release.yml

name: Publish release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

jobs:
  release:
    runs-on: ubuntu-latest

    permissions:
      contents: write
      pull-requests: write
      deployments: write

    steps:
      - uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
        with:
          egress-policy: audit

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - uses: mikepenz/release-changelog-builder-action@f3fc77b47b74e78971fffecb2102ae6eac9a44d6 # v5
        id: build_changelog
        with:
          configuration: .github/changelog.json
          failOnError: "true"
          fetchReviewers: "true"

      - uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
        if: startsWith(github.ref, 'refs/tags/')
        with:
          body: ${{steps.build_changelog.outputs.changelog}}