Add release-plz automation (PR on main, tag on merged release PR)

Author: timvw

.github/workflows/release-plz.yml

@@ -0,0 +1,94 @@
+name: Release-plz
+
+permissions:
+  pull-requests: write
+  contents: write
+
+on:
+  push:
+    branches:
+      - main          # create/update release PR on every push to main
+  pull_request:
+    types: [closed]   # tag/release only when a release PR is merged
+  workflow_dispatch:
+
+jobs:
+  release-pr:
+    name: Release PR
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    env:
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Create GitHub App token
+        id: app-token
+        if: ${{ env.BOT_APP_ID != '' && env.BOT_PRIVATE_KEY != '' }}
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ env.BOT_APP_ID }}
+          private-key: ${{ env.BOT_PRIVATE_KEY }}
+
+      - name: Install release-plz
+        uses: taiki-e/install-action@v2
+        with:
+          tool: release-plz@0.3.149
+
+      - name: Run release-plz release-pr
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          release-plz release-pr \
+            --git-token "${GITHUB_TOKEN}" \
+            --repo-url "https://github.com/${GITHUB_REPOSITORY}" \
+            --config .release-plz.toml \
+            -o json
+
+  release-tag:
+    name: Tag and GitHub release
+    runs-on: ubuntu-latest
+    needs: []
+    # Run when a PR (with label 'release') is merged, or via manual dispatch
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' &&
+       github.event.pull_request.merged == true &&
+       contains(join(fromJson(toJson(github.event.pull_request.labels)).*.name, ','), 'release'))
+    env:
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Create GitHub App token
+        id: app-token
+        if: ${{ env.BOT_APP_ID != '' && env.BOT_PRIVATE_KEY != '' }}
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ env.BOT_APP_ID }}
+          private-key: ${{ env.BOT_PRIVATE_KEY }}
+
+      - name: Install release-plz
+        uses: taiki-e/install-action@v2
+        with:
+          tool: release-plz@0.3.149
+
+      - name: Run release-plz release (tags only; GitHub release handled by binaries workflow)
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          release-plz release \
+            --git-token "${GITHUB_TOKEN}" \
+            --repo-url "https://github.com/${GITHUB_REPOSITORY}" \
+            --config .release-plz.toml \
+            -o json

.release-plz.toml

@@ -0,0 +1,7 @@
+[workspace]
+publish = false                 # do not publish to crates.io
+git_tag_enable = true           # create git tags
+git_release_enable = false      # GitHub release is handled by the Release workflow
+git_release_draft = false
+changelog_update = true
+pr_labels = ["release"]