release.yml

---
name: New release
on: # yamllint disable-line rule:truthy
  workflow_dispatch:
  push:
    branches:
      - main

jobs:
  generate_changelog:
    if: github.repository_owner == 'telekom-mms' # do not run this elsewhere
    permissions:
      contents: write
      issues: read
      pull-requests: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Get Previous tag
        id: previoustag
        uses: "WyriHaximus/github-action-get-previous-tag@04e8485ecb6487243907e330d522ff60f02283ce" # v1.4.0
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

      - name: calculate next version
        id: version
        uses: patrickjahns/version-drafter-action@2076fa43abb28f31d0e8b0890253fbd1d1a966fc # v1.3.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Python
        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
        with:
          python-version: "3.10"

      - name: Install poetry
        run: pip install poetry

      - name: Update Version with poetry
        run: poetry version ${{ steps.version.outputs.next-version }}

      - name: Generate changelog
        uses: charmixer/auto-changelog-action@b25e89c9410e03189f0d48b02b3a8caad6e78015 # v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          future_release: ${{ steps.version.outputs.next-version }}

      # the token is needed so the github app can push to the repository
      # the github app can bypass the branch protection rule (need a PR to merge)
      # this way it can directly commit to main
      - name: Obtain a GitHub App Installation Access Token
        id: githubAppAuth
        run: |
          TOKEN="$(npx obtain-github-app-installation-access-token ci ${{ secrets.GH_BRANCH_PROTECTION_APP_TOKEN }})"
          echo "::add-mask::$TOKEN"
          echo token=${TOKEN} >> $GITHUB_OUTPUT

      - name: push new version
        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
        with:
          # use the token obtained in the step before
          github-token: ${{ steps.githubAppAuth.outputs.token }}
          push-branch: "main"
          commit-message: "update changelog"
          force-add: "true"
          files: pyproject.toml CHANGELOG.md
          name: Telekom MMS GmbH
          email: mms@telekom.de
          rebase: true

      # do a second checkout to prevent race situation
      # changelog gets updated but action works on old commit id
      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
        with:
          ref: main

      - name: Generate changelog for the release
        run: |
          sed '/## \[${{ steps.previoustag.outputs.tag }}\]/Q' CHANGELOG.md > CHANGELOGRELEASE.md

      - name: Read CHANGELOG.md
        id: package
        uses: juliangruber/read-file-action@b549046febe0fe86f8cb4f93c24e284433f9ab58 # v1
        with:
          path: ./CHANGELOGRELEASE.md

      - name: Delete old drafts
        uses: hugo19941994/delete-draft-releases@1bdca1ea7ffb25ae7f468a7bdb40056dae98175e # v1.0.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create Release draft
        id: create_release
        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
        with:
          release_name: ${{ steps.version.outputs.next-version }}
          tag_name: ${{ steps.version.outputs.next-version }}
          body: |
            ${{ steps.package.outputs.content }}
          draft: true