release.yml

name: Releases

on:
  workflow_call:
    outputs:
      release_id:
        description: "Tag name to use of release, empty if not needed"
        value: ${{ jobs.prepare-release.outputs.release_id }}

permissions:
  contents: read

jobs:
  prepare-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      security-events: write

    outputs:
      release_id: ${{ steps.release_info.outputs.tag }}

    steps:
      - uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit
      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
        with:
          python-version: '3.13'
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Determine release info
        id: release_info
        run: |
              if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then
                BRANCH="${GITHUB_HEAD_REF}"
              else
                BRANCH="${GITHUB_REF#refs/heads/}"
              fi

              if [[ "$BRANCH" == "main" ]]; then
                TAG="latest"
              elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
                TAG="${GITHUB_REF#refs/tags/}"
              else
                TAG=""
              fi
              echo "tag=$TAG"
              echo "tag=$TAG" >> $GITHUB_OUTPUT

      - name: Update latest tag
        if: ${{ steps.release_info.outputs.tag == 'latest' }}
        uses: EndBug/latest-tag@52ce15b2695f86a4ce47b72387dee54e47f6356c # v1.6.2
        with:
          ref: latest
          description: Last state in main
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate release notes
        if: ${{ steps.release_info.outputs.tag }}
        id: notes
        run: |
          python script/create_release_notes.py

      - name: Delete existing release
        if: ${{ steps.release_info.outputs.tag == 'latest' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.release_info.outputs.tag }}
        run: |
          if gh release view "$TAG" >/dev/null 2>&1; then
            gh release delete "$TAG" --yes
          else
            echo "No release found for $TAG."
          fi

      # Note that since this is a draft the link will be untagged (see https://github.com/cli/cli/issues/11589)
      - name: Create draft release
        if: ${{ steps.release_info.outputs.tag }}
        run: |
          gh release create "${{ steps.release_info.outputs.tag }}" \
            --repo "$GITHUB_REPOSITORY"                             \
            --title "${{ steps.release_info.outputs.tag }}"         \
            --notes-file release_notes.txt                          \
            --draft                                                 \
            --verify-tag                                            \
            LICENSE
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}