github-signed-release.yaml

# yamllint disable rule:line-length
#
# Release a non-node.js project with GitHub Actions and semantic-release
#
# Required secrets:
#
#   GPG_PRIVATE_KEY_(github-actor-username)
#   GPG_PASSPHRASE_(github-actor-username)
#   CUSTOM_GITHUB_TOKEN_(github-actor-username)
#
# Also required/expected: .releaserc.json in repository root
#
name: GitHub Signed Release

on:
  push:
    branches:
      - main
      - master
      - alpha
      - beta
      - next
      - next-major

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0 # for all commits since last release

      - name: Setup Node.js for semantic-release
        uses: actions/setup-node@v3
        with:
          node-version: 'lts/*'

      # see https://github.com/marketplace/actions/import-gpg
      - name: Import GPG Key of github.actor
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@v5
        with:
          gpg_private_key: ${{ secrets[format('GPG_PRIVATE_KEY_{0}', github.actor)] }}
          passphrase: ${{ secrets[format('GPG_PASSPHRASE_{0}', github.actor)] }}
          git_config_global: true
          git_user_signingkey: true

      - name: Install semantic-release
        run: |
          npm --global install semantic-release@21 \
            conventional-changelog-conventionalcommits \
            @semantic-release/changelog \
            @semantic-release/git

      # these environment variables are set so that the next step can use them to
      # credit the actual doer for this release instead of crediting
      # semantic-release-bot
      - name: Update GITHUB_ENV and set git global config
        run: |
          echo "GIT_AUTHOR_EMAIL=$(git config --get user.email)" >> $GITHUB_ENV
          echo "GIT_AUTHOR_NAME=$(git config --get user.name)" >> $GITHUB_ENV
          echo "GIT_COMMITTER_EMAIL=$(git config --get user.email)" >> $GITHUB_ENV
          echo "GIT_COMMITTER_NAME=$(git config --get user.name)" >> $GITHUB_ENV
          echo "GIT_EMAIL=$(git config --get user.email)" >> $GITHUB_ENV
          echo "GIT_USERNAME=$(git config --get user.name)" >> $GITHUB_ENV
          git config --global commit.gpgSign true
          git config --global tag.forceSignAnnotated true

      - name: Perform Semantic Release
        if: success()
        env:
          # IF RELEASE NEEDS TO TRIGGER ANOTHER ACTION, CREATE A CUSTOM TOKEN
          # SEE https://github.com/semantic-release/github#github-authentication
          GITHUB_TOKEN: ${{ secrets[format('CUSTOM_GITHUB_TOKEN_{0}', github.actor)] }}
        run: npx semantic-release