1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# The release automation and the crates.io trusted publisher. This filename
# is registered at crates.io; cargo-dist's release.yml builds binaries and
# must never be registered there.
#
# Both halves run on every push to the trunk, and to a release/* line when a
# project keeps older lines. The pull-request half maintains the one release
# pull request against the pushed branch; the release half publishes and tags
# only on the push that lands the bot's own bump, which release_always = false
# recognizes by its release-plz-* head branch. The publish half runs free of
# any concurrency group — cancelling it could skip a release — while the
# pull-request half serializes per ref so racing pushes cannot fight over the
# release pull request.
name: release-plz
permissions:
on:
push:
branches:
jobs:
# Merging the release pull request is the release: the bump push lands here,
# and this half publishes over OIDC and pushes the tag. The app token is what
# makes the tag trigger release.yml; a tag pushed with GITHUB_TOKEN starts no
# further workflow. On a release/* line the same job tags the line's patch.
release-plz-release:
if: github.repository_owner == 'OWNER'
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
fetch-depth: 0
persist-credentials: false
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
id: app-token
with:
app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
private-key: ${{ secrets.RELEASE_BOT_APP_PRIVATE_KEY }}
- uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
- uses: release-plz/action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5
id: release
with:
command: release
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
release-plz-pr:
if: github.repository_owner == 'OWNER'
runs-on: ubuntu-latest
permissions:
contents: read
concurrency:
group: release-plz-${{ github.ref }}
cancel-in-progress: false
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
fetch-depth: 0
persist-credentials: false
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
id: app-token
with:
app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
private-key: ${{ secrets.RELEASE_BOT_APP_PRIVATE_KEY }}
- uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
- uses: release-plz/action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5
id: release-pr
with:
command: release-pr
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}