release.yml

name: Release

on:
  push:
    branches: [main]
  workflow_dispatch: {}

# Note: release-please uses GITHUB_TOKEN, which can't trigger other workflows
# (GitHub limitation). When the release PR auto-merges, the push to main does
# NOT trigger this workflow. After the release PR merges, manually dispatch:
#   gh workflow run Release
# CI checks on release PRs are handled by release-pr-checks.yml via
# workflow_run (fires when this workflow completes). That workflow posts commit
# statuses to the PR head SHA so branch protection sees the results.
# Docker publishing uses docker-publish.yml (also workflow_run).

permissions: read-all

jobs:
  release-please:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      pr: ${{ steps.rp.outputs.pr }}
      release_created: ${{ steps.rp.outputs.release_created }}
    steps:
      - name: Run release-please
        id: rp
        uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
        with:
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

      - name: Auto-merge release PR
        if: steps.rp.outputs.pr
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          PR_NUM=$(echo '${{ steps.rp.outputs.pr }}' | jq -r '.number')
          echo "Enabling auto-merge for release PR #$PR_NUM"
          gh pr merge "$PR_NUM" --auto --squash --repo "${{ github.repository }}"