feat: seed remaining empty frameworks onto the Security Map #65

	name: Publish Release

	on:
	pull_request:
	types: [closed]

	permissions: {}

	jobs:
	publish:
	if: >
	github.event.pull_request.merged == true &&
	github.event.pull_request.base.ref == 'main' &&
	startsWith(github.event.pull_request.head.ref, 'release/') &&
	contains(github.event.pull_request.labels.*.name, 'release')
	runs-on: ubuntu-latest
	permissions:
	contents: write
	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	ref: main
	fetch-depth: 0
	persist-credentials: false

	- name: Read version
	id: version
	run: \|
	set -euo pipefail
	tag="$(head -n1 VERSION \| tr -d '[:space:]')"
	if ! printf '%s' "$tag" \| grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
	echo "::error::Invalid VERSION content '$tag' (expected vMAJOR.MINOR.PATCH)"
	exit 1
	fi
	echo "tag=$tag" >> "$GITHUB_OUTPUT"

	- name: Extract latest changelog section
	run: \|
	awk '/^## /{ if (found) exit; found=1; next } found' CHANGELOG.md > RELEASE_NOTES.md
	cat RELEASE_NOTES.md

	- name: Create tag
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	TAG: ${{ steps.version.outputs.tag }}
	run: \|
	set -euo pipefail
	sha="$(git rev-parse HEAD)"
	gh api "repos/${GITHUB_REPOSITORY}/git/refs" \
	-f "ref=refs/tags/${TAG}" \
	-f "sha=${sha}"

	- name: Create GitHub Release
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	TAG: ${{ steps.version.outputs.tag }}
	run: \|
	set -euo pipefail
	gh release create "$TAG" \
	--title "$TAG" \
	--notes-file RELEASE_NOTES.md

Navigation Menu