release.yml

---
name: Release
on:
  workflow_dispatch:
  pull_request_target:
    types: [closed]
    branches: [main]
permissions:
  contents: read
jobs:
  release:
    permissions:
      contents: write # Create release and push tags
      pull-requests: read # Read PR labels for release-drafter
      packages: write # Push container image to ghcr.io
      id-token: write # Federate for artifact attestation
      attestations: write # Generate build provenance attestations
      discussions: write # Create release announcement discussion
    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/release.yaml@e92cb6053ace495fe40a5f185988557afcdcecbc # v1.0.1
    with:
      publish: true
      release-config-name: release-drafter.yml
      image-name: ${{ github.repository }}
      create-attestation: true
      create-discussion: true
    secrets:
      github-token: ${{ secrets.GITHUB_TOKEN }}
      image-registry-password: ${{ secrets.GITHUB_TOKEN }}
      discussion-repository-id: ${{ secrets.RELEASE_DISCUSSION_REPOSITORY_ID }}
      discussion-category-id: ${{ secrets.RELEASE_DISCUSSION_CATEGORY_ID }}