update-release.yml

name: CodeQL Update Release

on:
  workflow_dispatch:
    inputs:
      mode:
        description: "Please select the bump version"
        required: true
        type: choice
        default: "patch"
        options:
          - patch
          - minor
          - major
      prerelease:
        description: "Mark the resulting GitHub Release as a pre-release (default: off, a full release)"
        required: true
        type: boolean
        default: false

jobs:
  update-release:
    runs-on: ubuntu-latest
    permissions:
      contents: read # PR creation uses a scoped GitHub App token (SECLABS_APP_ID/SECLABS_APP_KEY), not GITHUB_TOKEN

    steps:
      - name: "Checkout"
        uses: actions/checkout@v7

      - name: Get Token
        id: get_workflow_token
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ secrets.SECLABS_APP_ID }}
          private-key: ${{ secrets.SECLABS_APP_KEY }}

      - name: "Patch Release Me"
        # TODO: Return to the upstream action after its runtime image is digest-pinned:
        # https://github.com/42ByteLabs/patch-release-me/issues/169
        uses: docker://ghcr.io/42bytelabs/patch-release-me:0.6.7@sha256:b9624359ce08707dfb4d22bcbf9d1a75f7f4718ccec610ddaa62280ffea98958
        with:
          args: --disable-banner bump -m ${{ inputs.mode }}

      - name: Determine new release version
        id: release_version
        run: |
          set -euo pipefail
          NEW_VERSION="$(grep -E '^version:' .release.yml | head -1 | sed -E 's/^version:[[:space:]]*"?([^"[:space:]]+)"?/\1/')"
          echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
          echo "Release version bumped to ${NEW_VERSION}"

      - name: Set release prerelease flag
        run: |
          set -euo pipefail
          # patch-release-me's Config struct doesn't know about a `prerelease`
          # key, so it silently drops any such field the next time it
          # round-trips .release.yml (see config.rs: Config::write() re-
          # serializes from the Rust struct, not the original file text).
          # That's fine here since we always re-set it fresh on every dispatch,
          # right after the bump step, before the PR is opened - so it's never
          # stale by the time upsert-release-table.sh reads it.
          if grep -qE '^prerelease:' .release.yml; then
            sed -i -E "s/^prerelease:.*/prerelease: ${{ inputs.prerelease }}/" .release.yml
          else
            sed -i -E "/^version:/a prerelease: ${{ inputs.prerelease }}" .release.yml
          fi

      - name: Ensure version label exists
        env:
          GH_TOKEN: ${{ steps.get_workflow_token.outputs.token }}
        run: |
          set -euo pipefail
          # `gh label create --force` is idempotent, so re-running this
          # workflow for the same release version is safe.
          gh label create "release-v${{ steps.release_version.outputs.version }}" --color ededed --force

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          token: ${{ steps.get_workflow_token.outputs.token }}
          title: "Chore: Auto Update new Release"
          commit-message: "[chore]: Auto Patch new Release"
          body: |
            This is automatically created as a chore to patch and update the release.

            Requested via the "CodeQL Update Release" workflow (`workflow_dispatch`,
            `mode: ${{ inputs.mode }}`, `prerelease: ${{ inputs.prerelease }}`).

            Merging this PR triggers `publish.yml`'s real batch publish. Its `summary`
            job will create the matching GitHub Release as a **${{ inputs.prerelease && 'pre-release' || 'full release' }}**.
          branch: "auto-patch-release"
          labels: |
            version
            release-v${{ steps.release_version.outputs.version }}
          delete-branch: true