release.yml

name: release

on:
  # Releases are cut manually, never on push. Run from beta for an rc, from master for a stable release.
  workflow_dispatch:
    inputs:
      version:
        description: 'master only: release this MAJOR.MINOR.PATCH instead of the computed version (e.g. to skip a version an immutable release used up)'
        required: false
        default: ''

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write
  actions: write # dispatch ci-build on the release tag

defaults:
  run:
    shell: bash

jobs:
  auto-release:
    runs-on: ubuntu-slim # lightweight: release-tool + git/gh, no build
    timeout-minutes: 10
    # Only beta (rc) and master (stable) produce releases.
    if: github.ref_name == 'beta' || github.ref_name == 'master'

    steps:
      # An App token pushes the release commit and tag
      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510  # v3.3.0
        id: app-token
        with:
          client-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_KEY }}

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}

      - name: Configure git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Rebase on top of latest remote
        run: git pull --rebase --autostash origin "${GITHUB_REF_NAME}"

      - name: Run release tool
        id: meta
        uses: OpenShock/release-tool@fa1f825330760c1a7d28a2b22c44c6f7607606a6  # v1.1.0
        with:
          mode: release
          output: release.json
          notes-output: release-notes.md
          version: ${{ inputs.version }}
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

      # release-tool leaves the tag empty when no change files accumulated since the last tag
      - name: Fail if there is nothing to release
        if: steps.meta.outputs.tag == ''
        run: |
          echo "::error::No change files present since the last tag - nothing to release."
          exit 1

      # The commit first: tags are immutable, so a tag pushed with a rejected commit would be stranded on no branch
      - name: Push release commit
        run: git push origin "HEAD:refs/heads/${GITHUB_REF_NAME}"

      - name: Push tag
        env:
          TAG: ${{ steps.meta.outputs.tag }}
        run: git push origin "refs/tags/${TAG}"

      # A draft until ci-build's release job attaches the binaries and publishes it
      - name: Stage GitHub Release (draft)
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          TAG: ${{ steps.meta.outputs.tag }}
          PRERELEASE: ${{ steps.meta.outputs.prerelease }}
        run: |
          ARGS=("$TAG" "release.json" --title "$TAG" --notes-file release-notes.md --draft --verify-tag)
          if [ "$PRERELEASE" = "true" ]; then
            ARGS+=(--prerelease)
          fi
          gh release create "${ARGS[@]}"

      # The tag push does not trigger ci-build; this dispatch does, once the commit, tag and draft all exist
      - name: Dispatch ci-build for the tag
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.meta.outputs.tag }}
        run: gh workflow run ci-build.yml --ref "$TAG" -f release=true