name: release-on-publish

# Listens for a published GitHub Release and starts release.yml via
# workflow_dispatch. GitHub documents that workflow_dispatch always creates a
# new run (even when triggered by GITHUB_TOKEN), unlike some release:published
# deliveries that never started release.yml in this repo (see repo events API
# 2026-08-14T16:44:21Z vs Actions run list).

on:
  release:
    types: [published]

permissions:
  actions: write
  contents: read

jobs:
  dispatch:
    runs-on: ubuntu-latest
    steps:
      - name: Derive SemVer from release tag
        id: version
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          set -euo pipefail
          raw="${RELEASE_TAG#v}"
          if ! [[ "$raw" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::release tag is not SemVer vX.Y.Z (${RELEASE_TAG})"
            exit 1
          fi
          #region agent log
          echo "::group::agent-log release-on-publish"
          echo "release_tag=${RELEASE_TAG} version=${raw} release_id=${{ github.event.release.id }} draft=${{ github.event.release.draft }}"
          echo "::endgroup::"
          #endregion
          echo "version=${raw}" >> "$GITHUB_OUTPUT"

      - name: Start release workflow
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh workflow run release.yml \
            --repo "${{ github.repository }}" \
            --ref main \
            -f "version=${{ steps.version.outputs.version }}"