monthly-release.yml

name: Monthly Release

on:
  schedule:
    # 1st of month, 6 AM UTC
    - cron: '0 6 1 * *'
  workflow_dispatch:
    inputs:
      version_override:
        description: 'Override version (e.g., v1.3.0). Leave empty for auto-increment.'
        required: false
        type: string

permissions: {}

jobs:
  monthly-release:
    name: Monthly Automated Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write
      attestations: write
      security-events: write

    steps:
      - name: Harden runner
        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          fetch-depth: 0

      - name: Determine version
        id: version
        run: |
          if [ -n "${{ github.event.inputs.version_override }}" ]; then
            VERSION="${{ github.event.inputs.version_override }}"
          else
            # Get latest tag and auto-increment patch
            LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0")
            echo "Latest tag: $LATEST_TAG"

            # Parse version components
            VERSION_NUM="${LATEST_TAG#v}"
            MAJOR=$(echo "$VERSION_NUM" | cut -d. -f1)
            MINOR=$(echo "$VERSION_NUM" | cut -d. -f2)
            PATCH=$(echo "$VERSION_NUM" | cut -d. -f3)

            # Increment patch
            PATCH=$((PATCH + 1))
            VERSION="v${MAJOR}.${MINOR}.${PATCH}"
          fi

          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          echo "Releasing version: $VERSION"

      - name: Check for changes since last release
        id: changes
        run: |
          LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          if [ -z "$LATEST_TAG" ]; then
            echo "has_changes=true" >> $GITHUB_OUTPUT
            echo "No previous tags found, proceeding with release."
          else
            COMMIT_COUNT=$(git rev-list "${LATEST_TAG}..HEAD" --count)
            echo "Commits since $LATEST_TAG: $COMMIT_COUNT"
            if [ "$COMMIT_COUNT" -gt 0 ]; then
              echo "has_changes=true" >> $GITHUB_OUTPUT
            else
              echo "has_changes=false" >> $GITHUB_OUTPUT
              echo "No changes since last release, skipping."
            fi
          fi

      - name: Generate changelog
        if: steps.changes.outputs.has_changes == 'true'
        id: changelog
        run: |
          LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          {
            echo "CHANGELOG<<EOF"
            echo "## Monthly Automated Release"
            echo ""
            echo "This is an automated monthly release that includes updated system packages and all changes merged since the last release."
            echo ""
            if [ -n "$LATEST_TAG" ]; then
              echo "### Changes since $LATEST_TAG"
              echo ""
              git log "${LATEST_TAG}..HEAD" --pretty=format:"- %s (%h)" --no-merges
              echo ""
              echo ""
              echo "### Dependency Updates"
              echo ""
              git log "${LATEST_TAG}..HEAD" --pretty=format:"- %s (%h)" --no-merges --grep="chore(deps)"
            else
              echo "### Initial Release"
              echo ""
              git log --pretty=format:"- %s (%h)" --no-merges -20
            fi
            echo ""
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Create and push tag
        if: steps.changes.outputs.has_changes == 'true'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "${{ steps.version.outputs.VERSION }}" -m "Monthly release ${{ steps.version.outputs.VERSION }}"
          git push origin "${{ steps.version.outputs.VERSION }}"

      - name: Create GitHub Release
        if: steps.changes.outputs.has_changes == 'true'
        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
        with:
          tag_name: ${{ steps.version.outputs.VERSION }}
          name: ${{ steps.version.outputs.VERSION }} (Monthly)
          body: ${{ steps.changelog.outputs.CHANGELOG }}
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}