.github/workflows/release.yml

name: "Create release"

on:
  workflow_dispatch:
    inputs:
      version:
        required: true
        type: string
        description: "Match the value in version.bzl"

permissions:
  id-token: write
  attestations: write
  contents: write

jobs:
  tests:
    name: "Release Tests"
    uses: "./.github/workflows/checks.yml"

  create_tag:
    name: "Create tag"
    runs-on:
      - "ubuntu-latest"
    needs:
      - "tests"

    steps:
      - uses: actions/checkout@v6

      - name: "Create tag"
        id: "tag"
        env:
          VERSION: "${{ inputs.version }}"

          GIT_AUTHOR_NAME: "${{ github.actor }}"
          GIT_AUTHOR_EMAIL: "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
          GIT_COMMITTER_NAME: "${{ github.actor }}"
          GIT_COMMITTER_EMAIL: "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
        run: |
          # 3. Push release tag.
          git tag "${VERSION}" "HEAD"
          git push origin "${VERSION}"

  release:
    name: "Create GitHub release"
    needs:
      - "create_tag"

    uses: "bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.3"
    with:
      # Create a distribution tarball with the release branded in to MODULE.bazel
      # The workflow appends `--disk_cache` here. There seems to be now way to
      # opt out, so use `|| false` to make it be |stuff we want || false --disk_cache|
      bazel_test_command: bazel build //distro:distro || false
      release_files: "bazel-bin/distro/rules_pkg-*.tar.gz"
      tag_name: "${{ inputs.version }}"