release.yml

name: Release
on:
  workflow_call:
    inputs:
      environment:
        description: "Release to environment"
        default: next
        required: false
        type: string

jobs:
  release:
    name: Semver Release
    runs-on: ubuntu-latest
    concurrency: release
    environment: ${{ inputs.environment }}
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@v1
        with:
          app_id: ${{ secrets.APP_ID }}
          private_key: ${{ secrets.PRIVATE_KEY }}

      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ steps.generate_token.outputs.token }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "lts/*"

      - name: Install dependencies
        run: npm ci

      - name: Verify signatures for installed dependencies
        run: npm audit signatures

      - name: Semantic Release
        uses: codfish/semantic-release-action@v2
        id: semantic
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
          GH_TOKEN: ${{ steps.generate_token.outputs.token }}