auto-release-jtk.yml

name: Auto Release jtk

# On push to main, decide whether to cut a jtk release and mint the jtk-v tag.
# Identity (tag prefix jtk-v, version file) comes from tools/jtk/packaging/
# identity.yml. The gate logic + version.txt + GITHUB_RUN_NUMBER tag scheme live
# in the shared reusable workflow; this caller wires triggers/scope/secrets.
on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      dry-run:
        description: "Compute the tag but do not push it"
        type: boolean
        default: true

# The tag push uses the dedicated TAP_GITHUB_TOKEN via a credential helper, not
# GITHUB_TOKEN — so the pushed tag retriggers release-jtk.yml.
permissions:
  contents: read

jobs:
  auto-release:
    uses: open-cli-collective/.github/.github/workflows/auto-release.yml@v1
    with:
      working-directory: tools/jtk
      # Two-stage monorepo gate: a changed file must be under a tool-path AND
      # match a release-path. tool-paths scopes to jtk + shared; release-paths is
      # the NARROW code-file set (NOT tools/jtk/** — that would release on a
      # docs/packaging change). version.txt is unioned in and matched
      # tool-relative, so tools/jtk/version.txt bumps still release.
      release-paths: "**.go,go.mod,go.sum,version.txt"
      tool-paths: "tools/jtk/**,shared/**"
      # push is live (false); workflow_dispatch honors the checkbox. Compare
      # against both true and 'true' because a workflow_dispatch boolean input
      # may surface as a real boolean or the string "true" depending on context.
      dry-run: ${{ github.event_name == 'workflow_dispatch' && (inputs.dry-run == true || inputs.dry-run == 'true') }}
    secrets:
      tag-token: ${{ secrets.TAP_GITHUB_TOKEN }}