release.yaml

name: Release

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
      - "v[0-9]+.[0-9]+.[0-9]+-dev.[0-9]+"
      - "v[0-9]+.[0-9]+.[0-9]+-beta.[0-9]+"

permissions:
  contents: read

jobs:
  artifacts:
    name: Artifacts
    uses: ./.github/workflows/artifacts.yaml
    with:
      publish: true
    permissions:
      contents: read
      packages: write
      id-token: write
      security-events: write

  dagger:
    name: Dagger
    runs-on: depot-ubuntu-latest-8

    permissions:
      contents: write
      packages: write
      id-token: write
      security-events: write

    steps:
      # Required as a workaround for Dagger to properly detect Git metadata
      - name: Checkout repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Run pipeline
        uses: dagger/dagger-for-github@a419ddbf5ee9800810f7e029de674fbe0ce855aa # v6.7.0
        with:
          verb: call
          module: github.com/${{ github.repository }}@${{ github.ref }}
          args: --ref ${{ github.ref }} release --version ${{ github.ref_name }} --github-actor ${{ github.actor }} --github-token env:GITHUB_TOKEN --pypi-token env:PYPI_TOKEN --npm-token env:NPM_TOKEN
          cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}
          version: "0.12.0"
        env:
          GITHUB_TOKEN: ${{ github.token }}
          PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}