deploy.yml

name: Deploy

on:
  push:
    tags:
      - "*"
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

jobs:
  test:
    name: Test
    uses: ./.github/workflows/test.yml
    with:
      suite: default
    secrets:
      ORCHESTRATE_API_KEY: ${{ secrets.ORCHESTRATE_API_KEY }}
      ORCHESTRATE_IDENTITY_API_KEY: ${{ secrets.ORCHESTRATE_IDENTITY_API_KEY }}
      ORCHESTRATE_IDENTITY_METRICS_KEY: ${{ secrets.ORCHESTRATE_IDENTITY_METRICS_KEY }}
      ORCHESTRATE_IDENTITY_URL: ${{ secrets.ORCHESTRATE_IDENTITY_URL }}

  version:
    name: Version
    outputs:
      version: ${{ steps.version.outputs.version }}
      target: ${{ steps.version.outputs.target }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Get Version
        id: version
        working-directory: typescript
        shell: pwsh
        run: |
          if ("${{ github.ref_type }}" -eq "tag") {
            $version = "${{ github.ref }}" -replace "refs/tags/(.*)", '$1'
            $target = "prod"
          } else {
            $version = git describe --tags --abbrev=0 | Select-Object -First 1
            $versionSuffix = "dev" + "${{ github.run_number }}"
            $version = $version, $versionSuffix -join "-"
            $target = "dev"
          }

          "version=$version" >> $Env:GITHUB_OUTPUT
          "target=$target" >> $Env:GITHUB_OUTPUT
          "Building version ``$version``" >> $Env:GITHUB_STEP_SUMMARY

  typescript:
    name: Typescript
    needs:
      - test
      - version
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"
      - name: Update npm
        run: npm install -g npm@latest
      - name: Install dependencies
        working-directory: typescript
        run: npm install
      - name: Build
        working-directory: typescript
        run: npm run build
      - name: Set Version
        working-directory: typescript
        run: npm version ${{ needs.version.outputs.version }}

      - name: Deploy Proget
        working-directory: typescript
        if: needs.version.outputs.target == 'dev'
        run: |
          npm config set @careevolution:registry=https://proget.careevolution.com/npm/npm/
          npm config set //proget.careevolution.com/npm/npm/:_authToken ${{ secrets.PROGET_TOKEN }}
          npm publish
          echo "Published `${{ needs.version.outputs.version }}` to internal NPM." >> $GITHUB_STEP_SUMMARY
      - name: Deploy NPM
        if: needs.version.outputs.target == 'prod'
        working-directory: typescript
        run: |
          npm publish --provenance --access public
          echo "Published `${{ needs.version.outputs.version }}` to NPM." >> $GITHUB_STEP_SUMMARY

  python:
    name: Python
    permissions:
      id-token: write
      contents: read
    needs:
      - test
      - version
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Python
        id: setup-python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.14"
      - name: Install Poetry
        run: |
          curl -sSL https://install.python-poetry.org | python -
          echo "$HOME/.poetry/bin" >> $GITHUB_PATH
      - name: Copy README
        run: cp ./README.md python/README.md
      - name: Install Dependencies
        working-directory: python
        run: poetry install --no-interaction --only "main"
      - name: Assign Version
        working-directory: python
        run: poetry version ${{ needs.version.outputs.version }}
      - name: Configure Pypi Tokens
        shell: pwsh
        run: |
          $pypis = @(
            @{ Name = "testpypi"; Url = "https://test.pypi.org" }
          )
          if ("${{ needs.version.outputs.target }}" -eq "prod") {
            $pypis += @{ Name = "pypi"; Url = "https://upload.pypi.org" }
          }

          $pypis | ForEach-Object {
            $pypiName = $_.Name
            $pypiUrl = $_.Url
            $githubToken = Invoke-RestMethod `
              -Uri "${Env:ACTIONS_ID_TOKEN_REQUEST_URL}&audience=$pypiName" `
              -Headers @{"Authorization" = "Bearer ${Env:ACTIONS_ID_TOKEN_REQUEST_TOKEN}"} |
              Select-Object -ExpandProperty value
            Write-Host "::add-mask::$githubToken"
            $pypiToken = Invoke-RestMethod `
              -Method Post `
              -Uri "$pypiUrl/_/oidc/github/mint-token" `
              -Body (@{ token = $githubToken } | ConvertTo-Json -Compress) |
              Select-Object -ExpandProperty token
            Write-Host "::add-mask::$pypiToken"

            poetry config repositories.$pypiName "$pypiUrl/legacy/"
            poetry config pypi-token.$pypiName $pypiToken
          }

      - name: Publish Test Pypi
        shell: pwsh
        working-directory: python
        if: needs.version.outputs.target == 'dev'
        run: |
          poetry publish --build --no-interaction -r testpypi

          $version = poetry version
          Write-Host "Published ``$version`` to test PyPI." >> $Env:GITHUB_STEP_SUMMARY
      - name: Publish Pypi
        shell: pwsh
        if: needs.version.outputs.target == 'prod'
        working-directory: python
        run: |
          poetry publish --build --no-interaction -r pypi
          $version = poetry version
          Write-Host "Published ``$version`` to Pypi." >> $Env:GITHUB_STEP_SUMMARY

  csharp:
    name: CSharp
    permissions:
      id-token: write
      contents: read
      packages: write
    needs:
      - test
      - version
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Setup .NET
        uses: actions/setup-dotnet@v5.4.0 # v5.2.0
        with:
          dotnet-version: |
            8.0.x
            10.0.x
      - name: Restore dotnet tools
        working-directory: dotnet
        run: dotnet tool restore
      - name: Check formatting
        working-directory: dotnet
        run: dotnet csharpier check .
      - name: Restore dependencies
        working-directory: dotnet
        run: dotnet restore OrchestrateSDK.DotNet.sln
      - name: Pack
        working-directory: dotnet
        run: dotnet pack src/CareEvolution.Orchestrate/CareEvolution.Orchestrate.csproj --configuration Release --no-restore -p:Version=${{ needs.version.outputs.version }} -o ./artifacts
      - name: Upload package artifact
        if: needs.version.outputs.target == 'dev'
        uses: actions/upload-artifact@v7
        with:
          name: csharp-nuget-package-${{ needs.version.outputs.version }}
          path: dotnet/artifacts/*.nupkg
      - name: Publish NuGet
        if: needs.version.outputs.target == 'prod'
        working-directory: dotnet
        run: |
          dotnet nuget push ./artifacts/*.nupkg \
            --source https://proget.careevolution.com/nuget/nuget/ \
            --api-key ${{ secrets.PROGET_TOKEN }} \
            --skip-duplicate
          echo "Published `${{ needs.version.outputs.version }}` to NuGet.org." >> $GITHUB_STEP_SUMMARY