draft-new-release.yml

name: Draft new release

on:
  workflow_dispatch

permissions:
  contents: read

jobs:
  draft-new-release:
    permissions:
      contents: read  # GITHUB_TOKEN only needs read for checkout
    name: Draft a new release
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/heads/fix/') || startsWith(github.ref, 'refs/heads/feat/')
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: Generate GitHub App Token
        id: generate-token
        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
        with:
          app-id: ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_PRIVATE_KEY }}
          permission-contents: write # to create commits, tags, and releases
          permission-pull-requests: write # to create and update PRs

      - name: Checkout source branch
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          token: ${{ steps.generate-token.outputs.token }}
          fetch-depth: 0

      - name: Set Node 16
        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
        with:
          node-version: 16

      # Calculate the next release version based on conventional semantic release
      - name: Create release branch
        id: create-release
        env:
          HUSKY: 0
        run: |
          source_branch_name=${GITHUB_REF##*/}
          release_type=release
          git fetch origin master --depth=1
          git merge origin/master
          current_version=$(jq -r .version package.json)

          npx standard-version --skip.commit --skip.tag --skip.changelog
          new_version=$(jq -r .version package.json)
          git reset --hard

          branch_name="${release_type}/${new_version}"

          echo "Source branch for new release is $source_branch_name"
          echo "Current version is $current_version"
          echo "Release type is $release_type"
          echo "New version is $new_version"
          echo "New release branch name is $branch_name"

          echo "source_branch_name=$source_branch_name" >> $GITHUB_OUTPUT
          echo "branch_name=$branch_name" >> $GITHUB_OUTPUT
          echo "new_version=$new_version" >> $GITHUB_OUTPUT
          echo "CURRENT_VERSION_VALUE=$current_version" >> $GITHUB_ENV
          echo "NEW_VERSION_VALUE=$new_version" >> $GITHUB_ENV

      - name: Create release branch via GitHub API
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
        run: |
          BASE_SHA=$(git rev-parse origin/master)
          gh api repos/${{ github.repository }}/git/refs \
            --method POST \
            -f ref="refs/heads/${{ steps.create-release.outputs.branch_name }}" \
            -f sha="$BASE_SHA"

      - name: Update changelog & bump version
        id: finish-release
        env:
          HUSKY: 0
        run: |
          npm i -g conventional-changelog-cli
          echo "Current version: $CURRENT_VERSION_VALUE"
          echo "New version: $NEW_VERSION_VALUE"
          npx replace $CURRENT_VERSION_VALUE $NEW_VERSION_VALUE README.md
          echo ${{ steps.create-release.outputs.new_version }}
          npx standard-version --skip.commit --skip.tag
          SUMMARY=$(((npx conventional-changelog -u) 2>&1) | sed "s/*/<br> */g" | sed "s/#/ /g" | tr -d '\n' || true)
          echo $SUMMARY
          echo "commit_summary=$SUMMARY" >> $GITHUB_OUTPUT

      - name: Create verified commit and tag via GitHub API
        uses: ryancyq/github-signed-commit@e9f3b28c80da7be66d24b8f501a5abe82a6b855f # v1.2.0
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
        with:
          branch-name: ${{ steps.create-release.outputs.branch_name }}
          commit-message: 'chore(release): v${{ steps.create-release.outputs.new_version }}'
          files: |
            CHANGELOG.md
            package.json
            README.md
          tag: 'v${{ steps.create-release.outputs.new_version }}'

      - name: Create pull request into master
        uses: repo-sync/pull-request@7e79a9f5dc3ad0ce53138f01df2fad14a04831c5 # v2.12.1
        with:
          source_branch: ${{ steps.create-release.outputs.branch_name }}
          destination_branch: 'master'
          github_token: ${{ steps.generate-token.outputs.token }}
          pr_title: "chore(release): pulling ${{ steps.create-release.outputs.branch_name }} into master"
          pr_body: ":crown: *An automated PR*\n\n${{ steps.finish-release.outputs.commit_summary }}"