prerelease.yml

name: Pre-release main branch

on:
  push:
    branches:
      - main

permissions: {}

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pages: write
      id-token: write
    outputs:
      full-version: ${{ steps.bootstrap.outputs.full-version }}
      major-version: ${{ steps.bootstrap.outputs.major-version }}
    needs: [build]
    concurrency: 
      group: deploy-to-github-pages

    environment:
      name: github-pages
      url: ${{steps.deployment.outputs.page_url}}
    steps:
      - id: repo-basename
        run: 'echo "value=`basename ${{ github.repository }}`" >> $GITHUB_OUTPUT'
      - uses: actions/checkout@v7.0.1
        with:
          persist-credentials: false
      - name: Setup Pages
        id: pages
        uses: actions/configure-pages@v6.0.0
      - name: Build documentation
        uses: elastic/docs-builder@main
        with:
          prefix: '${{ steps.repo-basename.outputs.value }}'
      - name: Upload artifact
        uses: actions/upload-pages-artifact@v5.0.0
        with:
          path: .artifacts/docs/html
          
      - name: Deploy artifact
        id: deployment
        uses: actions/deploy-pages@v5.0.0

  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      # Required for `actions/attest-build-provenance`
      id-token: write
      attestations: write
      artifact-metadata: write
    outputs:
      full-version: ${{ steps.bootstrap.outputs.full-version }}
      major-version: ${{ steps.bootstrap.outputs.major-version }}

    steps:
      - uses: actions/checkout@v7.0.1
        with:
          persist-credentials: false

      - name: Bootstrap Action Workspace
        id: bootstrap
        uses: ./.github/actions/bootstrap

      # Restore npm dependencies explicitly for supply-chain checks
      - name: Restore npm dependencies
        working-directory: src/Elastic.Documentation.Site
        run: npm ci

      - name: Check shai-hulud supply-chain hashes
        uses: ./.github/actions/check-shai-hulud
        with:
          path: src/Elastic.Documentation.Site

      - name: Login to GitHub Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish Containers
        run: ./build.sh publishcontainers

      # Resolve the manifest digest of each pushed image so we can
      # mint a signed attestation against the immutable digest, not
      # the mutable :edge tag. Consumers verify with:
      #   gh attestation verify oci://ghcr.io/elastic/docs-builder@<digest> \
      #     -R elastic/docs-builder
      - name: Resolve pushed image digests
        id: digests
        # language=bash
        run: |
          set -euo pipefail
          for image in docs-builder docs-builder-mcp docs-builder-api; do
            ref="ghcr.io/elastic/${image}:edge"
            digest=$(docker buildx imagetools inspect "$ref" 2>/dev/null \
              | awk '/^Digest:/ {print $2; exit}')
            if [ -z "$digest" ]; then
              echo "::error::Could not resolve manifest digest for ${ref}"
              exit 1
            fi
            echo "${image}=${digest}" >> "$GITHUB_OUTPUT"
            echo "Resolved ${ref} -> ${digest}"
          done

      - name: Attest docs-builder image
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: ghcr.io/elastic/docs-builder
          subject-digest: ${{ steps.digests.outputs.docs-builder }}
          push-to-registry: true

      - name: Attest docs-builder-mcp image
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: ghcr.io/elastic/docs-builder-mcp
          subject-digest: ${{ steps.digests.outputs.docs-builder-mcp }}
          push-to-registry: true

      - name: Attest docs-builder-api image
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: ghcr.io/elastic/docs-builder-api
          subject-digest: ${{ steps.digests.outputs.docs-builder-api }}
          push-to-registry: true

      - name: Fetch ephemeral GitHub token
        id: fetch-ephemeral-token
        uses: elastic/ci-gh-actions/fetch-github-token@v1
        with:
          vault-instance: "ci-prod"

      - name: Notify docs-internal-workflows
        env:
          GH_TOKEN: ${{ steps.fetch-ephemeral-token.outputs.token }}
          SHA: ${{ github.sha }}
        run: |
          gh api repos/elastic/docs-internal-workflows/dispatches \
            -f event_type=docs-builder-prereleased \
            -F client_payload[sha]="$SHA"

  notify-failure:
    needs: [build, deploy]
    if: always() && contains(needs.*.result, 'failure')
    runs-on: ubuntu-slim
    permissions:
      id-token: write
    steps:
      - uses: elastic/docs-actions/slack/notify-status@v1
        with:
          channel: docs-alerts
          status: failure
          mention: S028C66K5EX
          description: Pre-release failed. Edge containers, GitHub Pages, or edge deploy dispatch did not complete.