chore(deps): update renovatebot/github-action action to v46.2.5 (#110) #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Please | |
| # Release automation for this repository's shared workflows and configs. | |
| # release-please derives the next semantic version from conventional commits | |
| # on main (fix: -> patch, feat: -> minor, BREAKING CHANGE: -> major) and | |
| # maintains an accumulating "release PR" (changelog + version bump): | |
| # | |
| # merge release PR -> tag v1.2.3 + GitHub release -> floating major tag | |
| # v1 is re-pinned to the same commit (move-major-tag job below). | |
| # | |
| # Consumers of the reusable workflows can then pin exactly | |
| # (@v1.2.3) or float on the major line (@v1). | |
| # | |
| # Bootstrap: the version baseline lives in .release-please-manifest.json. | |
| on: | |
| push: | |
| branches: | |
| - main | |
| # Only the shared Renovate setup is released for now run the releaser | |
| # exclusively when one of its files changes or a release please PR is merged. | |
| # exclusively when one of its files changes. | |
| paths: | |
| - '.github/workflows/renovate.yml' | |
| - '.github/workflows/renovate-schedule.yml' | |
| - '.github/renovate-central.json5' | |
| - '.github/renovate.json5' | |
| - '.github/renovate-repositories.json' | |
| - '.release-please-manifest.json' | |
| - 'CHANGELOG.md' | |
| # Manual recovery: re-run the releaser (e.g. after a failed tag move). | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: read | |
| jobs: | |
| release-please: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| # The ODG_BOT App credentials are scoped to this environment (same as in | |
| # renovate.yml) — without it vars.ODG_BOT_APP_ID / secrets.ODG_BOT_PRIVATE_KEY | |
| # are not visible and the steps below fall back to GITHUB_TOKEN. | |
| environment: | |
| name: renovate | |
| deployment: false | |
| permissions: | |
| contents: write # release commit, tag, GitHub release | |
| pull-requests: write # the release PR | |
| outputs: | |
| release_created: ${{ steps.release.outputs.release_created }} | |
| tag_name: ${{ steps.release.outputs.tag_name }} | |
| steps: | |
| # Writes (release branch, release PR, tag, release) authenticate as the | |
| # ODG_BOT GitHub App when configured — same pattern as renovate.yml. App | |
| # tokens are not subject to the "Allow GitHub Actions to create and | |
| # approve pull requests" repository setting, which the GITHUB_TOKEN | |
| # fallback (e.g. on forks without the App configured) is. | |
| - name: Generate App token | |
| if: vars.ODG_BOT_APP_ID != '' | |
| id: generate_token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ vars.ODG_BOT_APP_ID }} | |
| private-key: ${{ secrets.ODG_BOT_PRIVATE_KEY }} | |
| permission-contents: write | |
| permission-pull-requests: write | |
| - name: Run release-please | |
| id: release | |
| uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 | |
| with: | |
| token: ${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }} | |
| # Releases created with GITHUB_TOKEN do not fire `release: published` | |
| # events, so a separate release-triggered workflow could never move the | |
| # major tag for release-please releases — do it here, driven by the | |
| # release-please outputs. Manually published releases leave the major tag | |
| # stale (move it by hand then: git tag -f vX vX.Y.Z && git push -f origin vX). | |
| move-major-tag: | |
| needs: release-please | |
| if: needs.release-please.outputs.release_created == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| # Same `renovate` environment as above: the ODG_BOT App credentials are | |
| # scoped to it. | |
| environment: | |
| name: renovate | |
| deployment: false | |
| permissions: | |
| contents: write | |
| env: | |
| TAG: ${{ needs.release-please.outputs.tag_name }} | |
| steps: | |
| # Pushing the re-pinned tag uses the ODG_BOT App token when configured | |
| # (see release-please job); checkout persists it for the git push. | |
| - name: Generate App token | |
| if: vars.ODG_BOT_APP_ID != '' | |
| id: generate_token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ vars.ODG_BOT_APP_ID }} | |
| private-key: ${{ secrets.ODG_BOT_PRIVATE_KEY }} | |
| permission-contents: write | |
| - name: Checkout (with tags) | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }} | |
| - name: Re-pin floating major tag | |
| run: | | |
| set -euo pipefail | |
| if [[ ! "$TAG" =~ ^v([0-9]+)\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "::error::release tag is not strict semver: $TAG" | |
| exit 1 | |
| fi | |
| major_tag="v${BASH_REMATCH[1]}" | |
| git tag --force "$major_tag" "$TAG" | |
| git push --force origin "$major_tag" | |
| echo "$major_tag -> $TAG" |