name: release-plz
on:
  push:
    branches:
    - main
concurrency:
  group: "${{ github.workflow }}"
  cancel-in-progress: true
permissions:
  contents: read

jobs:
  release-plz:
    name: release-plz
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: write
      id-token: write
    steps:
    - name: harden runner
      uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
      with:
        egress-policy: audit
    - name: generate cultivator token
      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
      id: generate-token
      with:
        app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
        private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
        # Scope to what release-plz needs: push the release branch and create
        # tags/releases (contents), open/update the release PR (pull-requests).
        permission-contents: write
        permission-pull-requests: write
    - name: checkout repository
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        submodules: recursive
        fetch-depth: 0
        token: "${{ steps.generate-token.outputs.token }}"
    - name: install stable rust toolchain
      run: |
        rustup update --no-self-update stable
        rustup default stable
    - name: install linux dependencies
      run: ./hack/ci/install-linux-deps.sh
    - name: release-plz
      uses: release-plz/action@f36720ba01927d9927fba665fcdf802e12bc264b # v0.5.147
      env:
        GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}"