release-helpers.yaml

name: Release Helpers

on:
  push:
    branches:
      - main
    paths:
      - "helpers/**"

permissions:
  contents: read

jobs:
  bump-version-and-release-notes:
    runs-on: ubuntu-latest
    outputs:
      new-version: ${{ steps.bump-version.outputs.new-version }}
    steps:
      - name: Checkout
        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
        with:
          fetch-depth: 0

      - name: Bump Version and Generate Release Notes
        uses: ./.github/actions/bump-and-notes
        id: bump-version
        with:
          module: "helpers"

  release:
    runs-on: ubuntu-latest
    needs: bump-version-and-release-notes
    # contents: write via the GH app
    environment: release
    steps:
      - name: Checkout
        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
        with:
          fetch-depth: 0

      - name: Download Release Notes
        uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
        with:
          name: release-notes

      - name: Get pkg app token
        id: pkg-app-token
        uses: actions/create-github-app-token@7bfa3a4717ef143a604ee0a99d859b8886a96d00 # v1.9.3
        with:
          app-id: ${{ vars.PKG_WORKFLOW_GITHUB_APP_ID }}
          private-key: ${{ secrets.PKG_WORKFLOW_GITHUB_APP_SECRET }}
          owner: defenseunicorns
          repositories: pkg

      - name: Release
        env:
          GH_TOKEN: ${{ steps.pkg-app-token.outputs.token }}
          NEW_VERSION: ${{ needs.bump-version-and-release-notes.outputs.new-version }}
        run: |
          gh release create "$NEW_VERSION" --title "$NEW_VERSION" --notes-file notes.md