
          go build ./...

      - name: Commit and push provider changes
        env:
          PUSH_TOKEN: ${{ secrets.TF_PROVIDER_GITHUB_TOKEN }}
        run: |
          cd terraform-provider-logstruct
          if git diff --quiet; then
            echo "No provider changes to commit."
            exit 0
          fi
          git add pkg/data/catalog_gen.go pkg/data/catalog.json go.mod go.sum || true
          if [[ "$DRY_RUN" == "true" ]]; then
            echo "[DRY-RUN] Would commit and push provider catalog changes with message:"
            echo "Sync catalog from logstruct ${{ steps.ver.outputs.tag }}"
            git --no-pager diff --staged || true
          else
            git commit -m "Sync catalog from logstruct ${{ steps.ver.outputs.tag }}"
            git push origin HEAD:main
          fi

      - name: Tag provider with release version
        env:
          PUSH_TOKEN: ${{ secrets.TF_PROVIDER_GITHUB_TOKEN }}
        run: |
          cd terraform-provider-logstruct
          TAG="${{ steps.ver.outputs.tag }}"
          if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then
            echo "Tag $TAG already exists; skipping."
            exit 0
          fi
          if [[ "$DRY_RUN" == "true" ]]; then
            echo "[DRY-RUN] Would create and push tag $TAG"
          else
            git tag -a "$TAG" -m "Release $TAG (logstruct sync)"
            git push origin "$TAG"
          fi