release.yaml

name: release

on:
  pull_request:
    paths:
      - .github/workflows/release.yaml
      - .github/workflows/reusable--*.yaml
      - Dockerfile
      - Dockerfile.*
      - entrypoint.sh
      - entrypoint.d/**
      - hack/**
  push:
    branches:
      - main
    paths:
      - .github/workflows/release.yaml
      - .github/workflows/reusable--*.yaml
      - Dockerfile
      - Dockerfile.*
      - entrypoint.sh
      - entrypoint.d/**
      - hack/**

jobs:
  # When Renovate has updated the version of actions/runner,
  # automatically create a new release into GitHub Releases.
  create-release-if-not-exists:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
        id: release-token
        with:
          app-id: ${{ secrets.E2E_TEST_APP_ID }}
          private-key: ${{ secrets.E2E_TEST_APP_PRIVATE_KEY }}
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: bash hack/create-release-if-not-exists.sh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Trigger the build workflow against the new release
          RELEASE_TOKEN: ${{ steps.release-token.outputs.token }}