name: release-please

on:
  push:
    branches: [main]

permissions:
  contents: write
  pull-requests: write

jobs:
  release-please:
    runs-on: ubuntu-latest
    steps:
      - uses: googleapis/release-please-action@v4
        with:
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json
          # Full auto-release. GITHUB_TOKEN-created PRs/tags do NOT trigger other
          # workflows (GitHub recursion guard), so with the default token the
          # release PR gets no CI (required checks never run → needs admin-merge)
          # and the tag never fires release.yml's `push: tags` image build (needs a
          # manual workflow_dispatch). A non-GITHUB_TOKEN actor fixes BOTH: the PR
          # runs CI → auto-mergeable, and its tag triggers release.yml.
          #
          # OPERATOR STEP to activate: add repo secret RELEASE_PLEASE_TOKEN — a
          # fine-grained PAT or GitHub App token with contents:write +
          # pull-requests:write + actions:write on this repo. Until it is set, this
          # falls back to GITHUB_TOKEN = today's behavior (no regression).
          #
          # NOTE: promote-stable (rollout to live relays) stays a DELIBERATE manual
          # gate for DPI-canary safety — it is intentionally NOT automated here.
          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
