publish-beta-package.yml

name: Sign Embedded Beta Package

on:
  pull_request:
    branches: [ "main" ]

env:
  NPM_REGISTRY_URL: "https://registry.npmjs.com"
  CDN_AWS_PUBLISH_ROLE: arn:aws:iam::654344198836:role/github-actions-oidc-role-nonprod-sign-embedded
  CDN_BUCKET: cdn.staging-hellosign.com
  CDN_PATH: public/js/embedded
  AWS_REGION: us-east-1
jobs:
  build:
    permissions:
      id-token: write # This is required for requesting the JWT
      contents: write # This is required for publishing releases
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [16.x] # we should pull this from a common place

    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          registry-url: ${{ env.NPM_REGISTRY_URL }}

      - name: Build
        run: |
          npm install
          npm run build

      - name: Test
        run: |
          npm test

      - name: Validate Semver
        id: version
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: .github/actions-scripts/validate-release-version.js --beta

      - name: Set Beta Version
        env:
          PACKAGE_VERSION: ${{ steps.version.outputs.version }}
        run: |
          echo "Setting beta version ${PACKAGE_VERSION}"
          npm version ${PACKAGE_VERSION} --no-git-tag-version

      - name: Pack
        run: |
          npm pack --pack-destination="./umd"

      - name: Create tag
        uses: actions/github-script@v5
        with:
          script: |
            github.rest.git.createRef({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: 'refs/tags/${{ steps.version.outputs.version }}',
              tag_name: 'v${{ steps.version.outputs.version }}',
              name: 'v${{ steps.version.outputs.version }}',
              draft: true,
              prerelease: true,
              sha: context.sha
            })

      - name: Publish Beta
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          npm publish --tag beta --provenance --access=public

      - name: Configure AWS credentials for Non-Prod
        id: awskeys
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.CDN_AWS_PUBLISH_ROLE }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Copy dev build to nonprod cdn
        run: aws s3 cp umd/embedded.development.js s3://${{ env.CDN_BUCKET }}/${{ env.CDN_PATH }}/v${{ steps.version.outputs.version }}/

      - name: Copy minified build to nonprod cdn
        run: aws s3 cp umd/embedded.production.min.js s3://${{ env.CDN_BUCKET }}/${{ env.CDN_PATH }}/v${{ steps.version.outputs.version }}/