semantic-release.yml

name: Semantic Release

# Run on push to main or manually via "Run workflow" (workflow_dispatch).
# Uses a GitHub App token to push the version-bump commit and tag to protected main.
#
# Minor/patch: feat → minor, fix/perf/refactor → patch.
# Major (1.x → 2.0): create tag manually: git tag -a v2.0.0 -m "..." && git push origin v2.0.0

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: write
  id-token: write

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    concurrency: release
    steps:
      - name: Create GitHub App token
        uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ vars.CI_APP_ID }}
          private-key: ${{ secrets.CI_PRIVATE_KEY }}
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.12"
      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"
      - name: Install dependencies
        run: uv sync --dev
      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
      - name: Python Semantic Release
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: uv run semantic-release version --skip-build --no-push
      - name: Add DCO sign-off to release commit
        run: |
          if git log -1 --pretty=format:%s | grep -q '^chore(release):'; then
            TAG=$(git describe --exact-match --tags HEAD)
            git commit --amend --no-edit -s
            git tag -f "$TAG"
          fi
      - name: Push changes
        id: push
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          REMOTE: https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}.git
        run: |
          RELEASED_TAG=$(git describe --exact-match --tags HEAD 2>/dev/null) || true
          git fetch "$REMOTE" main
          if ! git merge-base --is-ancestor FETCH_HEAD HEAD 2>/dev/null; then
            git reset --hard HEAD
            git rebase FETCH_HEAD
            [ -n "$RELEASED_TAG" ] && git tag -f "$RELEASED_TAG"
          fi
          git push "$REMOTE" HEAD:main --follow-tags
          [ -z "$RELEASED_TAG" ] || echo "released_tag=$RELEASED_TAG" >> "$GITHUB_OUTPUT"
      - name: Create GitHub Release with changelog
        if: steps.push.outputs.released_tag != ''
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: uv run semantic-release changelog --post-to-release-tag "${{ steps.push.outputs.released_tag }}"
      - name: Summary
        run: |
          echo "## Semantic Release Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          if git describe --exact-match --tags HEAD 2>/dev/null; then
            NEW_VERSION=$(git describe --exact-match --tags HEAD)
            echo "- New version released: **${NEW_VERSION}**" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "The release workflow will now be triggered by the new tag." >> $GITHUB_STEP_SUMMARY
          else
            echo "- No release created" >> $GITHUB_STEP_SUMMARY
          fi