VACMS-16476: production tag workflow (#336)

.github/workflows/production-tag.yml

@@ -0,0 +1,128 @@
+name: Create Production Tag
+
+on:
+  workflow_dispatch:
+  workflow_run:
+    workflows: ['Continuous Integration']
+    types: [completed]
+    branches: [main]
+
+concurrency:
+  group: production-tag
+  cancel-in-progress: true
+
+env:
+  SLACK_CHANNEL: C06DSBT7CBW #status-next-build
+  DSVA_SCHEDULE_ENABLED: true
+
+jobs:
+  create-production-tag:
+    name: Create Production Tag
+    runs-on: ubuntu-latest
+    # Run the workflow unless it was triggered by CI and that failed
+    if: ${{ !(github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'failure') }}
+    outputs:
+      RELEASE_NAME: ${{ steps.export-release-name.outputs.RELEASE_NAME }}
+    permissions:
+      id-token: write
+      contents: write
+
+    steps:
+      - name: Cancel workflow due to DSVA schedule, unless this is a manual build
+        if: ${{ github.event_name != 'workflow_dispatch' && env.DSVA_SCHEDULE_ENABLED != 'true' }}
+        uses: andymckay/cancel-action@b9280e3f8986d7a8e91c7462efc0fa318010c8b1 # v0.3
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
+        with:
+          role-to-assume: ${{ vars.AWS_ASSUME_ROLE }}
+          aws-region: us-gov-west-1
+
+      - name: Get bot token from Parameter Store
+        uses: department-of-veterans-affairs/action-inject-ssm-secrets@d8e6de3bde4dd728c9d732baef58b3c854b8c4bb # latest
+        with:
+          ssm_parameter: /devops/VA_VSP_BOT_GITHUB_TOKEN
+          env_variable_name: VA_VSP_BOT_GITHUB_TOKEN
+
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+
+      - name: Install Npm Dependencies
+        run: |
+          yarn set version 3.6.1
+          HUSKY=0 yarn install --immutable
+
+      - name: Get current ref
+        id: get-current-ref
+        run: echo REF=$(git rev-parse HEAD) >> $GITHUB_OUTPUT
+
+      - name: Get latest tag
+        id: get-latest-tag
+        run: echo LATEST_TAG_VERSION=$(git fetch --all --tags > /dev/null && git tag -l | sort -V --reverse | head -n 1) >> $GITHUB_OUTPUT
+
+      - name: Get next tag version
+        run: |
+          next_increment=$(( $(echo ${{ steps.get-latest-tag.outputs.LATEST_TAG_VERSION }} | cut -d'.' -f3) + 1))
+          echo "NEW_TAG=$(echo ${{ steps.get-latest-tag.outputs.LATEST_TAG_VERSION }} | sed -E "s/\.[0-9]+/.$next_increment/2")" >> $GITHUB_ENV
+
+      - name: Create next tag
+        uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd # v2.8.3
+        with:
+          timeout_seconds: 30
+          max_attempts: 3
+          command: git tag ${{ env.NEW_TAG }} ${{ steps.get-current-ref.outputs.REF }} && git push --no-verify origin ${{ env.NEW_TAG }}
+          new_command_on_retry: git tag ${{ env.NEW_TAG }} ${{ steps.get-current-ref.outputs.REF }} && git push --no-verify origin ${{ env.NEW_TAG }}
+
+
+      - name: Create release
+        uses: ncipollo/release-action@a2e71bdd4e7dab70ca26a852f29600c98b33153e # v1.12.0
+        with:
+          tag: ${{ env.NEW_TAG }}
+          name: next-build/${{ env.new_NEW_TAG }}
+          token: ${{ env.VA_VSP_BOT_GITHUB_TOKEN }}
+          commit: ${{ steps.get-current-ref.outputs.REF }}
+
+      - name: Export new release name
+        id: export-release-name
+        run: |
+          echo RELEASE_NAME=${{ env.NEW_TAG }} >> $GITHUB_OUTPUT
+
+  notify-success:
+    name: Notify Success
+    runs-on: ubuntu-latest
+    needs: create-production-tag
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: Notify Slack
+        uses: department-of-veterans-affairs/platform-release-tools-actions/slack-notify@8c496a4b0c9158d18edcd9be8722ed0f79e8c5b4 # main
+        continue-on-error: true
+        with:
+          payload: '{"attachments": [{"color": "#07711E","blocks": [{"type": "section","text": {"type": "mrkdwn","text": "Successfully tagged new next-build release: ${{ needs.create-production-tag.outputs.RELEASE_NAME }}"}}]}]}'
+          channel_id: ${{ env.SLACK_CHANNEL }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+  notify-failure:
+    name: Notify Failure
+    runs-on: ubuntu-latest
+    if: ${{ failure() || cancelled() }}
+    needs: create-production-tag
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: Notify Slack
+        if: ${{ env.DSVA_SCHEDULE_ENABLED == 'true' }}
+        uses: department-of-veterans-affairs/platform-release-tools-actions/slack-notify@8c496a4b0c9158d18edcd9be8722ed0f79e8c5b4 # main
+        continue-on-error: true
+        with:
+          payload: '{"attachments": [{"color": "#D33834","blocks": [{"type": "section","text": {"type": "mrkdwn","text": ">!here< New next-build release could not be tagged!: <https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}>"}}]}]}'
+          channel_id: ${{ env.SLACK_CHANNEL }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}