name: release

# Caller workflow for the shared release automation in OpenHands/release-actions.
# This file owns the trigger; the reusable workflow owns the logic.
on:
  push:
    branches:
      - main
      # Maintenance/freeze branches (e.g. release/0.2). The reusable workflow
      # scopes the release to whichever branch triggered this run.
      - 'release/**'

jobs:
  release-please:
    # The caller must grant the permissions the reusable workflow needs; the
    # effective token is the intersection of the two.
    permissions:
      contents: write
      pull-requests: write
    # Passes the org-level RELEASE_APP_ID / RELEASE_APP_PRIVATE_KEY through so the
    # reusable workflow can mint the GitHub App token. These are org secrets —
    # nothing to create per-repo.
    secrets: inherit
    uses: OpenHands/release-actions/.github/workflows/release-please.yml@main