name: Release Please

on:
  push:
    branches:
      - main

permissions:
  contents: write
  pull-requests: write

jobs:
  release-please:
    runs-on: ubuntu-latest
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      - uses: googleapis/release-please-action@v5
        id: release
        with:
          config-file: .github/release-please-config.json
          manifest-file: .release-please-manifest.json

  docker:
    needs: release-please
    if: ${{ needs.release-please.outputs.release_created == 'true' }}
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/docker-build.yml
    with:
      tag_name: ${{ needs.release-please.outputs.tag_name }}
    # The Docker Hub mirror needs DOCKERHUB_USERNAME / DOCKERHUB_TOKEN, and a
    # called workflow sees no secrets unless they are passed. GITHUB_TOKEN is
    # always available regardless, so this only widens the Docker Hub path.
    secrets: inherit