1---
  2name: "Release"
  3on:
  4  workflow_dispatch:
  5  pull_request_target:
  6    types: [closed]
  7    branches:
  8      - main
  9jobs:
 10  release:
 11    permissions:
 12      contents: write       # Create release and push tags
 13      pull-requests: read   # Read PR labels for release-drafter
 14      packages: write       # Push container image to ghcr.io
 15      id-token: write       # Federate for artifact attestation
 16      attestations: write   # Generate build provenance attestations
 17      discussions: write    # Create release announcement discussion
 18    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/release.yaml@13d124b245cf85ba41d9dd58d6888979043f1a29 # v1.2.3
 19    with:
 20      publish: true
 21      release-config-name: release-drafter.yml
 22      release-only-with-label: true
 23    secrets:
 24      github-token: ${{ secrets.GITHUB_TOKEN }}
 25  publish-cue:
 26    needs: release
 27    if: needs.release.outputs.full-tag != ''
 28    runs-on: ubuntu-latest
 29    permissions:
 30      contents: read
 31    steps:
 32      - name: Checkout
 33        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 34        with:
 35          fetch-depth: 0
 36          persist-credentials: false
 37      - name: Setup Cue
 38        uses: cue-lang/setup-cue@a93fa358375740cd8b0078f76355512b9208acb1 # v1.0.1
 39        with:
 40          version: "v0.15.1"
 41      - name: Login to Central Registry
 42        run: cue login --token=${{ secrets.CUE_REG_TOKEN }}
 43      - name: Publish the module
 44        run: cue mod publish ${{ needs.release.outputs.full-tag }}
 45  publish-openapi:
 46    # The website (and other downstream type generators) consume the spec's
 47    # OpenAPI projection, so attach it to the release as an asset.
 48    needs: release
 49    if: needs.release.outputs.full-tag != ''
 50    runs-on: ubuntu-latest
 51    permissions:
 52      contents: write   # Upload the release asset
 53    steps:
 54      - name: Checkout
 55        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 56        with:
 57          ref: ${{ needs.release.outputs.full-tag }}
 58          persist-credentials: false
 59      - name: Setup Go
 60        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 61        with:
 62          go-version: '1.25'
 63      - name: Generate openapi.yaml
 64        run: make genopenapi
 65      - name: Upload release asset
 66        env:
 67          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 68          TAG: ${{ needs.release.outputs.full-tag }}
 69        run: gh release upload "$TAG" generated/openapi.yaml --clobber
 70  notify-website:
 71    # The website repo regenerates its schema reference pages from the
 72    # released spec, so tell it a new release exists. This must happen here
 73    # rather than in an `on: release` workflow in the website repo: the
 74    # release is created with GITHUB_TOKEN, whose events do not trigger
 75    # other workflows.
 76    #
 77    # Runs after publish-openapi so the rebuild finds the openapi.yaml
 78    # asset already attached instead of racing the upload.
 79    needs: [release, publish-openapi]
 80    if: needs.release.outputs.full-tag != ''
 81    runs-on: ubuntu-latest
 82    permissions: {}
 83    steps:
 84      - name: Generate GitHub App token
 85        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
 86        id: app-token
 87        with:
 88          client-id: ${{ secrets.GEMARA_AUTOMATION_CLIENT_ID }}
 89          private-key: ${{ secrets.GEMARA_AUTOMATION_PRIVATE_KEY }}
 90          owner: ${{ github.repository_owner }}
 91          repositories: website
 92          permission-contents: write
 93      - name: Trigger website rebuild
 94        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
 95        env:
 96          TAG: ${{ needs.release.outputs.full-tag }}
 97        with:
 98          github-token: ${{ steps.app-token.outputs.token }}
 99          script: |
100            await github.rest.repos.createDispatchEvent({
101              owner: context.repo.owner,
102              repo: 'website',
103              event_type: 'gemara-release',
104              client_payload: { ref: process.env.TAG },
105            });