release_workflow.yml

name: Build and Publish Release
run-name: Build and publish release${{ github.event.inputs.github_release == 'true' &&  ' - Stage Release' || ''}}
on:
  # only manual trigger
  workflow_dispatch:
    inputs:
      continue-on-error:
        description: Continue release if pre-checks fail
        type: boolean
        required: false
        default: false
      github_release:
        description: Stage github release
        type: boolean
        required: false
        default: false
jobs:
  security:
    permissions:
      # needed to write security info to repository
      security-events: write
      contents: read
    uses: ./.github/workflows/security_checks.yml
    with:
      continue-on-error: ${{ github.event.inputs.continue-on-error == 'true' }}
  build:
    uses: ./.github/workflows/release_build.yml
  unit-test:
    uses: ./.github/workflows/tox.yml
    with:
      continue-on-error: ${{ github.event.inputs.continue-on-error == 'true' }}
  azdev_linter:
    needs: [build]
    uses: ./.github/workflows/azdev_linter.yml
    with:
      continue-on-error: ${{ github.event.inputs.continue-on-error == 'true' }}
  int_test:
    needs: [build]
    uses: ./.github/workflows/trigger_ado_int_tests.yml
    secrets: inherit
  approval:
    needs: [security, build, unit-test, azdev_linter]
    # only needed if (release || wheel) - conditionals allow previous jobs to be skipped and still run
    if:  always() && !cancelled() && !failure() && (github.event.inputs.github_release == 'true')
    environment: production
    runs-on: ubuntu-latest
    steps:
      - name: Confirm
        run: |
          echo "Approved" >> $GITHUB_STEP_SUMMARY
          if [ "${{ inputs.github_release }}" == "true" ]; then
            echo "Github release will be drafted." >> $GITHUB_STEP_SUMMARY
          fi
  # github_release == 'true'
  draft_github_release:
    permissions:
      # needed to create draft release
      contents: write
    needs: [approval]
    if:  always() && !cancelled() && !failure() && github.event.inputs.github_release == 'true'
    uses: ./.github/workflows/stage_release.yml
    secrets: inherit