name: Release a new version
on:
  push:
    branches:
      - stable
      
permissions:
  id-token: write  # Required for OIDC
  contents: read
  
jobs:
  release:
    name: Release
    if: |
      !(github.event_name == 'push' && contains(github.event.head_commit.message, '[skip ci]')) &&
      !(github.event_name == 'pull_request' && contains(join(github.event.pull_request.title, github.event.pull_request.body), '[skip ci]'))
    runs-on: ubuntu-latest
    permissions:
      contents: write # to be able to publish a GitHub release
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@v4
        with:
          git_user_signingkey: true
          git_commit_gpgsign: true
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}

      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: npm ci

      - name: Semantic release
        run: npm run release
        env:
          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}

          GIT_AUTHOR_NAME: ${{ secrets.GIT_USERNAME }}
          GIT_AUTHOR_EMAIL: ${{ secrets.GIT_EMAIL }}
          GIT_COMMITTER_NAME: ${{ secrets.GIT_USERNAME }}
          GIT_COMMITTER_EMAIL: ${{ secrets.GIT_EMAIL }}

          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}

      - name: Trigger Renovate
        uses: AlexanderBabel/action-renovate-checkbox@v1
        with:
          master-issue-id: 16
          repo: kubernetes-config
          token: ${{ secrets.GH_TOKEN }}