__release.yml

name: Internal - Release

on:
  workflow_dispatch:
    # checkov:skip=CKV_GHA_7: force only bypasses the no-changes guard; source and build settings stay fixed.
    inputs:
      force:
        description: Release even when no relevant changes are detected
        type: boolean
        required: false
        default: false

  schedule:
    - cron: "25 8 * * 1"

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  ci:
    if: github.ref_type == 'branch' && github.ref_name == github.event.repository.default_branch
    uses: $/.github/workflows/__shared-ci.yml
    permissions:
      actions: read
      attestations: write
      contents: read
      packages: write
      pull-requests: write
      id-token: write
      issues: write
      security-events: write
      statuses: write

  release:
    name: Create and publish release
    needs: ci
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      # Use the app token so publishing the tag triggers the main CI documentation jobs.
      - id: generate-token
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        with:
          client-id: ${{ vars.CI_BOT_APP_CLIENT_ID }}
          private-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] CI bot authentication is required to trigger tag workflows
          permission-contents: write
          permission-pull-requests: read

      - name: Plan release
        id: plan-release
        uses: hoverkraft-tech/ci-github-publish/actions/release/plan@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2
        with:
          target-sha: ${{ github.sha }}
          github-token: ${{ steps.generate-token.outputs.token }}

      - name: Create and publish release
        if: (steps.plan-release.outputs.has-changes == 'true' || (github.event_name == 'workflow_dispatch' && inputs.force)) && steps.plan-release.outputs.tag != ''
        uses: hoverkraft-tech/ci-github-publish/actions/release/create@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} # zizmor: ignore[secrets-outside-env] repository secret is scoped to the release summary step
        with:
          tag: ${{ steps.plan-release.outputs.tag }}
          target-sha: ${{ github.sha }}
          publish: "true"
          changelog-summary: |
            {
              "llmAuth": ${{ toJSON(env.OPENAI_API_KEY) }},
              "llmProvider": "openai"
            }
          github-token: ${{ steps.generate-token.outputs.token }}