---
  name: Release Please
  on:
    push:
      branches:
        - main
    workflow_dispatch:

  permissions:
    id-token: write
    contents: write
    pull-requests: write

  jobs:
    release-please:
      runs-on: ubuntu-latest
      steps:
        - name: Checkout Repository
          uses: actions/checkout@v5
          with:
            fetch-depth: 0

        - name: Configure AWS Credentials
          uses: aws-actions/configure-aws-credentials@v6
          with:
            aws-region: us-west-2
            role-to-assume: ${{ secrets.SECRETS_AWS_PACKAGING_ROLE_TO_ASSUME }}
            role-duration-seconds: 900
            role-session-name: ${{ github.run_id }}

        - name: Get git credentials
          uses: aws-actions/aws-secretsmanager-get-secrets@v2
          with:
            parse-json-secrets: true
            secret-ids: |
              ${{ secrets.OSDS_PACKAGING_ROLE }}

        - name: Run release-please
          id: release
          uses: googleapis/release-please-action@v4
          with:
            release-type: node
            token: ${{ env.OSDS_ACCESS_TOKEN }}
            config-file: release-please-config.json
            manifest-file: .release-please-manifest.json

        - name: Checkout Again
          uses: actions/checkout@v5
          with:
            fetch-depth: 0
            persist-credentials: false

        - name: Tag Major Version
          if: ${{ steps.release.outputs.release_created }}
          run: |
            git config user.name "GitHub Actions"
            git config user.email "github-aws-sdk-osds-automation@amazon.com"
            echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}"
            git remote set-url origin https://${{ env.OSDS_ACCESS_TOKEN }}@github.com/aws-actions/configure-aws-credentials.git
            if git rev-parse "v${{ steps.release.outputs.major }}" >/dev/null 2>&1; then
              git tag -d "v${{ steps.release.outputs.major }}"
              git push origin ":v${{ steps.release.outputs.major }}"
            fi
            git tag -a "v${{ steps.release.outputs.major }}" -m "Release v${{ steps.release.outputs.major }}"
            git push origin "v${{ steps.release.outputs.major }}"

        - name: Update README version references
          if: ${{ steps.release.outputs.release_created }}
          run: |
            sed -i 's|configure-aws-credentials@v[0-9]*\.[0-9]*\.[0-9]*|configure-aws-credentials@${{ steps.release.outputs.tag_name }}|g' README.md
            if git diff --quiet README.md; then
              echo "README already up to date"
            else
              echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}"
              git remote set-url origin https://${{ env.OSDS_ACCESS_TOKEN }}@github.com/aws-actions/configure-aws-credentials.git
              git add README.md
              git commit -m "docs: update README version references to ${{ steps.release.outputs.tag_name }}"
              git push --force origin
            fi