dotfiles/.github/workflows/release.yml at 6aa75db2cf12027507ce5f297c7b1810af4f9660 · ChipWolf/dotfiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
---
name: Release

"on":
  push:
    branches: [main]
  workflow_dispatch: null

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  release-please:
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      pull-requests: write
    outputs:
      release_created: ${{ steps.rp.outputs.release_created }}
      tag_name: ${{ steps.rp.outputs.tag_name }}
    steps:
      - name: Release Please
        id: rp
        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0

  # --- Build and attest container image (reusable workflow for SLSA L3) ---

  build:
    if: needs.release-please.outputs.release_created == 'true'
    needs: [release-please]
    uses: ./.github/workflows/_build-container.yml
    with:
      image_registry: ghcr.io
      image_name: ${{ github.repository }}
      tag_name: ${{ needs.release-please.outputs.tag_name }}
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write

  # --- Upload and attest install scripts (reusable workflow for SLSA L3) ---

  upload-scripts:
    if: needs.release-please.outputs.release_created == 'true'
    needs: [release-please]
    uses: ./.github/workflows/_upload-scripts.yml
    with:
      image_registry: ghcr.io
      image_name: ${{ github.repository }}
      tag_name: ${{ needs.release-please.outputs.tag_name }}
    permissions:
      contents: write
      id-token: write
      attestations: write