From bc45e785f69d3d1753f72068126e27b05e958633 Mon Sep 17 00:00:00 2001
From: Mohammad Hossein Nemati <ckoliber@gmail.com>
Date: Sat, 22 Feb 2025 18:54:48 +0330
Subject: [PATCH] feat: add new CI

---
 .github/.releaserc.yml     |  8 +-----
 .github/renovate.json      |  5 ++++
 .github/workflows/ci.yml   | 56 ++++++++++++++++++++++++++++++++++++++
 .github/workflows/cicd.yml | 42 ----------------------------
 4 files changed, 62 insertions(+), 49 deletions(-)
 create mode 100644 .github/renovate.json
 create mode 100644 .github/workflows/ci.yml
 delete mode 100644 .github/workflows/cicd.yml

diff --git a/.github/.releaserc.yml b/.github/.releaserc.yml
index 07b949b..75d779f 100644
--- a/.github/.releaserc.yml
+++ b/.github/.releaserc.yml
@@ -1,12 +1,6 @@
-tagFormat: $${q}{version}
+tagFormat: ${version}
 branches:
     - main
-    - master
-    - +([0-9])?(.{+([0-9]),x}).x
-    - { name: next, prerelease: true }
-    - { name: beta, prerelease: true }
-    - { name: alpha, prerelease: true }
-    - { name: stable, prerelease: true }
 plugins:
     - "@semantic-release/commit-analyzer"
     - "@semantic-release/release-notes-generator"
diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 0000000..dba48e6
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,5 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": ["config:recommended"],
+    "enabledManagers": ["terraform", "github-actions"]
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c73674b
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,56 @@
+name: CI Pipeline
+
+on:
+    push:
+        tags: ["*"]
+        branches: [main]
+    pull_request:
+        branches: [main]
+    workflow_dispatch:
+        inputs: {}
+
+jobs:
+    build:
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            packages: write
+            attestations: write
+            id-token: write
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v4
+
+            - name: Setup Terraform
+              uses: hashicorp/setup-terraform@v3
+              with:
+                  terraform_version: "1.10.5"
+
+            - name: Restore cache
+              uses: actions/cache@v4
+              with:
+                  path: .terraform/
+                  key: ${{ hashFiles('.terraform.lock.hcl') }}
+
+            - run: terraform init
+            - run: terraform fmt -check
+            - run: terraform validate -no-color
+
+    release:
+        needs: build
+        runs-on: ubuntu-latest
+        if: github.ref_protected && !startsWith(github.event.head_commit.message, 'chore')
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v4
+              with:
+                  persist-credentials: false
+
+            - name: Semantic Release
+              run: cp .github/.releaserc.yml .
+            - uses: cycjimmy/semantic-release-action@v4
+              with:
+                  extra_plugins: "@semantic-release/exec"
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  GITHUB_API: ${{ github.api_url }}
diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml
deleted file mode 100644
index 688050b..0000000
--- a/.github/workflows/cicd.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: CI/CD
-
-on:
-    pull_request: { branches: ["*"] }
-    push:
-        branches:
-            - "+([0-9])?(.{+([0-9]),x}).x"
-            - master
-            - main
-            - next
-
-jobs:
-    build:
-        runs-on: ubuntu-latest
-        steps:
-            - uses: actions/checkout@v4
-            - uses: hashicorp/setup-terraform@v3
-              with:
-                  terraform_version: "1.9.5"
-            - uses: actions/cache@v4
-              with:
-                  path: .terraform/
-                  key: ${{ hashFiles('.terraform.lock.hcl') }}
-
-            - run: terraform init
-            - run: terraform fmt -check
-            - run: terraform validate -no-color
-
-    bump:
-        needs: build
-        runs-on: ubuntu-latest
-        if: github.event_name == 'push'
-        steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-node@v4
-              with:
-                  node-version: 20
-
-            - run: npm i -g semantic-release @semantic-release/changelog @semantic-release/github @semantic-release/git
-            - run: cat .github/.releaserc.yml | envsubst > .releaserc.yml && semantic-release
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}