release-please.yml

---
name: Create Release

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.ref }}-${{ github.workflow }}

permissions:
  contents: read

jobs:
  create-release:
    runs-on: ubuntu-latest
    steps:
      - uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
        id: token
        with:
          app-id: ${{ vars.FOREST_RELEASER_APP_ID }}
          private-key: ${{ secrets.FOREST_RELEASER_APP_PRIVATE_KEY }}
      - uses: googleapis/release-please-action@a02a34c4d625f9be7cb89156071d8567266a2445 # v4.2.0
        id: release
        with:
          token: ${{ steps.token.outputs.token }}