release.yml

---
name: Release

on:
  workflow_dispatch:
  pull_request_target:
    types:
      - closed
    branches:
      - main

permissions:
  contents: read

jobs:
  create_release:
    # release if
    # manual deployment OR
    # merged to main and labelled with release labels
    if: |
      (github.event_name == 'workflow_dispatch') ||
      (github.event.pull_request.merged == true &&
      (contains(github.event.pull_request.labels.*.name, 'breaking') ||
      contains(github.event.pull_request.labels.*.name, 'feature') ||
      contains(github.event.pull_request.labels.*.name, 'vuln') ||
      contains(github.event.pull_request.labels.*.name, 'release')))
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: read
    steps:
      - uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348 # pin@v6
        id: release-drafter
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          config-name: release-drafter.yml
          publish: true