name: Release Drafter & Updater

on:
  workflow_dispatch:
  push:
    branches:
      - develop

permissions:
  id-token: write  # Required for OIDC
  contents: read

jobs:
  # cleanup draft releases before creating a new one
  delete-draft-releases:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Configure AWS Credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::730335206644:role/delegatedadmin/developer/qppa-github-actions-role-1
          aws-region: us-east-1

      - name: Retrieve GitHub service account token from secops account
        id: get-token
        run: |
          SECRET_VALUE=$(aws secretsmanager get-secret-value \
            --secret-id "arn:aws:secretsmanager:us-east-1:863249929524:secret:qpp/qppa/github/token/automation-bhLO2e" \
            --query SecretString \
            --output text | jq -r ".GITHUB_TOKEN")
          echo "::add-mask::$SECRET_VALUE"
          echo "GITHUB_TOKEN=$SECRET_VALUE" >> $GITHUB_OUTPUT
      - name: Delete draft releases
        env:
          GITHUB_TOKEN: ${{ steps.get-token.outputs.GITHUB_TOKEN }}
        run: |
          echo "Fetching draft releases..."
          DRAFTS=$(curl -H "Authorization: token $GITHUB_TOKEN" \
                        -H "Accept: application/vnd.github.v3+json" \
                      https://api.github.com/repos/${{ github.repository }}/releases \
                      | jq '.[] | select(.draft==true) | .id')

          echo "Draft Releases IDs: $DRAFTS"

          for DRAFT_ID in $DRAFTS; do
            if [ -n "$DRAFT_ID" ]; then
              echo "Deleting draft release ID: $DRAFT_ID"
              curl -X DELETE \
                   -H "Authorization: token $GITHUB_TOKEN" \
                   -H "Accept: application/vnd.github.v3+json" \
                   https://api.github.com/repos/${{ github.repository }}/releases/$DRAFT_ID
            fi
          done

  # create release draft with new release notes
  update_release_draft:
    needs: delete-draft-releases
    permissions:
      # write permission is required to create a github release
      id-token: write  # Required for OIDC
      contents: write
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      # Drafts your next Release notes as Pull Requests are merged into "master"
      - name: Configure AWS Credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::730335206644:role/delegatedadmin/developer/qppa-github-actions-role-1
          aws-region: us-east-1

      - name: Retrieve GitHub service account token from secops account
        id: get-token
        run: |
          SECRET_VALUE=$(aws secretsmanager get-secret-value \
            --secret-id "arn:aws:secretsmanager:us-east-1:863249929524:secret:qpp/qppa/github/token/automation-bhLO2e" \
            --query SecretString \
            --output text | jq -r ".GITHUB_TOKEN")
          echo "::add-mask::$SECRET_VALUE"
          echo "GITHUB_TOKEN=$SECRET_VALUE" >> $GITHUB_OUTPUT
      - uses: release-drafter/release-drafter@v6
        env:
          GITHUB_TOKEN: ${{ steps.get-token.outputs.GITHUB_TOKEN }}