release-draft.yml

name: Release – Draft

on:
  workflow_dispatch: # checkov:skip=CKV_GHA_7
    inputs:
      bump-type:
        description: "Specify if the version should be bumped as patch, minor, or major"
        required: true
        type: choice
        options:
          - patch
          - minor
          - major

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write
  pull-requests: write

jobs:
  publish-draft-release:
    runs-on: ubuntu-latest
    env:
      ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.MAVEN_CENTRAL_SIGNING_KEY }}
      ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.MAVEN_CENTRAL_SIGNING_KEY_PASSWORD }}
      ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_NEXUS_USERNAME }}
      ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_NEXUS_PASSWORD }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install JDK 17
        uses: actions/setup-java@v5
        with:
          distribution: "zulu"
          java-version: "17"

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2

      - name: Get current version
        id: version-file
        run: |
          version_from_file=$(head -n 1 VERSION)
          echo "release-version=$version_from_file" >> $GITHUB_OUTPUT

      - name: Bump version
        id: bump-version
        uses: actions-ecosystem/action-bump-semver@34e334551143a5301f38c830e44a22273c6ff5c5 # v1.0.0
        with:
          current_version: ${{ steps.version-file.outputs.release-version }}
          level: ${{ github.event.inputs.bump-type || 'patch' }}

      - name: Save bumped version to file
        run: |
          echo "${{ steps.bump-version.outputs.new_version }}" > VERSION

      - name: Publish to Maven local (smoke test)
        run: ./gradlew publishMavenPublicationToMavenLocal -PVERSION=${{ steps.bump-version.outputs.new_version }}

      - name: Generate changelog entry
        id: changelog
        # Pinned SHA for Semgrep (no mutable @main); bump when upgrading the action.
        uses: ROKT/rokt-workflows/actions/generate-changelog@c5c93e92107c520fb8b8cf71070995abdf4c403f
        with:
          version: ${{ steps.bump-version.outputs.new_version }}
          repo-url: https://github.com/${{ github.repository }}
          changelog-path: CHANGELOG.md
          exclude-types: chore,ci,test,build
          kits-path: kits

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          token: ${{ secrets.MP_SEMANTIC_RELEASE_BOT }}
          commit-message: "chore: prepare release ${{ steps.bump-version.outputs.new_version }}"
          branch: release/${{ steps.bump-version.outputs.new_version }}
          title: "Prepare release ${{ steps.bump-version.outputs.new_version }}"
          base: main
          body: |
            Preparing for release ${{ steps.bump-version.outputs.new_version }}
            - Bumped version to ${{ steps.bump-version.outputs.new_version }}