release.yml

name: Release

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Dry run (no tag, no release)'
        type: boolean
        default: false

# Read at the top, write only on the job that tags and publishes. A workflow
# with one job today can grow a second, and the second should not inherit the
# right to move tags because the first needed it.
permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    permissions:
      contents: write
      id-token: write
    uses: FerrLabs/.github/.github/workflows/reusable-ferrflow-release.yml@006179d85612bca62c683001b983a3bfa98ca507 # main
    with:
      dry-run: ${{ inputs.dry_run || false }}
    secrets: inherit