feat: first open-source commit #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # release-please watches Conventional Commits on main and maintains a rolling | |
| # "release PR" that bumps the version + CHANGELOG. Merging that PR tags the | |
| # release and publishes GitHub release notes. (Container image publishing is | |
| # intentionally out of scope for now.) | |
| # | |
| # PERMISSION TO OPEN THE RELEASE PR — pick ONE: | |
| # | |
| # (A) Repo/org setting: Settings → Actions → General → Workflow permissions → | |
| # "Read and write permissions" + "Allow GitHub Actions to create and approve | |
| # pull requests". If that checkbox is GREYED OUT, it's enforced at the | |
| # organization level — an org owner must enable it in the org's Actions | |
| # settings, OR use option (B). | |
| # | |
| # (B) Provide a token (works even when the org blocks Actions-created PRs, and | |
| # lets the release PR trigger CI). Create a fine-grained PAT scoped to this | |
| # repo with Contents: read/write + Pull requests: read/write (or a GitHub | |
| # App token), and save it as the repo secret RELEASE_PLEASE_TOKEN. | |
| # | |
| # The `token:` below uses RELEASE_PLEASE_TOKEN when present and otherwise falls back | |
| # to the default GITHUB_TOKEN — so option (A) needs no secret, option (B) just works | |
| # once the secret exists. | |
| # | |
| # Runs on push to main. Code only reaches main through a PR whose CI passed (enforced | |
| # by branch protection — see RELEASE.md), so a release is never cut from a red build. | |
| on: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| release-please: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: googleapis/release-please-action@v5 | |
| with: | |
| # Uses RELEASE_PLEASE_TOKEN (a PAT/App token) if you've set it; otherwise | |
| # falls back to the built-in token (which requires the repo/org setting). | |
| token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }} | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json |