upload.yml

name: NSS Upload

on:
  workflow_run:
    workflows: ["NSS Release"]
    types:
      - completed
    branches:
      - main

jobs:
  upload:
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' && startsWith(github.event.workflow_run.head_branch, 'refs/tags/NSS_') && endsWith(github.event.workflow_run.head_branch, '_RTM') }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install google-cloud-storage

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

      - name: Upload to GCP
        run: |
          gcloud storage cp --recursive --no-clobber \
            stage/${{ github.event.workflow_run.head_branch }} \
            gs://${{ secrets.GCP_PROJECT }}-productdelivery/pub/security/nss/releases/

      - name: Verify upload
        run: |
          gcloud storage ls gs://${{ secrets.GCP_PROJECT }}-productdelivery/pub/security/nss/releases/${{ github.event.workflow_run.head_branch }}/
          gcloud storage ls gs://${{ secrets.GCP_PROJECT }}-productdelivery/pub/security/nss/releases/${{ github.event.workflow_run.head_branch }}/src/