release-tag.yml

# Create a tag when a PR on a release/v* branch is merged

name: release-tag

on:
  pull_request:
    types:
      - closed
    branches:
      - main

jobs:
  tag:
    runs-on: ubuntu-22.04
    steps:
      -
        name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      -
        name: Temporarily disable "include administrators" branch protection
        if: ${{ always() && github.ref == 'refs/heads/main' }}
        id: disable_include_admins
        uses: benjefferies/branch-protection-bot@a37e132671409118a53e37e9c81d63fd534bb2e7 # 1.0.9
        with:
          access_token: ${{ secrets.REPO_GHA_PAT }}
          branch: main
          enforce_admins: false
      -
        name: Create tag
        if: github.event.pull_request.merged == true && startsWith(${{ github.head_ref }}, "release/")
        uses: christophebedard/tag-version-commit@ea0363ff76cae3e81c21695cdd21218204be290b # v1.6.3
        with:
          token: ${{ secrets.REPO_GHA_PAT }}
          version_regex: '^Release ([a-z-]+-v[0-9]+\.[0-9]+\.[0-9]+)'
          dry_run: false
      -
        name: Enable "include administrators" branch protection
        uses: benjefferies/branch-protection-bot@a37e132671409118a53e37e9c81d63fd534bb2e7 # 1.0.9
        if: ${{ always() && github.ref == 'refs/heads/main' }}
        with:
          access_token: ${{ secrets.REPO_GHA_PAT }}
          branch: main
          enforce_admins: ${{ steps.disable_include_admins.outputs.initial_status }}