name: Release
run-name: Release — determine version

on:
  push:
    branches: [main]

# Only one release at a time.
concurrency:
  group: release
  cancel-in-progress: false

permissions:
  contents: write
  issues: write
  pull-requests: write

jobs:
  semantic-release:
    name: Semantic Release
    runs-on: ubuntu-latest
    steps:
      # persist-credentials: false prevents actions/checkout from setting up
      # the credential helper with GITHUB_TOKEN. We configure git auth manually
      # with the PAT so that tag pushes trigger downstream workflows.
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Configure git credentials
        run: |
          git config --global credential.helper store
          echo "https://x-access-token:${{ secrets.RELEASE_TOKEN }}@github.com" > ~/.git-credentials
          git config --global user.name "github-actions[bot]"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - uses: actions/setup-node@v6
        with:
          node-version: 24

      - name: Install semantic-release and plugins
        run: >
          npm install --no-save
          semantic-release@24
          @semantic-release/changelog@6
          @semantic-release/git@10
          @semantic-release/github@11
          @semantic-release/commit-analyzer@13
          @semantic-release/release-notes-generator@14
          conventional-changelog-conventionalcommits@8

      - name: Run semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          GIT_AUTHOR_NAME: github-actions[bot]
          GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
          GIT_COMMITTER_NAME: github-actions[bot]
          GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
        run: npx semantic-release