{#- OZI 0.1
# ozi/templates/github_workflows/release.yml
# SPDX-License-Identifier: Unlicense
#}
  release:
    needs: [draft, checkpoint]
    runs-on: ubuntu-latest
    concurrency: release
    strategy:
      matrix:
        py:
          - security2
          - security1
          - bugfix
          - prerelease
      fail-fast: true
      max-parallel: 1
    outputs:
{%- raw %}
      hashes: ${{ steps.release.outputs.hashes }}
{%- endraw %}
    permissions:
      contents: write
      id-token: write
    steps:
{%- if project.github_harden_runner %}
      - name: Harden Runner
        uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            files.pythonhosted.org:443
            fulcio.sigstore.dev:443
            github.com:443
            pypi.org:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443
            oziproject.dev:443
            www.oziproject.dev:443
            objects.githubusercontent.com:443
            quay.io:443
            cdn03.quay.io:443
            downloads.python.org:443
{%- endif %}

      - uses: OZI-Project/release@{{ spec.python.ci.release.version }}
        id: release
        with:
{%- raw %}
          python-dist: ${{ matrix.py }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          tag: ${{ needs.draft.outputs.tag }}
{%- endraw %}
