release.yml

name: "Release New Version"
run-name: "Release ${{ inputs.version }}"

on:
  workflow_dispatch:
    inputs:
      version:
        description: "The version to be released. This is checked for consistency with the branch name and configuration"
        required: true
        type: "string"
      jira-version-number:
        description: "JIRA version ID (e.g. 54321)"
        required: true
        type: "string"

env:
  default-release-message: |
    The PHP team is happy to announce that version {0} of the MongoDB PHP library is now available.

    **Release Highlights**

    TODO: one or more paragraphs describing important changes in this release

    A complete list of resolved issues in this release may be found in [JIRA](https://jira.mongodb.org/secure/ReleaseNote.jspa?version={1}&projectId=12483).

    **Documentation**

    Documentation for this library may be found in the [PHP Library Manual](https://mongodb.com/docs/php-library/current/).

    **Installation**

    This library may be installed or upgraded with:
    
      composer require mongodb/mongodb:{0}
      
    Installation instructions for the `mongodb` extension may be found in the [PHP.net documentation](https://php.net/manual/en/mongodb.installation.php).

jobs:
  prepare-release:
    environment: release
    name: "Prepare release"
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write

    steps:
      - name: "Create release output"
        run: echo '🎬 Release process for version ${{ inputs.version }} started by @${{ github.triggering_actor }}' >> $GITHUB_STEP_SUMMARY

      - name: "Generate token and checkout repository"
        uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
        with:
          app_id: ${{ vars.APP_ID }}
          private_key: ${{ secrets.APP_PRIVATE_KEY }}

      - name: "Store version numbers in env variables"
        run: |
          echo RELEASE_VERSION=${{ inputs.version }} >> $GITHUB_ENV
          echo RELEASE_VERSION_WITHOUT_STABILITY=$(echo ${{ inputs.version }} | awk -F- '{print $1}') >> $GITHUB_ENV
          echo RELEASE_BRANCH=v$(echo ${{ inputs.version }} | cut -d '.' -f-2) >> $GITHUB_ENV
          echo DEV_BRANCH=v$(echo ${{ inputs.version }} | cut -d '.' -f-1).x >> $GITHUB_ENV

      - name: "Ensure release tag does not already exist"
        run: |
          if [[ $(git tag -l ${RELEASE_VERSION}) == ${RELEASE_VERSION} ]]; then
            echo '❌ Release failed: tag for version ${{ inputs.version }} already exists' >> $GITHUB_STEP_SUMMARY
            exit 1
          fi

      # For patch releases (A.B.C where C != 0), we expect the release to be
      # triggered from the A.B maintenance branch
      - name: "Fail if patch release is created from wrong release branch"
        if: ${{ !endsWith(env.RELEASE_VERSION_WITHOUT_STABILITY, '.0') && env.RELEASE_BRANCH != github.ref_name }}
        run: |
          echo '❌ Release failed due to branch mismatch: expected ${{ inputs.version }} to be released from ${{ env.RELEASE_BRANCH }}, got ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
          exit 1

      # For non-patch releases (A.B.C where C == 0), we expect the release to
      # be triggered from the A.B maintenance branch or A.x development branch
      - name: "Fail if non-patch release is created from wrong release branch"
        if: ${{ endsWith(env.RELEASE_VERSION_WITHOUT_STABILITY, '.0') && env.RELEASE_BRANCH != github.ref_name && env.DEV_BRANCH != github.ref_name }}
        run: |
          echo '❌ Release failed due to branch mismatch: expected ${{ inputs.version }} to be released from ${{ env.RELEASE_BRANCH }} or ${{ env.DEV_BRANCH }}, got ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
          exit 1

      # If a non-patch release is created from its A.x development branch,
      # create the A.B maintenance branch from the current one and push it
      - name: "Create and push new release branch for non-patch release"
        if: ${{ endsWith(env.RELEASE_VERSION_WITHOUT_STABILITY, '.0') && env.DEV_BRANCH == github.ref_name }}
        run: |
          echo '🆕 Creating new release branch ${{ env.RELEASE_BRANCH }} from ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
          git checkout -b ${RELEASE_BRANCH}
          git push origin ${RELEASE_BRANCH}

      #
      # Preliminary checks done - commence the release process
      #

      - name: "Set up drivers-github-tools"
        uses: mongodb-labs/drivers-github-tools/setup@v3
        with:
          aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
          aws_region_name: ${{ vars.AWS_REGION_NAME }}
          aws_secret_id: ${{ secrets.AWS_SECRET_ID }}

      - name: "Prepare release message"
        run: |
          cat > release-message <<'EOL'
          ${{ format(env.default-release-message, inputs.version, inputs.jira-version-number) }}
          EOL

      - name: "Create draft release"
        run: echo "RELEASE_URL=$(gh release create ${{ inputs.version }} --target ${{ env.RELEASE_BRANCH }} --title "${{ inputs.version }}" --notes-file release-message --draft)" >> "$GITHUB_ENV"

      - name: "Create release tag"
        uses: mongodb-labs/drivers-github-tools/tag-version@v3
        with:
          version: ${{ inputs.version }}
          tag_message_template: 'Release ${VERSION}'

      # TODO: Manually merge using ours strategy. This avoids merge-up pull requests being created
      # Process is:
      # 1. switch to next branch (according to merge-up action)
      # 2. merge release branch using --strategy=ours
      # 3. push next branch
      # 4. switch back to release branch, then push

      - name: "Set summary"
        run: |
          echo '🚀 Created tag and drafted release for version [${{ inputs.version }}](${{ env.RELEASE_URL }})' >> $GITHUB_STEP_SUMMARY
          echo '✍️ You may now update the release notes and publish the release when ready' >> $GITHUB_STEP_SUMMARY

  static-analysis:
    needs: prepare-release
    name: "Run Static Analysis"
    uses: ./.github/workflows/static-analysis.yml
    with:
      ref: refs/tags/${{ inputs.version }}
    permissions:
      security-events: write
      id-token: write

  publish-ssdlc-assets:
    needs: static-analysis
    environment: release
    name: "Publish SSDLC Assets"
    runs-on: ubuntu-latest
    permissions:
      security-events: read
      id-token: write
      contents: write

    steps:
      - name: "Generate token and checkout repository"
        uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
        with:
          app_id: ${{ vars.APP_ID }}
          private_key: ${{ secrets.APP_PRIVATE_KEY }}
          ref: refs/tags/${{ inputs.version }}

      # Sets the S3_ASSETS environment variable used later
      - name: "Set up drivers-github-tools"
        uses: mongodb-labs/drivers-github-tools/setup@v3
        with:
          aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
          aws_region_name: ${{ vars.AWS_REGION_NAME }}
          aws_secret_id: ${{ secrets.AWS_SECRET_ID }}

      - name: "Generate SSDLC Reports"
        uses: mongodb-labs/drivers-github-tools/full-report@v3
        with:
          product_name: "MongoDB PHP Driver (library)"
          release_version: ${{ inputs.version }}
          silk_asset_group: mongodb-php-driver-library

      - name: "Upload SBOM as release artifact"
        run: gh release upload ${{ inputs.version }} ${{ env.S3_ASSETS }}/cyclonedx.sbom.json
        continue-on-error: true

      - name: Upload S3 assets
        uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3
        with:
          version: ${{ inputs.version }}
          product_name: mongo-php-library