github-actions-maintainer 0.4.2

General-purpose GitHub Actions maintenance toolkit with secure workflow pinning
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

name: Reusable Auto Release

# Callable wrapper around the release action so consuming Cargo repositories
# need only a few lines of workflow. Callers own the trigger, gating, and
# concurrency group; see release/README.md for the consumer snippets.

on:
  workflow_call:
    inputs:
      bump:
        description: Version bump strategy (auto, major, minor, patch).
        required: false
        default: auto
        type: string
      tag-prefix:
        description: Prefix for release tags.
        required: false
        default: v
        type: string
      update-major-alias:
        description: Also move the moving major alias tag to the new release.
        required: false
        default: false
        type: boolean
      notes-file:
        description: Path where generated release notes are written.
        required: false
        default: release_notes.md
        type: string
      dry-run:
        description: Analyze and report without creating any commit, tag, or release.
        required: false
        default: false
        type: boolean
    secrets:
      release-token:
        description: Optional GitHub App or PAT token; falls back to GITHUB_TOKEN. Required if the created tag must trigger tag pipelines natively.
        required: false
    outputs:
      released:
        description: Whether a release was created (true or false).
        value: ${{ jobs.release.outputs.released }}
      version:
        description: The released version without the tag prefix.
        value: ${{ jobs.release.outputs.version }}
      tag:
        description: The created release tag.
        value: ${{ jobs.release.outputs.tag }}
      release-url:
        description: URL of the created GitHub Release.
        value: ${{ jobs.release.outputs.release-url }}

permissions:
  contents: read

jobs:
  release:
    name: Auto Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      released: ${{ steps.release.outputs.released }}
      version: ${{ steps.release.outputs.version }}
      tag: ${{ steps.release.outputs.tag }}
      release-url: ${{ steps.release.outputs.release-url }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Fetch the release action at the exact commit of this reusable
      # workflow (job.workflow_sha), so the action version always matches the
      # workflow ref the caller pinned — no mutable cross-repo action
      # reference.
      - name: Checkout the release action at the workflow ref
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ job.workflow_repository || 'ThreatFlux/github_actions' }}
          ref: ${{ job.workflow_sha }}
          path: .release-action
          persist-credentials: false

      - name: Release
        id: release
        uses: ./.release-action/release
        with:
          token: ${{ secrets.release-token || github.token }}
          bump: ${{ inputs.bump }}
          tag-prefix: ${{ inputs.tag-prefix }}
          update-major-alias: ${{ inputs.update-major-alias }}
          notes-file: ${{ inputs.notes-file }}
          dry-run: ${{ inputs.dry-run }}