release-publish.yaml

---
name: "Release Publish"
# Building block: publishes a draft release created by release-draft.yaml.
# Used by the release variant workflows and callable directly for custom
# compositions. Call this after all build jobs that attach assets to the
# draft release have completed, so repositories with immutable releases
# enabled get a complete release at publish time.
on:
  workflow_call:
    inputs:
      release-id:
        description: "ID of the draft release to publish, from release-draft.yaml"
        required: true
        type: string
    secrets:
      github-token:
        required: true
    outputs:
      published:
        description: "'true' when the draft release was published"
        value: ${{ jobs.publish_release.outputs.published }}

permissions: {}

jobs:
  publish_release:
    runs-on: ubuntu-latest
    permissions:
      contents: write # Publish draft release
    outputs:
      published: ${{ steps.publish.outputs.published }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
        with:
          egress-policy: audit

      - name: Publish draft release
        id: publish
        env:
          RELEASE_ID: ${{ inputs.release-id }}
          GH_TOKEN: ${{ secrets.github-token }}
        run: |
          if ! [[ "$RELEASE_ID" =~ ^[0-9]+$ ]]; then
            echo "::error::release-id must be numeric, got: ${RELEASE_ID}"
            exit 1
          fi
          gh api \
            --method PATCH \
            "/repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
            -F draft=false
          echo "published=true" >> "$GITHUB_OUTPUT"