release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      bump:
        description: "Release bump: major, minor or patch"
        required: true
        default: "patch"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}  # Deny all permissions by default at workflow level

jobs:
  bump-version:
    runs-on: ubuntu-latest
    environment: tag-release
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.13'
      - name: Install release tooling
        run: python -m pip install bump2version
      - name: Bump and tag
        env:
          BUMP: ${{ github.event.inputs.bump }}
        run: |
          git config --local user.email "swan-admins@cern.ch"
          git config --local user.name "swan-admins[bot]"
          bump2version ${BUMP}
      - name: Push changes
        env:
          WORKFLOW_ACCESS_TOKEN: ${{ secrets.WORKFLOW_ACCESS_TOKEN }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          git remote set-url origin "https://x-access-token:${WORKFLOW_ACCESS_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git push origin "${REF_NAME}" --tags --atomic