ci: improve release workflow

.github/workflows/autotag.yml

@@ -0,0 +1,31 @@
+name: autotag
+#
+# Create a git tag based on the Cargo workflow packages version if one does not already exist
+# The tag will trigger the release process (as it is triggered via tagging)
+#
+on:
+  push:
+    branches: [main]
+jobs:
+  create_tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Create tag if changed
+        if: github.repository_owner == 'thin-edge'
+        run: |
+          VERISON=$(yq '.workspace.package.version' Cargo.toml)
+          if [ -z "$VERISON" ]; then
+            echo "Could not detect workspace package version (.workspace.package.version) from Cargo.toml"
+            exit 1
+          fi
+          if [ -n $(git tag -l "$VERSION") ]; then
+            echo "Skipping as tag already exists"
+            exit 0
+          fi
+          echo "Creating tag: $VERSION"
+          git tag -a "$VERSION" -m "Release $VERSION"
+          git push origin "$VERSION"

.github/workflows/build-workflow.yml

@@ -325,3 +325,23 @@ jobs:
         run: |
           just publish-linux-virtual --repo tedge-main
           just publish-linux-virtual --repo tedge-main-armv6
+
+  release:
+    runs-on: ubuntu-latest
+    needs: [publish-virtual-packages, publish-containers]
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - name: Release
+        uses: softprops/action-gh-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          generate_release_notes: true
+          draft: true
+
+      - name: Create tedge-docs snapshot
+        run: |
+          gh workflow run snapshot.yml -R thin-edge/tedge-docs -f version=${{github.ref_name}}
+        env:
+          # Triggering another workflow requires more additional credentials
+          GITHUB_TOKEN: ${{ secrets.ACTIONS_PAT }}

.github/workflows/hosted-post-merge_version_update.yml

@@ -23,10 +23,15 @@ env:
 jobs:
   versioning:
     runs-on: ubuntu-20.04
+    permissions:
+      contents: write
+      pull-requests: write
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - run: |
           git config --global user.email "[email protected]"
           git config --global user.name "Versioneer"
@@ -57,4 +62,4 @@ jobs:
           delete-branch: true
           title: ${{ inputs.bump }} version bump
           body: ${{ inputs.bump }} version bump
-          reviewers: rina23q
+          token: ${{ secrets.ACTIONS_PAT }}