# Release automation: release-please maintains a
# standing release PR from conventional commits on main; merging it bumps the
# engine workspace version, writes engine/CHANGELOG.md, and mints the v-tag
# that fires the dist-generated release.yml unchanged.
#
# TOKEN SEAM (the key hazard): a tag minted with the default
# GITHUB_TOKEN does NOT trigger downstream `on: push: tags` workflows —
# GitHub suppresses workflow chaining — so release.yml would silently never
# fire. Provision RELEASE_PLEASE_TOKEN as a fine-grained PAT (or GitHub App
# token) with contents: write and pull-requests: write on this repository.
# The github.token fallback keeps the release-PR flow alive without it, but
# the minted tag will not chain until the secret exists.

name: release-please

on:
  push:
    branches: [main]

permissions:
  contents: write
  pull-requests: write

# Serialize runs: rapid pushes to main must not race on the release PR.
concurrency:
  group: release-please-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release-please:
    runs-on: Linux
    steps:
      - uses: googleapis/release-please-action@v4
        with:
          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json
      - name: Reclaim runner disk (always)
        if: always()
        shell: bash
        run: |
          set +e
          df -h . 2>/dev/null | tail -1
          rm -rf "${RUNNER_TEMP:-/tmp}"/vaultspec-* 2>/dev/null || true
          df -h . 2>/dev/null | tail -1