release.yml

name: Release

on:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  verify:
    if: startsWith(github.event.head_commit.message, 'Release v')
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        php: ['8.4', '8.5']
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240
        with:
          php-version: ${{ matrix.php }}
          coverage: none
          tools: composer:2.9.8@sha256:59b2c50e10cafa0d8efc19ede9a326d782f096c674a26baf98cf042ce23de890
      - run: composer validate --strict
      - run: composer install --no-interaction --prefer-dist --no-progress
      - run: composer audit
      - run: composer check

  publish:
    if: startsWith(github.event.head_commit.message, 'Release v')
    needs: verify
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - name: Publish GitHub release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
        run: |
          set -euo pipefail
          first_line="${COMMIT_MESSAGE%%$'\n'*}"
          tag="${first_line#Release }"
          if ! [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
            echo "Invalid release tag: $tag" >&2
            exit 1
          fi
          if gh release view "$tag" >/dev/null 2>&1; then
            echo "Release $tag already exists."
            exit 0
          fi
          gh release create "$tag" --target "$GITHUB_SHA" --title "$tag" --generate-notes