tag-and-release.yml

name: tag and release new version

on:
  pull_request_target:
    types:
      - closed

jobs:
  tag:
    name: create git tag
    if: github.event.pull_request.merged == true && github.event.pull_request.base.ref == github.event.repository.default_branch
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.bump.outputs.version }}
      changes: ${{ steps.details.outputs.changes }}
      is_new_version: ${{ steps.details.outputs.is_new_version }}
    steps:
      - id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ vars.PUBLIC_RELEASE_MANAGER_ID }}
          private-key: ${{ secrets.PUBLIC_RELEASE_MANAGER_SECRET }}
      - uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}
          ref: ${{ github.event.repository.default_branch }}
          # `fetch-depth` > 0 is required to have `ref` have an effect
          fetch-depth: 999
          fetch-tags: true
      - id: bump
        uses: commitizen-tools/commitizen-action@master
        with:
          changelog_increment_filename: .changes.md
          git_redirect_stderr: true
          commit: true
          push: false
          no_raise: 21
      - id: details
        shell: bash
        run: |
          {
            echo 'changes<<EOF'
            cat .changes.md
            echo EOF
          } >> "$GITHUB_OUTPUT"

          if [ "$REVISION" != "$PREVIOUS_REVISION" ]; then
            echo "is_new_version=1" >> "$GITHUB_OUTPUT"
            # pushing seperately to use correct auth set up during actions/checkout
            git push --atomic --tags origin HEAD:${GITHUB_REF_NAME}
          fi

  release:
    name: create new release
    needs:
      - tag
    if: ${{ needs.tag.outputs.is_new_version }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/github-script@v7
        env:
          CHANGES: ${{ needs.tag.outputs.changes }}
          TAG: ${{ needs.tag.outputs.tag }}
        with:
          script: |
            const { CHANGES, TAG } = process.env
            github.rest.repos.createRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              tag_name: TAG,
              body: CHANGES,
            })
      - name: Build package
        run: poetry build
      - name: Publish package to PyPI