name: release-plz

permissions: {}

on:
  workflow_dispatch: {}
  push:
    branches:
      - main
      - release-plz

concurrency:
  group: release-plz

env:
  DRY_RUN: 0

jobs:
  release-plz:
    if: github.repository == 'jdx/hk'
    runs-on: namespace-profile-endev-linux-amd64
    permissions:
      contents: write
      pull-requests: write
    steps:
      # release-plz needs persisted credentials so the mise-tasks/release-plz
      # script's `git push --tags` / `git push origin release --force` can
      # authenticate.
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # zizmor: ignore[artipacked] v6
        with:
          fetch-depth: 0
          token: ${{ secrets.HK_GH_TOKEN }}
      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
        with:
          experimental: true
          cache: false
      - run: mise trust --all
      - run: mise run release-plz
        env:
          GITHUB_TOKEN: ${{ secrets.HK_GH_TOKEN }}
