release-please.yml

name: Release Please

# On every push to main, opens or updates the release pull request from the Conventional Commits
# since the last release, and dispatches its required checks and Release Distributions on its
# branch. Once the release pull request merges, it tags the release and dispatches Publish for it.
on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  actions: write
  contents: write
  pull-requests: write

concurrency:
  group: release-please
  cancel-in-progress: false

jobs:
  release-please:
    runs-on: ubuntu-24.04
    steps:
      # The organization's delivery App opens and updates the release pull request, so GitHub
      # emits its pull request events and the organization auto-merge workflow treats it as its own.
      # Without the App's variable, Release Please keeps github.token.
      - name: Create delivery token
        id: delivery-token
        if: vars.CHIO_DELIVERY_APP_ID != ''
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ vars.CHIO_DELIVERY_APP_ID }}
          private-key: ${{ secrets.CHIO_DELIVERY_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: ${{ github.event.repository.name }}
          permission-actions: write
          permission-contents: write
          permission-issues: write
          permission-pull-requests: write

      - uses: googleapis/release-please-action@v4
        id: release
        with:
          token: ${{ steps.delivery-token.outputs.token || github.token }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

      - name: Publish the created release
        if: steps.release.outputs.release_created == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ steps.release.outputs.tag_name }}
        run: |
          gh workflow run publish.yml --repo "${GITHUB_REPOSITORY}" --ref main \
            -f "tag=${RELEASE_TAG}"

      # The release pull request's required checks are dispatched on its branch, since a pull request
      # github.token opens starts no pull_request runs: CI replays every recorded case before the
      # release, alongside the distribution build.
      - name: Check the release pull request and build its distributions
        if: steps.release.outputs.prs_created == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_PRS: ${{ steps.release.outputs.prs }}
        run: |
          release_branch="$(jq -r '.[0].headBranchName // empty' <<< "${RELEASE_PRS}")"
          release_pr="$(jq -r '.[0].number // empty' <<< "${RELEASE_PRS}")"
          if [[ -z "${release_branch}" || -z "${release_pr}" ]]; then
            echo "Release Please reported a created pull request without a head branch or number" >&2
            exit 1
          fi
          run() { gh workflow run "$1" --repo "${GITHUB_REPOSITORY}" --ref "${release_branch}" "${@:2}"; }
          run release-distributions.yml
          run ci.yml
          run version-guard.yml
          run pull-request-metadata.yml -f "pr_number=${release_pr}"