semantic-release.yml

name: Semantic Release

on:
  push:
    branches:
      - staging
      - main

permissions:
  contents: read

jobs:
  release:
    runs-on: ubuntu-latest
    concurrency: release
    if: ${{ github.repository == 'sandialabs/sansmic' }}  # do not run everywhere

    permissions:
      id-token: write
      contents: write

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
      with:
        egress-policy: audit

    - name: Setup | Checkout Repository at workflow sha
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0
        ref: ${{ github.sha }}

    - name: Setup | Force correct release branch on workflow sha
      run: |
        git checkout -B ${{ github.ref_name }} ${{ github.sha }}

    - name: Setup | Get short commit SHA
      id: vars
      run: |
        echo "short_sha=$(git rev-parse --short HEAD)\n" >> $GITHUB_OUTPUT

    - name: Action | Semantic Release - Update version
      id: release
      # Adjust tag with desired version if applicable.
      uses: python-semantic-release/python-semantic-release@c1bcfdbb994243ac7cf419365d5894d6bfb2950e # v9.12.0
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        git_committer_name: "github-actions"
        git_committer_email: "actions@users.noreply.github.com"
        build: false
        changelog: true
        commit: true
        push: true
        tag: true
        vcs_release: false