release.yml

name: Release, publish, and deploy
on:
  push:
    branches:
      - main
  workflow_dispatch:

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: ${{ github.repository }}
  COMMIT_MESSAGE: ${{ github.event.commits[0].message }}

permissions:
  contents: read # for checkout

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write # to be able to publish a GitHub release
      issues: write # to be able to comment on released issues
      pull-requests: write # to be able to comment on released pull requests
      id-token: write # to enable use of OIDC for npm provenance
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Node.js and pnpm
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 11.20.0
      - name: Install dependencies
        env:
          HUSKY: 0 # skip husky install to avoid running git hooks during CI
        run: pnpm install --frozen-lockfile --ignore-scripts
      - name: Validate current commit
        run: npx commitlint --last --verbose
      - name: Run tests and typecheck
        run: |
          pnpm test --runInBand
          pnpm typecheck
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx semantic-release

  publish:
    runs-on: ubuntu-latest
    needs: release
    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}

      # Install the cosign tool except on PR
      # https://github.com/sigstore/cosign-installer
      - name: Install cosign
        if: github.event_name != 'pull_request'
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
        with:
          cosign-release: 'v2.2.4'

      # Set up BuildKit Docker container builder to be able to build
      # multi-platform images and export cache
      # https://github.com/docker/setup-buildx-action
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0

      # Login against a Docker registry except on PR
      # https://github.com/docker/login-action
      - name: Log into registry ${{ env.REGISTRY }}
        if: github.event_name != 'pull_request'
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Extract metadata (tags, labels) for Docker
      # https://github.com/docker/metadata-action
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Sign the resulting Docker image digest except on PRs.
      # This will only write to the public Rekor transparency log when the Docker
      # repository is public to avoid leaking data.  If you would like to publish
      # transparency data even for private images, pass --force to cosign below.
      # https://github.com/sigstore/cosign
      - name: Sign the published Docker image
        if: ${{ github.event_name != 'pull_request' }}
        env:
          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
          TAGS: ${{ steps.meta.outputs.tags }}
          DIGEST: ${{ steps.build-and-push.outputs.digest }}
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance.
        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

  deploy:
    runs-on: ubuntu-latest
    needs: publish
    steps:
      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.SSH_HOST }}
          username: ${{ secrets.SSH_USERNAME }}
          key: ${{ secrets.SSH_KEY }}
          passphrase: ${{ secrets.SSH_PASSPHRASE }}
          script: |
            set -e
            cd ${{ secrets.DEPLOY_PATH}}
            echo ${{ secrets.GH_PAT }} | docker login ghcr.io -u ${{ secrets.GH_USER }} --password-stdin
            docker pull ${{ env.REGISTRY }}/cfbd/cbb-api:main
            docker compose up -d
            docker image prune -f || echo "Image cleanup skipped; deployment completed"

  discord:
    needs: deploy
    runs-on: ubuntu-latest
    continue-on-error: true
    env:
      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
    steps:
      - name: Install dependencies
        run: |
          sudo apt install jq -y
          sudo apt install curl -y
      - name: Get API version
        run: |
          api_version=$(curl https://api.collegebasketballdata.com/api-docs.json | jq .info.version)
          api_version=${api_version%\"}
          api_version=${api_version#\"}
          echo "api_version=$api_version" >> $GITHUB_ENV
      - name: Send Discord message
        uses: sarisia/actions-status-discord@v1
        with:
          nodetail: true
          title: 'New version of CBB API deployed'
          url: 'https://github.com/CFBD/cbb-api'
          color: 0xf24f02
          description: |
            v${{ env.api_version}}
            - ${{ join(github.event.commits.*.message, fromJSON('"\n- "')) }}

  buildPython:
    needs: deploy
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: Install dependencies
        run: |
          sudo apt install wget -y
          sudo apt install unzip -y
          sudo apt install jq -y
          sudo apt install curl -y
      - name: Generate library
        id: generate
        run: |
          api_version=$(curl https://api.collegebasketballdata.com/api-docs.json | jq .info.version)
          api_version=${api_version%\"}
          api_version=${api_version#\"}
          package_version=(${api_version})
          code=$(curl -X POST -H "content-type:application/json" -d '{"openAPIUrl": "https://api.collegebasketballdata.com/api-docs.json", "options": { "packageName": "cbbd", "projectName": "cbbd", "packageUrl": "https://github.com/CFBD/cbbd-python", "packageVersion": "'"${package_version}"'"}}' https://api.openapi-generator.tech/api/gen/clients/python-pydantic-v1 | jq '. | .code')
          code=${code%\"}
          code=${code#\"}
          wget 'http://api.openapi-generator.tech/api/gen/download/'"${code}"''
          unzip $code
          echo "package_version=$package_version" >> $GITHUB_ENV
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          repository: cfbd/cbbd-python
          token: ${{ secrets.GH_PAT }}
          ref: main
          path: cbbd-python
      - name: Copy and push generated code
        run: |
          sudo yes | cp -a ./python-pydantic-v1-client/. cbbd-python
          cd cbbd-python
          rm .gitlab-ci.yml .travis.yml git_push.sh .github/workflows/python.yml
          sed -i '30,47d' README.md
          sed -i 's/git+https:\/\/\/\/.git/cbbd/g' README.md
          sed -i '18,19d' README.md
          sed -i 's/pip install cbbd/pip install cbbd@'"$package_version"'/g' README.md
          sed -i '38d' setup.py
          echo "Configuring git..."
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if git status --porcelain --
          then
            git add .
            echo "Committing changes ..."
            git commit -am "$COMMIT_MESSAGE"
            echo "Pushing to remote..."
            git push
          fi

  buildTypeScript:
    needs: deploy
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: Install dependencies
        run: |
          sudo apt install wget -y
          sudo apt install jq -y
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          repository: cfbd/cbbd-typescript
          token: ${{ secrets.GH_PAT }}
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install
      - name: Download spec
        run: |
          wget https://api.collegebasketballdata.com/api-docs.json
      - name: Set version number
        run: |
          api_version=$(cat api-docs.json | jq '. | .info.version')
          api_version=${api_version%\"}
          api_version=${api_version#\"}
          package_version=(${api_version})
          sed -i '/"version": /c\  "version": "'"$package_version"'",' package.json
      - name: Generate client
        run: |
          npx @hey-api/openapi-ts -i api-docs.json -o src -c @hey-api/client-fetch
          sed -i 's/createConfig()/createConfig({ baseUrl: '\''https:\/\/api.collegebasketballdata.com'\'' })/g' src/sdk.gen.ts
          sed -i '$a export * from '\''./client.gen'\'';' src/index.ts
      - name: Commit and push changes
        run: |
          echo "Configuring git..."
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if git status --porcelain --
          then
            git add .
            echo "Committing changes ..."
            git commit -am "$COMMIT_MESSAGE"
            echo "Pushing to remote..."
            git push
          fi

  buildR:
    needs: deploy
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: r-lib/actions/setup-r@v2
        with:
          use-public-rspm: true
      - uses: r-lib/actions/setup-r-dependencies@v2
        with:
          extra-packages: |
            jsonlite
            snakecase
            purrr
            stringr
            styler
            devtools
            data.table,
            janitor,
            keyring,
            RcppSimdJson
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          repository: CFBD/cbbd-r
          token: ${{ secrets.GH_PAT }}
          ref: main
          path: cbbd-r
      - name: Copy and push generated code
        run: |
          cd cbbd-r
          echo "Building package..."
          Rscript scripts/build-package.R
          echo "Configuring git..."
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if git status --porcelain --
          then
            git add .
            echo "Committing changes ..."
            git commit -am "$COMMIT_MESSAGE"
            echo "Pushing to remote..."
            git push
          fi