name: Release Please

# What this does
# ----------------
# release-please watches `main` for conventional-commit traffic and
# maintains a single "Release vX.Y.Z" PR that aggregates everything
# released since the last tag. Merging that PR is what triggers an
# actual PyPI / npm / GitHub-Release publish (via release.yml, which
# fires on the published-release event the bot emits at merge time).
#
# This replaces the prior "every push to main is a release" pattern
# that burned PyPI's per-project storage quota by uploading a fresh
# wheel matrix (~200 MB) for each merged `fix:` / `feat:` PR.
#
# Day-to-day:
#   - Merge a `fix:` PR into main      -> bot updates the release PR
#   - Merge a `feat:` PR into main     -> bot bumps minor in release PR
#   - Merge `ci:` / `docs:` / `chore:` -> no PR change (hidden)
#   - Ready to ship                    -> merge the release PR
#                                       (bot tags + emits release event;
#                                        release.yml does the actual builds + publishes)
#
# Config lives in `.release-please-config.json`; current versions
# tracked in `.release-please-manifest.json`.

on:
  push:
    branches: [main]

permissions:
  contents: write
  pull-requests: write

concurrency:
  # Serialize bot runs on main so two pushes don't race the
  # release-PR update. We never cancel mid-flight — losing a manifest
  # write would mean the next push computes the wrong base version.
  group: release-please-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release-please:
    runs-on: ubuntu-latest
    steps:
      # Prefer a short-lived, repo-scoped GitHub App installation token. A
      # personal PAT carries the maintainer's whole account — with a classic
      # `repo` scope that reaches every other repository they can access — and
      # this credential can tag past branch protection and reaches PyPI, npm and
      # GHCR through the `release: published` publishes. An installation token is
      # scoped to this repository and expires in an hour. Gated on the repo
      # variable so an unconfigured app falls through instead of blocking a
      # release. See #2955.
      - name: Mint installation token
        id: app-token
        if: ${{ vars.RELEASE_APP_ID != '' }}
        continue-on-error: true
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - uses: googleapis/release-please-action@v5
        with:
          # Neither an app token nor a PAT is GITHUB_TOKEN, and that matters: a
          # release/tag created by GITHUB_TOKEN does NOT emit events that trigger
          # other workflows, so release.yml (PyPI/npm) and docker.yml — which fire
          # on `release: published` — never ran, and releases had to be cut by
          # hand. Falls back to GITHUB_TOKEN when nothing else is set (the release
          # PR still opens; it just won't trigger the downstream publishes).
          token: ${{ steps.app-token.outputs.token || secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
          config-file: .release-please-config.json
          manifest-file: .release-please-manifest.json