release.yml

name: Release SDK if needed

on:
  pull_request:
    branches: main
    types: closed

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true && contains(github.event.pull_request.head.ref, 'release/')
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
        with:
          fetch-depth: 0
      - name: Setup Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: '3.10'
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install poetry
          poetry install
      - name: Build the package
        run: poetry build
      - name: Publish to PyPi
        uses: step-security/gh-action-pypi-publish@ef63b3f651e4131083ceb916595ce721a1959385 # v1.14.0
        with:
          password: ${{ secrets.PYPI_API_TOKEN }}
      - name: Create Release tag
        id: create-tag
        env:
          PR_REF: ${{ github.event.pull_request.head.ref }}
        run: |
          release_tag=$(echo "$PR_REF" | cut -d "/" -f2)
          echo "::set-output name=release-tag::$release_tag"
      - name: Make new release
        uses: step-security/release-action@a0d8e0f90f554c15366ca2c9046bf4090d24adbe # v1.21.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          tag: ${{ steps.create-tag.outputs.release-tag }}
          commit: main
          body: ${{ github.event.pull_request.body }}