release-please.yml

name: Release Please

on:
  push:
    branches: [main]
  workflow_dispatch:
  # Sweep for fix/feat commits that reached main via a GITHUB_TOKEN merge (e.g.
  # Dependabot auto-merge), which don't fire the push trigger. Keeps the app
  # token in this trusted context instead of the Dependabot PR context.
  schedule:
    - cron: '37 */6 * * *'

# App-token auth (not GITHUB_TOKEN) so the release PR triggers CI - GITHUB_TOKEN events don't fire downstream workflows.
permissions: {}

concurrency:
  group: release-please-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release-please:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}

      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
        with:
          token: ${{ steps.app-token.outputs.token }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json