name: tag

on:
  release:
    types: [published]

permissions: read-all

jobs:
  tag:
    name: Tag capa rules
    runs-on: ubuntu-latest
    steps:
    - name: Checkout capa-rules
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        repository: mandiant/capa-rules
        token: ${{ secrets.CAPA_TOKEN }}
    - name: Tag capa-rules
      run: |
        # user information is needed to create annotated tags (with a message)
        git config user.email 'capa-dev@mandiant.com'
        git config user.name 'Capa Bot'
        name=${{ github.event.release.tag_name }}
        git tag $name -m "https://github.com/mandiant/capa/releases/$name"
        # TODO update branch name-major=${name%%.*}
    - name: Push tag to capa-rules
      uses: ad-m/github-push-action@d91a481090679876dfc4178fef17f286781251df # v0.8.0
      with:
        repository: mandiant/capa-rules
        github_token: ${{ secrets.CAPA_TOKEN }}
        tags: true
