release.yml

name: Release
on:
  workflow_dispatch:
    inputs:
      update_type:
        description: Update type
        required: true
        type: choice
        options:
          - patch
          - minor
          - major

permissions: read-all

jobs:
  initiate:
    name: Initiate
    runs-on: ubuntu-24.04
    permissions:
      contents: write # To push a commit
      pull-requests: write # To open a Pull Request
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            github.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
      - name: Checkout repository
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
      - name: Install Node.js
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Install dependencies
        run: npm clean-install
      - name: Create automation token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
        id: automation-token
        with:
          app_id: ${{ secrets.AUTOMATION_APP_ID }}
          private_key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
      - name: Bump version
        env:
          UPDATE_TYPE: ${{ github.event.inputs.update_type }}
        run: npm version "$UPDATE_TYPE" --no-git-tag-version
      - name: Update CHANGELOG
        run: node scripts/bump-changelog.js
      - name: Create Pull Request
        uses: peter-evans/create-pull-request@4320041ed380b20e97d388d56a7fb4f9b8c20e79 # v7.0.0
        with:
          token: ${{ steps.automation-token.outputs.token }}
          title: New ${{ github.event.inputs.update_type }} release
          body: |
            _This Pull Request was created automatically_

            ---

            ### Merge checklist

            - [ ] All continuous integration checks passed.
            - [ ] The version number is consistently updated in `package.json` and `package-lock.json`.
            - [ ] A new release is added to `CHANGELOG.md` with the correct version number and date.
            - [ ] The new version number is in accordance with [Semantic Versioning].
            - [ ] There are no unexpected changes in the Pull Request.

            ---

            ### Post-merge checklist

            - [ ] The new version is published to [npm].
            - [ ] The `v3` branch is at the merge commit.
            - [ ] There is a git tag for the new version on the merge commit.

            [npm]: https://www.npmjs.com/package/@ericcornelissen/eslint-plugin-top
            [semantic versioning]: https://semver.org/spec/v2.0.0.html
          branch: release-${{ github.event.inputs.update_type }}
          branch-suffix: random
          commit-message: Version bump