release.yaml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Release version number (v#.#.#)"
        type: string
        required: true

jobs:
  changelog:
    runs-on: ubuntu-latest
    permissions:
      actions: read
    steps:
      - name: Verify tests have succeeded before releasing
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          successful=$(gh api --method GET repos/$GITHUB_REPOSITORY/actions/runs --field head_sha="${{ github.sha }}" --field status=success | jq --raw-output '.workflow_runs[].path')

          echo "$successful"
          if ! echo "$successful" | grep --quiet '^.github/workflows/build.yaml$'; then
            echo "Tests have not passed successfully, release halted"
            exit 1
          fi

      - name: Validate version
        # grep pattern that works on both BSD grep & GNU grep
        run: |
          echo "${{ inputs.version }}" | grep '^v[0-9][0-9]*.[0-9][0-9]*.[0-9][0-9]*$'

      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          # We have to use credentials other than standard github-actions to give permission for the workflow to
          # push directly to `main`
          token: "${{ secrets.RELEASE_TOKEN }}"

      - name: Batch .changes/unreleased into .changes/version.md
        uses: miniscruff/changie-action@6dcc2533cac0495148ed4046c438487e4dceaa23 # v2.0.0
        with:
          version: v1.21.0
          args: "batch ${{ inputs.version }}"

      - name: Update CHANGELOG.md
        uses: miniscruff/changie-action@6dcc2533cac0495148ed4046c438487e4dceaa23 # v2.0.0
        with:
          version: v1.21.0
          args: merge

      - name: Push changelog changes
        uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
        with:
          tagging_message: "${{ inputs.version }}"
          commit_message: |
            Update changelog for ${{ inputs.version }}

  release:
    runs-on: ubuntu-latest
    permissions:
      # Need write permission to create the release
      contents: write
    needs:
      - changelog
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          # Default input is the SHA that initially triggered the workflow. As we created a new commit in the previous job,
          # to ensure we get the correct commit
          ref: "refs/tags/${{ inputs.version }}"

      - name: Create release
        env:
          GITHUB_TOKEN: "${{ github.token }}"
          VERSION: "${{ inputs.version }}"
        run: |
          gh release create --repo "$GITHUB_REPOSITORY" --title "${VERSION}" --verify-tag --notes-file ".changes/${VERSION}.md" "${VERSION}"