diff --git a/.github/workflows/semantic-release.yml b/.github/workflows/semantic-release.yml index 5883b87..7cbd879 100644 --- a/.github/workflows/semantic-release.yml +++ b/.github/workflows/semantic-release.yml @@ -12,10 +12,10 @@ jobs: release: runs-on: ubuntu-latest concurrency: release - environment: - github: release + permissions: id-token: write + contents: write steps: - name: Harden Runner @@ -23,19 +23,28 @@ jobs: with: egress-policy: audit - - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + - name: Setup | Checkout Repository at workflow sha + uses: actions/checkout@v4 with: fetch-depth: 0 - token: ${{ secrets.GH_TOKEN }} + ref: ${{ github.sha }} + + - name: Setup | Force correct release branch on workflow sha + run: | + git checkout -B ${{ github.ref_name }} ${{ github.sha }} - - name: Python Semantic Release + - name: Action | Semantic Version Release id: release + # Adjust tag with desired version if applicable. uses: python-semantic-release/python-semantic-release@v9.9.0 with: - github_token: ${{ secrets.GH_TOKEN }} + github_token: ${{ secrets.GITHUB_TOKEN }} + git_committer_name: "github-actions" + git_committer_email: "actions@users.noreply.github.com" - - name: Publish to GitHub Releases - uses: python-semantic-release/upload-to-gh-release@v9.9.0 + - name: Publish | Upload to GitHub Release Assets + uses: python-semantic-release/publish-action@v9.8.9 if: steps.release.outputs.released == 'true' with: - github_token: ${{ secrets.GH_TOKEN }} + github_token: ${{ secrets.GITHUB_TOKEN }} + tag: ${{ steps.release.outputs.tag }}