New workflows

.github/workflows/release.yml

@@ -1,8 +1,13 @@
 name: Package and release
+
 on:
   push:
     tags:
       - '**'
+  workflow_dispatch: # so we can trigger it from another workflow
+
+permissions:
+  contents: write # required to create a release
 
 jobs:
   release:
@@ -16,8 +21,20 @@ jobs:
 
       - name: Package and release
         uses: BigWigsMods/packager@v2
-    env:
-      CF_API_KEY: ${{ secrets.CF_API_KEY }}
-      WOWI_API_TOKEN: ${{ secrets.WOWI_API_TOKEN }}
-      GITHUB_OAUTH: ${{ secrets.GITHUB_TOKEN }}
-      WAGO_API_TOKEN: ${{ secrets.WAGO_API_TOKEN }}
+        if: github.ref_type == 'tag' # ensure no rogue triggers
+        env:
+          CF_API_KEY: ${{ secrets.CF_API_KEY }}
+          WOWI_API_TOKEN: ${{ secrets.WOWI_API_TOKEN }}
+          GITHUB_OAUTH: ${{ secrets.GITHUB_TOKEN }}
+          WAGO_API_TOKEN: ${{ secrets.WAGO_API_TOKEN }}
+
+      - name: Notify on failures
+        # when triggered by another workflow we won't get notifications from failures, this is a workaround
+        if: ${{ failure() }}
+        uses: appleboy/[email protected]
+        with:
+          webhook_id: ${{ secrets.DISCORD_WEBHOOK_ID }}
+          webhook_token: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}
+          message: |
+            Workflow "${{ github.workflow }}" failed during job "${{ github.job }}"
+            <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}>

.github/workflows/tag.yml

@@ -0,0 +1,49 @@
+name: Tag
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - CHANGELOG.md
+
+permissions:
+  contents: write # needed to run `git push`
+  actions: write # needed to trigger other workloads
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone project
+        uses: actions/checkout@v4
+
+      - name: Get latest version from changelog header
+        run: |
+          echo "tag=$(grep -oPm 1 '(?<=### Changes in )(.*)(?=:)' CHANGELOG.md)" >> "$GITHUB_OUTPUT"
+        id: changelog
+
+      - name: Bail if tag exists
+        run: |
+          ! git show-ref -q --tags "${{ steps.changelog.outputs.tag }}" || {
+            echo "Tag ${{ steps.changelog.outputs.tag }} already exists"
+            exit 1
+          }
+
+      - name: Setup Git
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
+
+      - name: Tag and push
+        run: |
+          git tag -a -m "Tag ${{ steps.changelog.outputs.tag }}" ${{ steps.changelog.outputs.tag }}
+          git push origin ${{ steps.changelog.outputs.tag }}
+
+      - name: Trigger release workflow
+        # workflows won't trigger when other workflows do git actions, so we need to do this
+        # https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication
+        run: |
+          gh workflow run release.yml --ref ${{ steps.changelog.outputs.tag }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}