publish-new-release.yml

name: Publish new github release

on:
  pull_request:
    branches:
      - master
    types:
      - closed

permissions:
  contents: read

jobs:
  release:
    permissions:
      contents: read  # GITHUB_TOKEN only needs read for checkout
    name: Publish new release
    runs-on: ubuntu-latest
    if: startsWith(github.event.pull_request.head.ref, 'release/') && github.event.pull_request.merged == true # only merged pull requests must trigger this job
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Generate GitHub App Token
        id: generate-token
        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
        with:
          app-id: ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_PRIVATE_KEY }}
          permission-contents: write # to create commits, tags, and releases

      - name: Extract version from branch name (for release branches)
        id: extract-version
        env:
          BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
        run: |
          VERSION="${BRANCH_NAME#release/}"
          echo "release_version=$VERSION" >> $GITHUB_OUTPUT

      - name: Checkout source branch
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          token: ${{ steps.generate-token.outputs.token }}
          fetch-depth: 0

      - name: Set Node 16
        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
        with:
          node-version: 16

      - name: Create Github Release
        id: create_release
        env:
          HUSKY: 0
          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
          CONVENTIONAL_GITHUB_RELEASER_TOKEN: ${{ steps.generate-token.outputs.token }}
        run: |
          npx conventional-github-releaser -p angular

      - name: Delete release branch
        uses: koj-co/delete-merged-action@63a03c35810a8a7d4840d18793c0f68ff8b59450 # master
        if: startsWith(github.event.pull_request.head.ref, 'release/')
        with:
          branches: 'release/*'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}