Release Auto-Tag #38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Release Auto-Tag | |
| on: | |
| workflow_dispatch: {} | |
| schedule: | |
| - cron: "0 14 * * 1-5" # 7 AM PDT, weekdays only | |
| permissions: | |
| contents: write | |
| actions: write | |
| concurrency: | |
| group: release-auto-tag | |
| cancel-in-progress: false | |
| jobs: | |
| create-tag: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Determine next patch version | |
| id: version | |
| run: | | |
| latest=$(git tag -l 'v*.*.*' --sort=-v:refname | head -1) | |
| if [ -z "$latest" ]; then | |
| echo "No existing tags — seeding from v0.0.0" | |
| latest="v0.0.0" | |
| fi | |
| echo "Latest tag: $latest" | |
| # Skip if no new commits since the latest tag (unless seeding) | |
| if git rev-parse "$latest" >/dev/null 2>&1; then | |
| commit_count=$(git rev-list "${latest}..HEAD" --count) | |
| else | |
| commit_count=$(git rev-list HEAD --count) | |
| fi | |
| echo "Commits since $latest: $commit_count" | |
| if [ "$commit_count" -eq 0 ]; then | |
| echo "No new commits since $latest — skipping tag creation" | |
| echo "skip=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| major=$(echo "$latest" | sed 's/^v//' | cut -d. -f1) | |
| minor=$(echo "$latest" | sed 's/^v//' | cut -d. -f2) | |
| patch=$(echo "$latest" | sed 's/^v//' | cut -d. -f3) | |
| next="v${major}.${minor}.$((patch + 1))" | |
| if git tag -l "$next" | grep -q .; then | |
| echo "::error::Tag $next already exists" | |
| exit 1 | |
| fi | |
| echo "next=$next" >> "$GITHUB_OUTPUT" | |
| echo "Next tag: $next" | |
| - name: Create signed tag via GitHub API | |
| if: steps.version.outputs.skip != 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAG: ${{ steps.version.outputs.next }} | |
| run: | | |
| SHA=$(git rev-parse HEAD) | |
| # Create annotated tag object (GitHub signs it with the token identity) | |
| gh api "repos/${{ github.repository }}/git/tags" \ | |
| -f tag="$TAG" \ | |
| -f message="Release $TAG" \ | |
| -f object="$SHA" \ | |
| -f type=commit | |
| # Create the ref pointing to the tag object | |
| gh api "repos/${{ github.repository }}/git/refs" \ | |
| -f ref="refs/tags/$TAG" \ | |
| -f sha="$SHA" | |
| echo "Created verified tag $TAG at $SHA" | |
| - name: Trigger Release Tag workflow | |
| if: steps.version.outputs.skip != 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAG: ${{ steps.version.outputs.next }} | |
| run: | | |
| gh workflow run release-tag.yml \ | |
| --ref main \ | |
| -f tag="$TAG" |