Release

name: Release

# This repository publishes reusable workflows that other repositories pin.
# Every push to main is therefore a release: it cuts vX.Y.Z and moves the
# floating major alias (vX) that consumers reference.

on:
  push:
    branches: [main]

# Serialize releases. Two pushes landing close together would otherwise race
# on the same tag namespace and one would compute a version the other took.
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write

jobs:
  tag:
    name: Tag Release
    uses: ./.github/workflows/shared-tag-release.yml
    with:
      # Lightweight, not annotated: consumers pin these tags as reusable-workflow
      # refs, and through an annotated tag GitHub cannot resolve a *-main-pipeline's
      # nested ./ calls on push events -- every push-triggered caller aborted at
      # startup with zero jobs. Pull-request runs and leaf workflows were unaffected.
      annotated: false

  major-alias:
    name: Move floating major tag
    needs: tag
    if: needs.tag.outputs.version_tag != ''
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0

      - name: Move major alias to the new release
        env:
          VERSION_TAG: ${{ needs.tag.outputs.version_tag }}
        run: |
          MAJOR="${VERSION_TAG%%.*}"

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git fetch --tags --force

          # Lightweight, for the same reason as the version tag above.
          git tag -f "$MAJOR" "${VERSION_TAG}^{commit}"
          git push origin "refs/tags/${MAJOR}" --force

          echo "### ${MAJOR} now points at ${VERSION_TAG}" >> "$GITHUB_STEP_SUMMARY"