👷 ci: Adds auto-labels for PR and changelog releaser (#8)

Author: bendoerr

.github/changelog.json

@@ -0,0 +1,25 @@
+{
+  "categories": [
+    {
+      "title": "## ✨ Features",
+      "labels": ["enhancement"]
+    },
+    {
+      "title": "## 🐛 Fixes",
+      "labels": ["bug"]
+    },
+    {
+      "title": "## 🎨 Cleanup",
+      "labels": ["cleanup"]
+    },
+    {
+      "title": "## 👷 CI/CD",
+      "labels": ["cicd"]
+    },
+    {
+      "title": "## 📌 Dependencies",
+      "labels": ["dependencies"]
+    }
+  ],
+  "template": "${{CHANGELOG}}\n\n## Contributors:\n${{CONTRIBUTORS}}"
+}

.github/labeler.yml

@@ -0,0 +1,11 @@
+enhancement:
+  - head-branch: ["^feature", "feature", "^new", "new"]
+
+bug:
+  - head-branch: ["^fix", "fix", "^bug", "bug"]
+
+cicd:
+  - head-branch: ["^ci", "ci", "^cicd", "cicd"]
+
+documentation:
+  - head-branch: ["^docs", "docs"]

.github/workflows/dependency-review.yml

@@ -15,6 +15,9 @@ permissions:
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
@@ -25,3 +28,5 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: "Dependency Review"
         uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
+        with:
+          comment-summary-in-pr: always

.github/workflows/pr-label.yml

@@ -0,0 +1,22 @@
+name: Label Pull Request
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 #v5.0.0

.github/workflows/release.yml

@@ -0,0 +1,37 @@
+name: Publish release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+      pull-requests: write
+      deployments: write
+
+    steps:
+      - uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+      - uses: mikepenz/release-changelog-builder-action@f3fc77b47b74e78971fffecb2102ae6eac9a44d6 # v5
+        id: build_changelog
+        with:
+          configuration: .github/changelog.json
+          failOnError: "true"
+          fetchReviewers: "true"
+
+      - uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
+        if: startsWith(github.ref, 'refs/tags/')
+        with:
+          body: ${{steps.build_changelog.outputs.changelog}}