chg: dev: update workflows, add nested release workflow

Signed-off-by: Stephen L Arnold <sarnold@vctlabs.com>

Author: sarnold

.github/workflows/debs.yml

@@ -2,6 +2,7 @@ name: Debian packages
 
 on:
   workflow_dispatch:
+  workflow_call:
   pull_request:
   push:
     branches:
@@ -11,6 +12,8 @@ jobs:
   get_version:
     name: Get version info
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     defaults:
       run:
         shell: bash
@@ -32,6 +35,8 @@ jobs:
   build_debs:
     name: ${{ matrix.name }}
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     needs: [get_version]
 
     strategy:

.github/workflows/release.yml

@@ -0,0 +1,66 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  push:
+    # release on tag push
+    tags:
+      - '*'
+
+permissions:
+  contents: write
+
+jobs:
+  build_debs:
+    name: Build deb packages
+    permissions:
+      contents: read
+    uses: ./.github/workflows/debs.yml
+
+  create_release:
+    name: Create Release
+    needs: [build_wheels, build_docs]
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Get version
+        id: get_version
+        run: |
+          echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_ENV
+          echo ${{ env.VERSION }}
+
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      # download all artifacts to project dir
+      - uses: actions/download-artifact@v5
+        with:
+          path: packages
+          pattern: libtins*
+          merge-multiple: true
+
+      - name: check artifacts
+        run: |
+          ls -l packages
+
+      - name: Generate changes file
+        uses: sarnold/gitchangelog-action@915234f151ceffb7a8c4f76de77e4ae321087b8f  # v1.1.1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN}}
+
+      - name: Create release
+        id: create_release
+        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090  # v2.4.1
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: ${{ env.VERSION }}
+          name: Release ${{ env.VERSION }}
+          body_path: CHANGES.md
+          draft: false
+          prerelease: false
+          files: |
+            packages/*.tar.gz
+            packages/*.deb