release.yml

# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".

name: release
on:
  workflow_dispatch: {}
jobs:
  release:
    runs-on: aws-cdk_ubuntu-latest_16-core
    permissions:
      contents: write
    outputs:
      latest_commit: ${{ steps.git_remote.outputs.latest_commit }}
      publish-aws-cdk-cloud-assembly-schema: ${{ steps.check-publish-aws-cdk-cloud-assembly-schema.outputs.publish }}
      publish-aws-cdk-cloudformation-diff: ${{ steps.check-publish-aws-cdk-cloudformation-diff.outputs.publish }}
      publish-aws-cdk-cli-plugin-contract: ${{ steps.check-publish-aws-cdk-cli-plugin-contract.outputs.publish }}
      publish-aws-cdk-cdk-assets-lib: ${{ steps.check-publish-aws-cdk-cdk-assets-lib.outputs.publish }}
      publish-cdk-assets: ${{ steps.check-publish-cdk-assets.outputs.publish }}
      publish-aws-cdk-toolkit-lib: ${{ steps.check-publish-aws-cdk-toolkit-lib.outputs.publish }}
      publish-aws-cdk: ${{ steps.check-publish-aws-cdk.outputs.publish }}
      publish-aws-cdk-cli-lib-alpha: ${{ steps.check-publish-aws-cdk-cli-lib-alpha.outputs.publish }}
      publish-cdk: ${{ steps.check-publish-cdk.outputs.publish }}
      publish-aws-cdk-integ-runner: ${{ steps.check-publish-aws-cdk-integ-runner.outputs.publish }}
      publish-aws-cdk-testing-cli-integ: ${{ steps.check-publish-aws-cdk-testing-cli-integ.outputs.publish }}
    env:
      CI: "true"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set git identity
        run: |-
          git config user.name "github-actions"
          git config user.email "github-actions@github.com"
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Install dependencies
        run: yarn install --check-files --frozen-lockfile
      - name: release
        run: npx projen release
      - id: check-publish-aws-cdk-cloud-assembly-schema
        run: (git ls-remote -q --exit-code --tags origin $(cat dist/releasetag.txt) && (echo "publish=false" >> $GITHUB_OUTPUT)) || echo "publish=true" >> $GITHUB_OUTPUT
        working-directory: packages/@aws-cdk/cloud-assembly-schema
      - id: check-publish-aws-cdk-cloudformation-diff
        run: (git ls-remote -q --exit-code --tags origin $(cat dist/releasetag.txt) && (echo "publish=false" >> $GITHUB_OUTPUT)) || echo "publish=true" >> $GITHUB_OUTPUT
        working-directory: packages/@aws-cdk/cloudformation-diff
      - id: check-publish-aws-cdk-cli-plugin-contract
        run: (git ls-remote -q --exit-code --tags origin $(cat dist/releasetag.txt) && (echo "publish=false" >> $GITHUB_OUTPUT)) || echo "publish=true" >> $GITHUB_OUTPUT
        working-directory: packages/@aws-cdk/cli-plugin-contract
      - id: check-publish-aws-cdk-cdk-assets-lib
        run: (git ls-remote -q --exit-code --tags origin $(cat dist/releasetag.txt) && (echo "publish=false" >> $GITHUB_OUTPUT)) || echo "publish=true" >> $GITHUB_OUTPUT
        working-directory: packages/@aws-cdk/cdk-assets-lib
      - id: check-publish-cdk-assets
        run: (git ls-remote -q --exit-code --tags origin $(cat dist/releasetag.txt) && (echo "publish=false" >> $GITHUB_OUTPUT)) || echo "publish=true" >> $GITHUB_OUTPUT
        working-directory: packages/cdk-assets
      - id: check-publish-aws-cdk-toolkit-lib
        run: (git ls-remote -q --exit-code --tags origin $(cat dist/releasetag.txt) && (echo "publish=false" >> $GITHUB_OUTPUT)) || echo "publish=true" >> $GITHUB_OUTPUT
        working-directory: packages/@aws-cdk/toolkit-lib
      - id: check-publish-aws-cdk
        run: (git ls-remote -q --exit-code --tags origin $(cat dist/releasetag.txt) && (echo "publish=false" >> $GITHUB_OUTPUT)) || echo "publish=true" >> $GITHUB_OUTPUT
        working-directory: packages/aws-cdk
      - id: check-publish-aws-cdk-cli-lib-alpha
        run: (git ls-remote -q --exit-code --tags origin $(cat dist/releasetag.txt) && (echo "publish=false" >> $GITHUB_OUTPUT)) || echo "publish=true" >> $GITHUB_OUTPUT
        working-directory: packages/@aws-cdk/cli-lib-alpha
      - id: check-publish-cdk
        run: (git ls-remote -q --exit-code --tags origin $(cat dist/releasetag.txt) && (echo "publish=false" >> $GITHUB_OUTPUT)) || echo "publish=true" >> $GITHUB_OUTPUT
        working-directory: packages/cdk
      - id: check-publish-aws-cdk-integ-runner
        run: (git ls-remote -q --exit-code --tags origin $(cat dist/releasetag.txt) && (echo "publish=false" >> $GITHUB_OUTPUT)) || echo "publish=true" >> $GITHUB_OUTPUT
        working-directory: packages/@aws-cdk/integ-runner
      - id: check-publish-aws-cdk-testing-cli-integ
        run: (git ls-remote -q --exit-code --tags origin $(cat dist/releasetag.txt) && (echo "publish=false" >> $GITHUB_OUTPUT)) || echo "publish=true" >> $GITHUB_OUTPUT
        working-directory: packages/@aws-cdk-testing/cli-integ
      - name: Output the sha value that downstream checks expect
        id: git_remote
        run: echo "latest_commit=${{ github.sha }}" >> $GITHUB_OUTPUT
      - name: "@aws-cdk/cloud-assembly-schema: Backup artifact permissions"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
        working-directory: packages/@aws-cdk/cloud-assembly-schema
      - name: "@aws-cdk/cloud-assembly-schema: Upload artifact"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: aws-cdk-cloud-assembly-schema_build-artifact
          path: packages/@aws-cdk/cloud-assembly-schema/dist
          overwrite: true
      - name: "@aws-cdk/cloudformation-diff: Backup artifact permissions"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
        working-directory: packages/@aws-cdk/cloudformation-diff
      - name: "@aws-cdk/cloudformation-diff: Upload artifact"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: aws-cdk-cloudformation-diff_build-artifact
          path: packages/@aws-cdk/cloudformation-diff/dist
          overwrite: true
      - name: "@aws-cdk/cli-plugin-contract: Backup artifact permissions"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
        working-directory: packages/@aws-cdk/cli-plugin-contract
      - name: "@aws-cdk/cli-plugin-contract: Upload artifact"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: aws-cdk-cli-plugin-contract_build-artifact
          path: packages/@aws-cdk/cli-plugin-contract/dist
          overwrite: true
      - name: "@aws-cdk/cdk-assets-lib: Backup artifact permissions"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
        working-directory: packages/@aws-cdk/cdk-assets-lib
      - name: "@aws-cdk/cdk-assets-lib: Upload artifact"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: aws-cdk-cdk-assets-lib_build-artifact
          path: packages/@aws-cdk/cdk-assets-lib/dist
          overwrite: true
      - name: "cdk-assets: Backup artifact permissions"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
        working-directory: packages/cdk-assets
      - name: "cdk-assets: Upload artifact"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: cdk-assets_build-artifact
          path: packages/cdk-assets/dist
          overwrite: true
      - name: "@aws-cdk/toolkit-lib: Backup artifact permissions"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
        working-directory: packages/@aws-cdk/toolkit-lib
      - name: "@aws-cdk/toolkit-lib: Upload artifact"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: aws-cdk-toolkit-lib_build-artifact
          path: packages/@aws-cdk/toolkit-lib/dist
          overwrite: true
      - name: "aws-cdk: Backup artifact permissions"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
        working-directory: packages/aws-cdk
      - name: "aws-cdk: Upload artifact"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: aws-cdk_build-artifact
          path: packages/aws-cdk/dist
          overwrite: true
      - name: "@aws-cdk/cli-lib-alpha: Backup artifact permissions"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
        working-directory: packages/@aws-cdk/cli-lib-alpha
      - name: "@aws-cdk/cli-lib-alpha: Upload artifact"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: aws-cdk-cli-lib-alpha_build-artifact
          path: packages/@aws-cdk/cli-lib-alpha/dist
          overwrite: true
      - name: "cdk: Backup artifact permissions"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
        working-directory: packages/cdk
      - name: "cdk: Upload artifact"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: cdk_build-artifact
          path: packages/cdk/dist
          overwrite: true
      - name: "@aws-cdk/integ-runner: Backup artifact permissions"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
        working-directory: packages/@aws-cdk/integ-runner
      - name: "@aws-cdk/integ-runner: Upload artifact"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: aws-cdk-integ-runner_build-artifact
          path: packages/@aws-cdk/integ-runner/dist
          overwrite: true
      - name: "@aws-cdk-testing/cli-integ: Backup artifact permissions"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        run: cd dist && getfacl -R . > permissions-backup.acl
        continue-on-error: true
        working-directory: packages/@aws-cdk-testing/cli-integ
      - name: "@aws-cdk-testing/cli-integ: Upload artifact"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: aws-cdk-testing-cli-integ_build-artifact
          path: packages/@aws-cdk-testing/cli-integ/dist
          overwrite: true
      - name: "standalone: Upload artifact"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: standalone_build-artifact
          path: dist/standalone
          overwrite: true
      - name: "standalone: Upload artifact"
        if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
        uses: actions/upload-artifact@v4.4.0
        with:
          name: standalone_build-artifact
          path: dist/standalone
          overwrite: true
  aws-cdk-cloud-assembly-schema_release_github:
    name: "@aws-cdk/cloud-assembly-schema: Publish to GitHub Releases"
    needs:
      - release
      - aws-cdk-cloud-assembly-schema_release_npm
      - aws-cdk-cloud-assembly-schema_release_maven
      - aws-cdk-cloud-assembly-schema_release_pypi
      - aws-cdk-cloud-assembly-schema_release_nuget
      - aws-cdk-cloud-assembly-schema_release_golang
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cloud-assembly-schema == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cloud-assembly-schema_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_SHA 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
  aws-cdk-cloud-assembly-schema_release_npm:
    name: "@aws-cdk/cloud-assembly-schema: Publish to npm"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cloud-assembly-schema == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cloud-assembly-schema_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo/packages/@aws-cdk/cloud-assembly-schema
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create js artifact
        run: cd .repo/packages/@aws-cdk/cloud-assembly-schema && npx projen package:js
      - name: Collect js artifact
        run: mv .repo/packages/@aws-cdk/cloud-assembly-schema/dist dist
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_CONFIG_PROVENANCE: "true"
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx -p publib@latest publib-npm
  aws-cdk-cloud-assembly-schema_release_maven:
    name: "@aws-cdk/cloud-assembly-schema: Publish to Maven Central"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cloud-assembly-schema == 'true' }}
    steps:
      - uses: actions/setup-java@v4
        with:
          distribution: corretto
          java-version: "11"
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cloud-assembly-schema_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo/packages/@aws-cdk/cloud-assembly-schema
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create java artifact
        run: cd .repo/packages/@aws-cdk/cloud-assembly-schema && npx projen package:java
      - name: Collect java artifact
        run: mv .repo/packages/@aws-cdk/cloud-assembly-schema/dist dist
      - name: Release
        env:
          MAVEN_SERVER_ID: central-ossrh
          MAVEN_GPG_PRIVATE_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          MAVEN_GPG_PRIVATE_KEY_PASSPHRASE: ${{ secrets.MAVEN_GPG_PRIVATE_KEY_PASSPHRASE }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
          MAVEN_STAGING_PROFILE_ID: ${{ secrets.MAVEN_STAGING_PROFILE_ID }}
        run: npx -p publib@latest publib-maven
  aws-cdk-cloud-assembly-schema_release_pypi:
    name: "@aws-cdk/cloud-assembly-schema: Publish to PyPI"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cloud-assembly-schema == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - uses: actions/setup-python@v5
        with:
          python-version: 3.x
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cloud-assembly-schema_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo/packages/@aws-cdk/cloud-assembly-schema
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create python artifact
        run: cd .repo/packages/@aws-cdk/cloud-assembly-schema && npx projen package:python
      - name: Collect python artifact
        run: mv .repo/packages/@aws-cdk/cloud-assembly-schema/dist dist
      - name: Release
        env:
          TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }}
          TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
        run: npx -p publib@latest publib-pypi
  aws-cdk-cloud-assembly-schema_release_nuget:
    name: "@aws-cdk/cloud-assembly-schema: Publish to NuGet Gallery"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cloud-assembly-schema == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 6.x
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cloud-assembly-schema_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo/packages/@aws-cdk/cloud-assembly-schema
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create dotnet artifact
        run: cd .repo/packages/@aws-cdk/cloud-assembly-schema && npx projen package:dotnet
      - name: Collect dotnet artifact
        run: mv .repo/packages/@aws-cdk/cloud-assembly-schema/dist dist
      - name: Release
        env:
          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
        run: npx -p publib@latest publib-nuget
  aws-cdk-cloud-assembly-schema_release_golang:
    name: "@aws-cdk/cloud-assembly-schema: Publish to GitHub Go Module Repository"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cloud-assembly-schema == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - uses: actions/setup-go@v5
        with:
          go-version: ^1.18.0
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cloud-assembly-schema_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo/packages/@aws-cdk/cloud-assembly-schema
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create go artifact
        run: cd .repo/packages/@aws-cdk/cloud-assembly-schema && npx projen package:go
      - name: Collect go artifact
        run: mv .repo/packages/@aws-cdk/cloud-assembly-schema/dist dist
      - name: Release
        env:
          GIT_USER_NAME: github-actions
          GIT_USER_EMAIL: github-actions@github.com
          GITHUB_TOKEN: ${{ secrets.GO_GITHUB_TOKEN }}
        run: npx -p publib@latest publib-golang
  aws-cdk-cloudformation-diff_release_github:
    name: "@aws-cdk/cloudformation-diff: Publish to GitHub Releases"
    needs:
      - release
      - aws-cdk-cloudformation-diff_release_npm
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cloudformation-diff == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cloudformation-diff_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_SHA 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
  aws-cdk-cloudformation-diff_release_npm:
    name: "@aws-cdk/cloudformation-diff: Publish to npm"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cloudformation-diff == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cloudformation-diff_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_CONFIG_PROVENANCE: "true"
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx -p publib@latest publib-npm
  aws-cdk-cli-plugin-contract_release_github:
    name: "@aws-cdk/cli-plugin-contract: Publish to GitHub Releases"
    needs:
      - release
      - aws-cdk-cli-plugin-contract_release_npm
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cli-plugin-contract == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cli-plugin-contract_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_SHA 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
  aws-cdk-cli-plugin-contract_release_npm:
    name: "@aws-cdk/cli-plugin-contract: Publish to npm"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cli-plugin-contract == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cli-plugin-contract_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_CONFIG_PROVENANCE: "true"
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx -p publib@latest publib-npm
  aws-cdk-cdk-assets-lib_release_github:
    name: "@aws-cdk/cdk-assets-lib: Publish to GitHub Releases"
    needs:
      - release
      - aws-cdk-cdk-assets-lib_release_npm
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cdk-assets-lib == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cdk-assets-lib_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_SHA 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
  aws-cdk-cdk-assets-lib_release_npm:
    name: "@aws-cdk/cdk-assets-lib: Publish to npm"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cdk-assets-lib == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cdk-assets-lib_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_CONFIG_PROVENANCE: "true"
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx -p publib@latest publib-npm
  cdk-assets_release_github:
    name: "cdk-assets: Publish to GitHub Releases"
    needs:
      - release
      - cdk-assets_release_npm
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-cdk-assets == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: cdk-assets_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_SHA 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
  cdk-assets_release_npm:
    name: "cdk-assets: Publish to npm"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-cdk-assets == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: cdk-assets_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_CONFIG_PROVENANCE: "true"
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx -p publib@latest publib-npm
  aws-cdk-toolkit-lib_release_github:
    name: "@aws-cdk/toolkit-lib: Publish to GitHub Releases"
    needs:
      - release
      - aws-cdk-toolkit-lib_release_npm
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-toolkit-lib == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-toolkit-lib_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_SHA 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
  aws-cdk-toolkit-lib_release_npm:
    name: "@aws-cdk/toolkit-lib: Publish to npm"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-toolkit-lib == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-toolkit-lib_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_CONFIG_PROVENANCE: "true"
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx -p publib@latest publib-npm
  aws-cdk_release_github:
    name: "aws-cdk: Publish to GitHub Releases"
    needs:
      - release
      - aws-cdk_release_npm
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_SHA 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
  aws-cdk_release_npm:
    name: "aws-cdk: Publish to npm"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_CONFIG_PROVENANCE: "true"
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx -p publib@latest publib-npm
  aws-cdk-cli-lib-alpha_release_github:
    name: "@aws-cdk/cli-lib-alpha: Publish to GitHub Releases"
    needs:
      - release
      - aws-cdk-cli-lib-alpha_release_npm
      - aws-cdk-cli-lib-alpha_release_maven
      - aws-cdk-cli-lib-alpha_release_pypi
      - aws-cdk-cli-lib-alpha_release_nuget
      - aws-cdk-cli-lib-alpha_release_golang
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cli-lib-alpha == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cli-lib-alpha_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_SHA 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
  aws-cdk-cli-lib-alpha_release_npm:
    name: "@aws-cdk/cli-lib-alpha: Publish to npm"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cli-lib-alpha == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cli-lib-alpha_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo/packages/@aws-cdk/cli-lib-alpha
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create js artifact
        run: cd .repo/packages/@aws-cdk/cli-lib-alpha && npx projen package:js
      - name: Collect js artifact
        run: mv .repo/packages/@aws-cdk/cli-lib-alpha/dist dist
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_CONFIG_PROVENANCE: "true"
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx -p publib@latest publib-npm
  aws-cdk-cli-lib-alpha_release_maven:
    name: "@aws-cdk/cli-lib-alpha: Publish to Maven Central"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cli-lib-alpha == 'true' }}
    steps:
      - uses: actions/setup-java@v4
        with:
          distribution: corretto
          java-version: "11"
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cli-lib-alpha_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo/packages/@aws-cdk/cli-lib-alpha
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create java artifact
        run: cd .repo/packages/@aws-cdk/cli-lib-alpha && npx projen package:java
      - name: Collect java artifact
        run: mv .repo/packages/@aws-cdk/cli-lib-alpha/dist dist
      - name: Release
        env:
          MAVEN_SERVER_ID: central-ossrh
          MAVEN_GPG_PRIVATE_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          MAVEN_GPG_PRIVATE_KEY_PASSPHRASE: ${{ secrets.MAVEN_GPG_PRIVATE_KEY_PASSPHRASE }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
          MAVEN_STAGING_PROFILE_ID: ${{ secrets.MAVEN_STAGING_PROFILE_ID }}
        run: npx -p publib@latest publib-maven
  aws-cdk-cli-lib-alpha_release_pypi:
    name: "@aws-cdk/cli-lib-alpha: Publish to PyPI"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cli-lib-alpha == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - uses: actions/setup-python@v5
        with:
          python-version: 3.x
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cli-lib-alpha_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo/packages/@aws-cdk/cli-lib-alpha
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create python artifact
        run: cd .repo/packages/@aws-cdk/cli-lib-alpha && npx projen package:python
      - name: Collect python artifact
        run: mv .repo/packages/@aws-cdk/cli-lib-alpha/dist dist
      - name: Release
        env:
          TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }}
          TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
        run: npx -p publib@latest publib-pypi
  aws-cdk-cli-lib-alpha_release_nuget:
    name: "@aws-cdk/cli-lib-alpha: Publish to NuGet Gallery"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cli-lib-alpha == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 6.x
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cli-lib-alpha_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo/packages/@aws-cdk/cli-lib-alpha
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create dotnet artifact
        run: cd .repo/packages/@aws-cdk/cli-lib-alpha && npx projen package:dotnet
      - name: Collect dotnet artifact
        run: mv .repo/packages/@aws-cdk/cli-lib-alpha/dist dist
      - name: Release
        env:
          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
        run: npx -p publib@latest publib-nuget
  aws-cdk-cli-lib-alpha_release_golang:
    name: "@aws-cdk/cli-lib-alpha: Publish to GitHub Go Module Repository"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-cli-lib-alpha == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - uses: actions/setup-go@v5
        with:
          go-version: ^1.18.0
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-cli-lib-alpha_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: .repo
      - name: Install Dependencies
        run: cd .repo && yarn install --check-files --frozen-lockfile
      - name: Extract build artifact
        run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo/packages/@aws-cdk/cli-lib-alpha
      - name: Move build artifact out of the way
        run: mv dist dist.old
      - name: Create go artifact
        run: cd .repo/packages/@aws-cdk/cli-lib-alpha && npx projen package:go
      - name: Collect go artifact
        run: mv .repo/packages/@aws-cdk/cli-lib-alpha/dist dist
      - name: Release
        env:
          GIT_USER_NAME: github-actions
          GIT_USER_EMAIL: github-actions@github.com
          GITHUB_TOKEN: ${{ secrets.GO_GITHUB_TOKEN }}
        run: npx -p publib@latest publib-golang
  cdk_release_github:
    name: "cdk: Publish to GitHub Releases"
    needs:
      - release
      - cdk_release_npm
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-cdk == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: cdk_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_SHA 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
  cdk_release_npm:
    name: "cdk: Publish to npm"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-cdk == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: cdk_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_CONFIG_PROVENANCE: "true"
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx -p publib@latest publib-npm
  aws-cdk-integ-runner_release_github:
    name: "@aws-cdk/integ-runner: Publish to GitHub Releases"
    needs:
      - release
      - aws-cdk-integ-runner_release_npm
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-integ-runner == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-integ-runner_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_SHA 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
  aws-cdk-integ-runner_release_npm:
    name: "@aws-cdk/integ-runner: Publish to npm"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-integ-runner == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-integ-runner_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_CONFIG_PROVENANCE: "true"
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx -p publib@latest publib-npm
  aws-cdk-testing-cli-integ_release_github:
    name: "@aws-cdk-testing/cli-integ: Publish to GitHub Releases"
    needs:
      - release
      - aws-cdk-testing-cli-integ_release_npm
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-testing-cli-integ == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-testing-cli-integ_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_SHA 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
  aws-cdk-testing-cli-integ_release_npm:
    name: "@aws-cdk-testing/cli-integ: Publish to npm"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    if: ${{ needs.release.outputs.latest_commit == github.sha && needs.release.outputs.publish-aws-cdk-testing-cli-integ == 'true' }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-testing-cli-integ_build-artifact
          path: dist
      - name: Restore build artifact permissions
        run: cd dist && setfacl --restore=permissions-backup.acl
        continue-on-error: true
      - name: Release
        env:
          NPM_DIST_TAG: latest
          NPM_REGISTRY: registry.npmjs.org
          NPM_CONFIG_PROVENANCE: "true"
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx -p publib@latest publib-npm
  standalone_release_adc:
    name: "standalone: publish to ADC"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    environment: releasing
    if: ${{ needs.release.outputs.latest_commit == github.sha }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Install dependencies
        run: yarn install --check-files --frozen-lockfile
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: standalone_build-artifact
          path: dist/standalone
      - name: Authenticate Via OIDC Role
        id: creds
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME_FOR_ACCOUNT }}
          role-session-name: standalone-release@aws-cdk-cli
          output-credentials: true
          mask-aws-account-id: true
      - name: Publish artifacts
        env:
          PUBLISHING_ROLE_ARN: ${{ vars.PUBLISHING_ROLE_ARN }}
          TARGET_BUCKETS: ${{ vars.TARGET_BUCKETS }}
        run: npx tsx projenrc/publish-to-adc.task.ts
  record_timestamp:
    name: "aws-cdk: Record publishing timestamp"
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    environment: releasing
    if: ${{ needs.release.outputs.latest_commit == github.sha }}
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk_build-artifact
          path: dist
      - name: Read version from build artifacts
        id: aws-cdk-version
        run: echo "version=$(cat dist/version.txt)" >> $GITHUB_OUTPUT
      - name: Authenticate Via OIDC Role
        id: creds
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME_FOR_ACCOUNT }}
          role-session-name: publish-timestamps@aws-cdk-cli
          mask-aws-account-id: true
      - name: Publish artifacts
        run: |-
          aws ssm put-parameter --name "/published/cdk/cli-npm/version" --type "String" --value "${{ steps.aws-cdk-version.outputs.version }}" --overwrite
          aws ssm put-parameter --name "/published/cdk/cli-npm/timestamp" --type "String" --value "$(date +%s)" --overwrite
  aws-cdk-toolkit-lib_release_api_extractor:
    name: "@aws-cdk/toolkit-lib: Publish api-extractor to S3"
    needs: aws-cdk-toolkit-lib_release_npm
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    environment: releasing
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: aws-cdk-toolkit-lib_build-artifact
          path: dist
      - name: Authenticate Via OIDC Role
        id: creds
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME_FOR_ACCOUNT }}
          role-session-name: s3-api-model-docs-publishing@aws-cdk-cli
          mask-aws-account-id: true
      - name: Assume the publishing role
        id: publishing-creds
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ vars.PUBLISH_TOOLKIT_LIB_DOCS_ROLE_ARN }}
          role-session-name: s3-api-model-docs-publishing@aws-cdk-cli
          mask-aws-account-id: true
          role-chaining: true
      - name: Publish api-extractor
        env:
          BUCKET_NAME: ${{ vars.DOCS_BUCKET_NAME }}
          DOCS_STREAM: toolkit-lib-api-model
        run: |-
          echo "Uploading api-extractor to S3"
          echo "::add-mask::$BUCKET_NAME"
          S3_PATH="$DOCS_STREAM/aws-cdk-toolkit-lib-api-model-v$(cat dist/version.txt).zip"
          LATEST="latest-toolkit-lib-api-model"

          # Capture both stdout and stderr
          if OUTPUT=$(aws s3api put-object \
            --bucket "$BUCKET_NAME" \
            --key "$S3_PATH" \
            --body dist/api-extractor-docs.zip \
            --if-none-match "*" 2>&1); then
            
            # File was uploaded successfully, update the latest pointer
            echo "New api-extractor artifact uploaded successfully, updating latest pointer"
            echo "$S3_PATH" | aws s3 cp - "s3://$BUCKET_NAME/$LATEST"

          elif echo "$OUTPUT" | grep -q "PreconditionFailed"; then
            # Check specifically for PreconditionFailed in the error output
            echo "::warning::File already exists in S3. Skipping upload."
            exit 0

          else
            # Any other error (permissions, etc)
            echo "::error::Failed to upload api-extractor artifact"
            exit 1
          fi