app.yml

# GitHub App manifest for the n3ary-release-bot
#
# This file is the GitHub App manifest. To register the app:
#   1. Go to https://github.com/organizations/n3ary/settings/apps/new
#   2. Paste the contents of this file as the manifest
#   3. Confirm the name, webhook URL (your Worker URL + /webhook), and events
#   4. GitHub creates the app and gives you an App ID + private key
#
# After registration, the App ID and private key are configured as
# Cloudflare Worker secrets (see README.md step 2).

name: n3ary-release-bot
description: Org-level release bot for the n3ary GitHub org. Bumps package.json#version on main after every merged PR using CalVer (YY.M.D-N) in Europe/Bucharest timezone.

url: https://github.com/n3ary/release-bot

# Webhook URL is the Cloudflare Worker URL with /webhook appended.
# Set this to your actual Worker URL after the first `wrangler deploy`.
hook_attributes:
  url: https://n3ary-release-bot.REPLACE_ME.workers.dev/webhook
  active: true

# Events the bot subscribes to. Only pull_request: the bot acts on
# merged PRs and opens a version-bump PR. We deliberately do NOT
# subscribe to push events: the bot's own version-bump PR auto-merge
# produces a push event on main, and we don't want the bot to
# re-trigger on that. The bot's webhook handler also explicitly
# rejects non-pull_request events, so the push event would be
# ignored even if subscribed -- but skipping the subscription
# saves a wasted round-trip.
events:
  - pull_request

# Permissions the bot needs. The bot is a PR-based contributor:
# it creates branches, commits the version bump, opens a PR, and
# enables auto-merge. All of that requires `contents: write` (for
# the commit) and `pull_requests: write` (for opening the PR and
# enabling auto-merge). `metadata: read` is required for any app.
permissions:
  contents: write       # create the version-bump commit on the bot's branch
  pull_requests: write  # open the PR and enable auto-merge
  metadata: read        # always required

# Default events receive the full payload. We only need the PR event
# so we don't need to subscribe to anything else.
default_events:
  - pull_request

# The bot does not need to act on behalf of a user.
public: false