release.yml

---
name: 'Publish to Ansible Galaxy'
on:  # yamllint disable-line rule:truthy
  push:
    branches:
      - 'main'
  workflow_dispatch: {}

permissions:
  contents: 'read'

jobs:
  release:
    name: 'Publish to Ansible Galaxy'
    runs-on: 'ubuntu-latest'
    permissions:
      contents: 'write'
      issues: 'write'
      pull-requests: 'write'
    steps:
      - name: 'Harden Runner'
        uses: 'step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6' # v2.8.1
        with:
          egress-policy: 'block'
          disable-sudo: true
          allowed-endpoints: >
            api.github.com:443
            galaxy.ansible.com:443
            github.com:443
            registry.npmjs.org:443

      - name: 'Checkout the repository'
        uses: 'actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332' # v4.1.7
        with:
          fetch-depth: 0

      - name: 'Create a semantic release'
        uses: 'cycjimmy/semantic-release-action@cb425203a562475bca039ba4dbf90c7f9ac790f4' # v4.1.0
        env:
          GH_TOKEN: '${{ secrets.RELEASE_TOKEN }}'

      - name: 'Publish to Ansible Galaxy'
        uses: 'robertdebock/galaxy-action@7d89099e09f4385ec4b53eb58c0d120f1ad806dd' # 1.2.1
        with:
          galaxy_api_key: '${{ secrets.galaxy_api_key }}'
          git_branch: 'main'
...