semantic-release.yaml

---
name: Semantic Release
on:
  push:
    branches:
      - main
  workflow_call:
    inputs:
      GH_APP_ID:
        type: string
        required: false
      semantic_release_plugins:
        type: string
        required: false
        default: ''
        description: Space-separated list of additional semantic-release plugins to install.
    secrets:
      GH_APP_PEM_FILE:
        required: false

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
    steps:
      - name: Create GitHub App token
        uses: actions/create-github-app-token@v3
        id: gh-app-token
        if: ${{ inputs.GH_APP_ID != '' }}
        with:
          app-id: ${{ inputs.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PEM_FILE }}
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          token: ${{ steps.gh-app-token.outputs.token || secrets.GITHUB_TOKEN }}
          fetch-depth: 0 
      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 'lts/*'
      - name: Install Semantic Release
        run: >
          npm install
          semantic-release
          conventional-changelog-conventionalcommits
          @semantic-release/changelog
          @semantic-release/git
          semantic-release-major-tag
          ${{ inputs.SEMANTIC_RELEASE_PLUGINS }}
      - name: Verify Semantic Release
        run: npm audit signatures
      - name: Run Semantic Release
        env:
          GITHUB_TOKEN: ${{ steps.gh-app-token.outputs.token || secrets.GITHUB_TOKEN }}
        run: npx semantic-release