create-tag.yml

name: Create tag

on:
  workflow_dispatch:

env:
  DOTNET_GENERATE_ASPNET_CERTIFICATE: false
  DOTNET_NOLOGO: true
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true

permissions:
  contents: read

jobs:
  create-tag:
    if: github.actor == 'skarllot'
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
    - name: 🛡️ Harden Runner
      uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
      with:
        disable-sudo: true
        egress-policy: block
        allowed-endpoints: >
          *.azureedge.net:443
          aka.ms:443
          github.com:443
          api.nuget.org:443
          builds.dotnet.microsoft.com:443
          ci.dot.net:443
          dc.services.visualstudio.com:443

    - name: 🛒 Checkout
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0

    - name: 🧰 Setup .NET
      uses: actions/setup-dotnet@3951f0dfe7a07e2313ec93c75700083e2005cbab # v4.3.0
      with:
        global-json-file: global.json

    - name: 🛠️ Setup Nerdbank.GitVersioning
      run: dotnet tool restore

    - name: 🏷️ Tag release
      run: dotnet nbgv tag

    - name: 🚀 Push Git tags
      run: git push --tags