sencho/.github/workflows/release-please.yml

name: Release Please

on:
  push:
    branches:
      - main
  # Manual recovery lever for cases where the action fails on a transient
  # GitHub API issue (e.g. duplicate-release-tag during a retry) and exits
  # before scanning main for new conventional commits. Re-running from the
  # Actions tab requeues the same logic against the current main HEAD; no
  # code push needed. Triggering manually does NOT skip the action's own
  # state checks, so it cannot accidentally double-publish a release.
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  release-please:
    runs-on: ubuntu-latest
    steps:
      # Mint a short-lived installation token for the `sencho-token-app`
      # GitHub App instead of using a long-lived user PAT. The token:
      #   - is scoped to this one repository (least privilege)
      #   - requests only the permissions release-please actually needs
      #   - is auto-revoked by the action's post step at job end
      #   - unlike GITHUB_TOKEN, CAN trigger downstream workflow runs, so the
      #     tag push from release-please still cascades to docker-publish.yml
      - name: Generate GitHub App installation token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: Sencho
          permission-contents: write
          permission-pull-requests: write

      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
        with:
          token: ${{ steps.app-token.outputs.token }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json