apply-release-notes.yml

# Cheap apply of curated notes onto a GitHub Release.
# Reads branch release-note-<semver> or vars RELEASE_NOTES +
# RELEASE_NOTES_TAG. Deletes the notes branch after a successful
# apply. Does not compile and does not start vsce/ovsx.
name: Apply release notes

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. patchloom-v0.7.0)"
        required: true
        type: string

concurrency:
  group: apply-release-notes-${{ inputs.tag }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  apply:
    name: Apply notes
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      GH_REPO: ${{ github.repository }}
      TAG: ${{ inputs.tag }}
      RELEASE_NOTES: ${{ vars.RELEASE_NOTES }}
      RELEASE_NOTES_TAG: ${{ vars.RELEASE_NOTES_TAG }}
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
        with:
          egress-policy: audit
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Apply curated notes
        run: bash scripts/apply-release-notes.sh