update-action-tag.yml

name: Update Tag

on:
  workflow_dispatch:

jobs:
  update-tag:
    name: Update Tag
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: write
      id-token: write

    steps:
      - uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}
          # Needed to push the tag in the final step
          persist-credentials: true

      - name: Setup
        uses: ./setup
        with:
          aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
          aws_region_name: ${{ vars.AWS_REGION_NAME }}
          aws_secret_id: ${{ secrets.AWS_SECRET_ID }}

      - name: Remove the existing tag
        run: |
          export VERSION=$(cat .github/workflows/version.txt)
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          git push origin ":v${VERSION}" || true

      - name: Create a new signed tag
        uses: ./git-sign
        with:
          command: git tag -a \"v${{ env.VERSION }}\" -m \"Update tag\" -s --local-user=${{ env.GPG_KEY_ID }}

      - name: Push the tag
        run:
            git push origin --tags