configure-aws-credentials/.github/workflows/release.yml

name: Update release tags

on:
  workflow_dispatch:
    inputs:
      v1:
        description: 'Update v1 release tag to the tip of the selected branch'
        required: false
        type: boolean
      v1-versioned:
        description: 'Push a new release semantic versioned tag to the selected branch'
        required: false
        type: boolean

jobs:
  v1:
    name: Update v1 release tag
    if: ${{ v1 }}
    timeout-minutes: 15
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1-node16
        with:
          aws-region: us-west-2
          role-to-assume: ${{ secrets.SECRETS_AWS_ROLE_TO_ASSUME }}
          role-session-name: SecretsManagerFetch
          role-duration-seconds: 900
      - name: Get bot user token
        uses: aws-actions/aws-secretsmanager-get-secrets@v1
        with:
          parse-json-secrets: true
          secret-ids: |
            OSDS,arn:aws:secretsmanager:us-west-2:294535624312:secret:github-aws-sdk-osds-automation-ZHNalp
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          ref: ${{ github.ref_name }}
          token: ${{ env.OSDS_ACCESS_TOKEN }}
      - name: Push tag
        run: |
          echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}"
          git config --global user.name "GitHub Actions"
          git tag -f -a v1 -m "Update v1 to ${{ github.sha }}"
          git push https://${{ env.OSDS_ACCESS_TOKEN }}@github.com/aws-actions/configure-aws-credentials.git -f --tags
  v1-versioned:
    description: 'Push a new semantic version tag'
    if: ${{ v1-versioned }}
    timeout-minutes: 15
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1-node16
        with:
          aws-region: us-west-2
          role-to-assume: ${{ secrets.SECRETS_AWS_ROLE_TO_ASSUME }}
          role-session-name: SecretsManagerFetch
          role-duration-seconds: 900
      - name: Get bot user token
        uses: aws-actions/aws-secretsmanager-get-secrets@v1
        with:
          parse-json-secrets: true
          secret-ids: |
            OSDS,arn:aws:secretsmanager:us-west-2:294535624312:secret:github-aws-sdk-osds-automation-ZHNalp
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          ref: ${{ github.ref_name }}
          token: ${{ env.OSDS_ACCESS_TOKEN }}
      - name: Get new semantic version
        id: semver
        uses: paulhatch/semantic-version@v4.0.2
        with:
          tag_prefix: 'v'
          major_pattern: '!'
      - name: Push semantic tag
        run: |
          echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}"
          git config --global user.name "GitHub Actions"
          git tag -f -a ${{ steps.semver.version_tag }} -m "New ${{ steps.semver.version_tag }} release"
          git push https://${{ env.OSDS_ACCESS_TOKEN }}@github.com/aws-actions/configure-aws-credentials.git -f --tags