sencho/.github/workflows/release-please.yml

name: Release Please

concurrency:
  group: release-please-${{ github.ref }}
  cancel-in-progress: false

on:
  push:
    branches:
      - main
  # Manual recovery lever for cases where the action fails on a transient
  # GitHub API issue (e.g. duplicate-release-tag during a retry) and exits
  # before scanning main for new conventional commits. Re-running from the
  # Actions tab requeues the same logic against the current main HEAD; no
  # code push needed. Triggering manually does NOT skip the action's own
  # state checks, so it cannot accidentally double-publish a release.
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  release-please:
    runs-on: ubuntu-latest
    steps:
      # Mint a short-lived installation token for the `sencho-token-app`
      # GitHub App instead of using a long-lived user PAT. The token:
      #   - is scoped to this one repository (least privilege)
      #   - requests only the permissions release-please actually needs
      #   - is auto-revoked by the action's post step at job end
      #   - unlike GITHUB_TOKEN, CAN trigger downstream workflow runs, so the
      #     tag push from release-please still cascades to docker-publish.yml
      - name: Generate GitHub App installation token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: Sencho
          permission-contents: write
          permission-pull-requests: write
          permission-issues: read

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          token: ${{ steps.app-token.outputs.token }}

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
        with:
          node-version-file: '.node-version'

      - id: release
        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
        with:
          token: ${{ steps.app-token.outputs.token }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

      - name: Credit external contributors in changelog
        if: ${{ steps.release.outputs.prs_created == 'true' }}
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          # fromJSON must tolerate empty pr: env is evaluated even when if: skips
          # (publish runs leave pr unset). Empty object yields empty RELEASE_BRANCH.
          RELEASE_BRANCH: ${{ fromJSON(steps.release.outputs.pr || '{}').headBranchName || '' }}
          MAINTAINER_LOGINS: ""
        run: |
          if [ -z "$RELEASE_BRANCH" ]; then
            echo "RELEASE_BRANCH is empty; aborting."
            exit 1
          fi
          cp scripts/credit-changelog-contributors.mjs "$RUNNER_TEMP/"
          git fetch origin "$RELEASE_BRANCH"
          git checkout "$RELEASE_BRANCH"
          node "$RUNNER_TEMP/credit-changelog-contributors.mjs"
          if [ -n "$(git status --porcelain CHANGELOG.md)" ]; then
            git config user.name "sencho-quartermaster[bot]"
            git config user.email "275163604+sencho-quartermaster[bot]@users.noreply.github.com"
            git add CHANGELOG.md
            git commit -m "chore: credit external contributors in changelog"
            git push origin "HEAD:$RELEASE_BRANCH"
          fi