chore: release v5.3.0 (#454) #262
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| jobs: | |
| release-plz: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Generate token (SW Release Bot) | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ secrets.RELEASER_APP_ID }} | |
| private-key: ${{ secrets.RELEASER_APP_PRIVATE_KEY }} | |
| # Least-privilege scope: release-plz needs to push version-bump | |
| # commits + release-PR branches (contents:write), open the | |
| # release PR (pull-requests:write), and create GitHub Releases | |
| # (releases is part of contents:write). | |
| permission-contents: write | |
| permission-pull-requests: write | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| fetch-depth: 0 | |
| # persist-credentials: false — release-plz reads the token via | |
| # the explicit GITHUB_TOKEN env var on its own steps, NOT via | |
| # .git/config. Disabling default credential persistence closes | |
| # the credential-persistence attack surface (zizmor's | |
| # `artipacked` lint — token leakage via the .git/config that | |
| # the default checkout would have populated with the | |
| # GITHUB_TOKEN, then exfiltrated by any later | |
| # actions/upload-artifact step). | |
| persist-credentials: false | |
| token: ${{ steps.app-token.outputs.token }} | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| with: | |
| toolchain: stable | |
| # Step 1: Create or update release PR (version bump + changelog) | |
| - name: Create release PR | |
| uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5.130 | |
| with: | |
| command: release-pr | |
| config: .release-plz.toml | |
| env: | |
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | |
| # Step 2: If version in Cargo.toml > latest tag, create GitHub Release + tag | |
| # This triggers release.yml → cargo publish via OIDC | |
| - name: Create GitHub Release | |
| uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5.130 | |
| with: | |
| command: release | |
| config: .release-plz.toml | |
| env: | |
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} |