github-release.yml

name: github-release

permissions:
  contents: read

on:
  workflow_dispatch:
    inputs:
      release-branch:
        description: "Branch to create release from"
        required: false
        default: "main"
      increment:
        description: "Version increment type"
        required: false
        type: choice
        options:
          - patch
          - minor
          - major
        default: "patch"
      prerelease_type:
        description: "Prerelease type"
        required: false
        type: choice
        options:
          - none
          - alpha
          - beta
          - rc
        default: "none"
      draft:
        description: "Create as draft release"
        required: false
        type: boolean
        default: false

jobs:
  pure-wheel-test:
    uses: ./.github/workflows/pure-wheel-test.yml

  release:
    needs: pure-wheel-test
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          ref: ${{ inputs.release-branch }}

      - name: Check actor is a repository admin
        run: |
          PERMISSION=$(gh api repos/${{ github.repository }}/collaborators/${{ github.actor }}/permission --jq '.permission')
          echo "Permission level for ${{ github.actor }}: $PERMISSION"
          if [ "$PERMISSION" != "admin" ]; then
            echo "::error::${{ github.actor }} is not a repository admin. Only admins can trigger releases."
            exit 1
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create GitHub Release with Commitizen
        uses: serapeum-org/github-actions/actions/release/github@38c111084f99d5ff5f4a1e63bedce48fe33a10c0  # github-release/v1.5.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          increment: ${{ github.event.inputs.increment }}
          prerelease-type: ${{ github.event.inputs.prerelease_type }}
          draft: ${{ github.event.inputs.draft }}
          package-manager: pixi
          package-manager-version: v0.73.0
          install-groups: "dev"

      - name: Update lockfile after version bump
        run: pixi lock

      - name: Commit and push updated lockfile
        env:
          RELEASE_BRANCH: ${{ inputs.release-branch }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add pixi.lock
          git diff --cached --quiet && echo "No lockfile changes" && exit 0
          git commit -m "build: sync pixi.lock after version bump"
          git push origin "$RELEASE_BRANCH"