github-release.yml

---
name: Release on GitHub
on:
  workflow_call:
    inputs:
      tag-name:
        required: false
        type: string
        description: Git tag to create a release for
        default: null
      create-new-tag:
        required: false
        type: boolean
        description: Create a new tag if the input tag does not exist
        default: false
      runs-on:
        required: false
        type: string
        description: Runner to use
        default: ubuntu-latest
    secrets:
      GH_TOKEN:
        required: false
        description: GitHub token
  workflow_dispatch:  # checkov:skip=CKV_GHA_7:workflow_dispatch inputs are required for release parameters
    inputs:
      tag-name:
        required: false
        type: string
        description: Git tag to create a release for
        default: null
      create-new-tag:
        required: false
        type: boolean
        description: Create a new tag if the input tag does not exist
        default: false
permissions:
  contents: write  # IMPORTANT: mandatory for making GitHub Releases
defaults:
  run:
    shell: bash -euo pipefail {0}
    working-directory: .
jobs:
  github-release:
    runs-on: ${{ inputs.runs-on }}
    steps:
      - name: Validate the tag consistency
        if: >
          startsWith(github.ref, 'refs/tags/') && inputs.tag-name != null
          && github.ref_name != inputs.tag-name
        env:
          TAG_NAME: ${{ inputs.tag-name }}
        run: >
          echo "Invalid input tag: ${TAG_NAME} != ${GITHUB_REF_NAME}" && exit 1
      - name: Validate the input tag
        if: >
          (! startsWith(github.ref, 'refs/tags/')) && inputs.tag-name == null
        run: >
          echo 'An input tag is required for non-tag events' && exit 2
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          fetch-depth: 1
          persist-credentials: false
      - name: Create the GitHub release for the tag
        if: >
          startsWith(github.ref, 'refs/tags/')
          || ((! startsWith(github.ref, 'refs/tags/')) && ! inputs.create-new-tag)
        env:
          REPOSITORY: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GH_TOKEN || secrets.GITHUB_TOKEN }}  # zizmor: ignore[secrets-outside-env] caller-provided secret
        run: >
          gh release create "${GITHUB_REF_NAME}" --repo "${REPOSITORY}" --generate-notes --verify-tag
      - name: Create the GitHub release with the new tag
        if: >
          (! startsWith(github.ref, 'refs/tags/')) && inputs.create-new-tag
        env:
          TAG_NAME: ${{ inputs.tag-name }}
          REPOSITORY: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GH_TOKEN || secrets.GITHUB_TOKEN }}  # zizmor: ignore[secrets-outside-env] caller-provided secret
        run: >
          gh release create "${TAG_NAME}" --repo "${REPOSITORY}" --generate-notes