release.yml

name: Release
on:
  push:
    branches: [main]
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions: {}
jobs:
  release:
    # no more than app-release's own jobs ask for; the workflow-level
    # `permissions: {}` above grants nothing to inherit.
    permissions:
      contents: write
      issues: write
      packages: write
      pull-requests: write
    # `@v1` moves on purpose: one fix reaches every project, and that same
    # channel outlives the engagement (ADR-0005).
    uses: ttncode/.github/.github/workflows/app-release.yml@v1 # zizmor: ignore[unpinned-uses,ref-confusion]
    # With these, release please opens its pull request as a GitHub app and the
    # checks on it run; without them it falls back to GITHUB_TOKEN, whose checks
    # sit at "Action required" and expire red. Named rather than `inherit`, so
    # the called workflow reads only the two it declared.
    secrets:
      RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
    with:
      # {image, context, dockerfile} per application, written by scaffold as
      # each is generated (ADR-0022). Empty means nothing to publish.
      images: "[{\"image\":\"ghcr.io/ttncode/openmedia-web\",\"context\":\"apps/web\",\"dockerfile\":\"apps/web/Dockerfile\"},{\"image\":\"ghcr.io/ttncode/openmedia-api\",\"context\":\"apps/api\",\"dockerfile\":\"apps/api/Dockerfile\"}]"