cd.yml

# Builds package and publishes it on npm.
# Triggered on pushes to develop, master and release branches
name: CD

on:
  push:
    branches:
      - master
      - develop
      - release-*

env:
  HUSKY: 0

jobs:
  build:
    runs-on: ubuntu-latest
    environment: upload

    permissions:
        id-token: write # Required by Akeyless
        contents: read
        packages: read

    concurrency:
        group: ${{ github.ref }}-cd
        cancel-in-progress: false

    steps:
      - name: Import Secrets
        id: import-secrets
        uses: LanceMcCarthy/akeyless-action@v3
        with:
          access-id: ${{ secrets.GH_AKEYLESS_ACCESS_ID }}
          static-secrets: |
            {
              "${{ secrets.GH_AKEYLESS_GH_TOKEN_PATH }}": "GH_TOKEN",
              "${{ secrets.GH_AKEYLESS_NPM_TOKEN_PATH }}": "NPM_TOKEN"
            }
          export-secrets-to-environment: false

      - name: Check out branch
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Fetch all branches

      - name: Install modules
        run: npm ci --no-audit --no-fund

      - name: Verify attestations
        run: npm audit signatures

      - name: Build package
        run: npm run build-package

      - name: Run unit tests
        run: |
            npx http-server -s &
            npm run test

      - name: Publish release
        env:
          NPM_TOKEN: ${{ steps.import-secrets.outputs.NPM_TOKEN }}
          GH_TOKEN: ${{ steps.import-secrets.outputs.GH_TOKEN }}
        run: npx semantic-release