monthly-release.yml

name: Monthly Release

on:
  schedule:
    # 1st of month, 6 AM UTC
    - cron: '0 6 1 * *'
  workflow_dispatch:
    inputs:
      version_override:
        description: 'Override version (e.g., v1.3.0). Leave empty for auto-increment.'
        required: false
        type: string

# Prevent overlap if a manual dispatch races with the cron trigger.
concurrency:
  group: monthly-release
  cancel-in-progress: false

permissions: {}

jobs:
  monthly-release:
    name: Monthly Automated Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write
      attestations: write
      security-events: write

    steps:
      - name: Harden runner
        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

      - name: Determine version
        id: version
        env:
          VERSION_OVERRIDE: ${{ github.event.inputs.version_override }}
        run: |
          if [ -n "$VERSION_OVERRIDE" ]; then
            # Validate format so a typo doesn't push a malformed tag.
            if ! [[ "$VERSION_OVERRIDE" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
              echo "::error::Invalid version_override '$VERSION_OVERRIDE'. Expected vMAJOR.MINOR.PATCH[-prerelease]."
              exit 1
            fi
            VERSION="$VERSION_OVERRIDE"
          else
            # Get latest tag and auto-increment patch
            LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0")
            echo "Latest tag: $LATEST_TAG"

            # Parse version components
            VERSION_NUM="${LATEST_TAG#v}"
            MAJOR=$(echo "$VERSION_NUM" | cut -d. -f1)
            MINOR=$(echo "$VERSION_NUM" | cut -d. -f2)
            PATCH=$(echo "$VERSION_NUM" | cut -d. -f3)

            # Increment patch
            PATCH=$((PATCH + 1))
            VERSION="v${MAJOR}.${MINOR}.${PATCH}"
          fi

          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          echo "Releasing version: $VERSION"

      - name: Check for changes since last release
        id: changes
        run: |
          LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          if [ -z "$LATEST_TAG" ]; then
            echo "has_changes=true" >> $GITHUB_OUTPUT
            echo "No previous tags found, proceeding with release."
          else
            COMMIT_COUNT=$(git rev-list "${LATEST_TAG}..HEAD" --count)
            echo "Commits since $LATEST_TAG: $COMMIT_COUNT"
            if [ "$COMMIT_COUNT" -gt 0 ]; then
              echo "has_changes=true" >> $GITHUB_OUTPUT
            else
              echo "has_changes=false" >> $GITHUB_OUTPUT
              echo "No changes since last release, skipping."
            fi
          fi

      - name: Generate changelog
        if: steps.changes.outputs.has_changes == 'true'
        id: changelog
        run: |
          LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          {
            echo "CHANGELOG<<EOF"
            echo "## Monthly Automated Release"
            echo ""
            echo "This is an automated monthly release that includes updated system packages and all changes merged since the last release."
            echo ""
            if [ -n "$LATEST_TAG" ]; then
              echo "### Changes since $LATEST_TAG"
              echo ""
              git log "${LATEST_TAG}..HEAD" --pretty=format:"- %s (%h)" --no-merges
              echo ""
              echo ""
              echo "### Dependency Updates"
              echo ""
              git log "${LATEST_TAG}..HEAD" --pretty=format:"- %s (%h)" --no-merges --grep="chore(deps)"
            else
              echo "### Initial Release"
              echo ""
              git log --pretty=format:"- %s (%h)" --no-merges -20
            fi
            echo ""
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Create and push tag
        if: steps.changes.outputs.has_changes == 'true'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "${{ steps.version.outputs.VERSION }}" -m "Monthly release ${{ steps.version.outputs.VERSION }}"
          git push origin "${{ steps.version.outputs.VERSION }}"

      - name: Create GitHub Release
        if: steps.changes.outputs.has_changes == 'true'
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2
        with:
          tag_name: ${{ steps.version.outputs.VERSION }}
          name: ${{ steps.version.outputs.VERSION }} (Monthly)
          body: ${{ steps.changelog.outputs.CHANGELOG }}
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}