release.yaml

---
name: "Release"
on:
  workflow_call:
    inputs:
      publish:
        required: false
        type: boolean
        default: true
      release-config-name:
        required: true
        type: string
    secrets:
      github-token:
        required: true
    outputs:
      full-tag:
        description: "Full tag of release"
        value: ${{ jobs.create_release.outputs.full-tag }}
      short-tag:
        description: "Short tag of release"
        value: ${{ jobs.create_release.outputs.short-tag }}
      body:
        description: "Body content of release"
        value: ${{ jobs.create_release.outputs.body }}
permissions:
  contents: read
jobs:
  create_release:
    # Release if:
    # - Manual deployment (workflow_dispatch), OR
    # - PR was merged with a breaking, feature, vuln, or release label
    # Note: major/minor/patch labels alone do NOT trigger a release
    if: >
      github.event_name == 'workflow_dispatch' ||
      (github.event.pull_request.merged == true &&
       (contains(github.event.pull_request.labels.*.name, 'breaking') ||
        contains(github.event.pull_request.labels.*.name, 'feature') ||
        contains(github.event.pull_request.labels.*.name, 'vuln') ||
        contains(github.event.pull_request.labels.*.name, 'release')))
    outputs:
      full-tag: ${{ steps.release-drafter.outputs.tag_name }}
      short-tag: ${{ steps.get_tag_name.outputs.SHORT_TAG }}
      body: ${{ steps.release-drafter.outputs.body }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit
      - uses: release-drafter/release-drafter@3a7fb5c85b80b1dda66e1ccb94009adbbd32fce3 # v7.0.0
        id: release-drafter
        with:
          config-name: ${{ inputs.release-config-name }}
          publish: ${{ inputs.publish }}
          token: ${{ secrets.github-token }}
      - name: Get the Short Tag
        id: get_tag_name
        run: |
          short_tag=$(echo ${{ steps.release-drafter.outputs.tag_name }} | cut -d. -f1)
          echo "SHORT_TAG=$short_tag" >> "$GITHUB_OUTPUT"