gh-release-drafter.yml

# Requires repo secret: PERSONAL_ACCESS_TOKEN with permissions:
#   Contents: read and write
#   Pull Requests: read

name: GitHub Release Drafter

on:
  push:
    branches:
      - 'main'
  workflow_dispatch:
    inputs:
      ref:
        description: 'Git ref (refs/heads/<branch>, refs/tags/<tag>, etc.) or SHA'
        required: true
        type: string

concurrency:
  group: ${{ github.workflow }}-${{ inputs.ref || github.ref }}
  cancel-in-progress: true

env:
  ref: ${{ inputs.ref || github.sha || github.ref }}

jobs:
  release:
    permissions:
      contents: read # actions/checkout
      pull-requests: write # thollander/actions-comment-pull-request
    runs-on: ubuntu-latest
    outputs:
      commit_hash: ${{ steps.pr-finder.outputs.GIT_SHA }}
      version: ${{ steps.check.outputs.version }}
      release_id: ${{ steps.release-drafter.outputs.id }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          ref: ${{ env.ref }}
          submodules: 'recursive'
          # auto-changelog needs a full fetch for tag info
          fetch-depth: 0

      # Check to see if the package.json version has changed
      - id: check
        uses: EndBug/version-check@095362f3cd50f690c8fa0e6afeea81834bd8d320 # v3.0.0
        with:
          # NOTE: `diff-search:true` is preferred so that only the exact commit that bumps the
          #   version triggers this workflow, but `workflow_dispatch` doesn't carry commit or
          #   commit ref info that's needed for it.
          diff-search: ${{ github.event_name != 'workflow_dispatch' && true || false }}
          static-checking: ${{ github.event_name == 'workflow_dispatch' && 'localIsNew' || '' }}
          file-url: ${{ github.event_name == 'workflow_dispatch' && 'https://unpkg.com/igir/package.json' || '' }}

      - if: steps.check.outputs.changed == 'true'
        uses: volta-cli/action@615a78f6c83e116339c53b94f3f82b4d6c0b7d18 # v5.0.0
      - if: steps.check.outputs.changed == 'true'
        run: npm ci

      # Generate the release's markdown template
      - if: steps.check.outputs.changed == 'true'
        id: auto-changelog
        run: |
          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
          {
            echo "MARKDOWN<<$EOF"
            ./scripts/auto-changelog.sh
            echo ""
            echo ""
            echo "$EOF"
          } >> "${GITHUB_OUTPUT}"

      # Create/update the draft release
      - if: steps.check.outputs.changed == 'true'
        id: release-drafter
        uses: release-drafter/release-drafter@ed4bc48ec97379be2258e7b7ac2624a3e26ab809 # v7.4.0
        with:
          name: v${{ steps.check.outputs.version }}
          tag: v${{ steps.check.outputs.version }}
          version: ${{ steps.check.outputs.version }}
          commitish: ${{ env.ref }}
          # NOTE(cemmer): `template` can't be supplied here, only `header` and `footer`, so have to pick one of those
          #   and make sure the .github/gh-release-drafter.yml's `template` is empty-ish.
          header: ${{ steps.auto-changelog.outputs.MARKDOWN }}
        env:
          # NOTE(cemmer): PAT here causes the release to be made under your account.
          #   ${{ secrets.GITHUB_TOKEN }} would cause it to be created from `github-actions`, even when published.
          GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
      - if: ${{ steps.release-drafter.outputs.id }}
        run: |
          {
            echo "# v${{ steps.check.outputs.version }} @ ${{ env.ref }}"
            echo ""
            echo "${{ steps.release-drafter.outputs.html_url }}"
          } >> "${GITHUB_STEP_SUMMARY}"

      # Comment back on the PR that caused this push
      - if: ${{ steps.release-drafter.outputs.id }}
        id: pr-finder
        run: |
          set -x
          GIT_SHA=$(git rev-parse HEAD)
          echo "GIT_SHA=${GIT_SHA}" >> "${GITHUB_OUTPUT}"
          PR_NUMBER=$(gh api \
            "repos/${GITHUB_REPOSITORY}/commits/${GIT_SHA}/pulls" \
            --jq '.[0].number')
          echo "PR_NUMBER=${PR_NUMBER}" >> "${GITHUB_OUTPUT}"
        env:
          GH_TOKEN: ${{ github.token }}
      - if: ${{ steps.release-drafter.outputs.id }}
        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
        with:
          message: |
            ## :octocat: GitHub release
            This pull request resulted in the release: [v${{ steps.check.outputs.version }} @ ${{ env.ref }}](${{ steps.release-drafter.outputs.html_url }})

            _Comment generated by the [${{ github.workflow }}](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}) workflow._
          comment-tag: gh-release
          pr-number: ${{ steps.pr-finder.outputs.PR_NUMBER }}

  # Kick off binary compilation
  compile:
    needs:
      - release
    if: ${{ needs.release.outputs.release_id }}
    permissions:
      pull-requests: read # node-compile.yml (dorny/paths-filter)
      contents: write # node-compile.yml (gh release upload)
    uses: ./.github/workflows/node-compile.yml
    with:
      ref: ${{ needs.release.outputs.commit_hash }}