Update CD workflows: support manual trigger and output sharing for release announcements on Mastodon

.github/workflows/cd-mastodon.yml

@@ -1,8 +1,24 @@
 name: Announce Release on Mastodon
 
 on:
+  # Fires for releases published by a human through the GitHub UI. Releases created by `scripts/release.sh`
+  # do NOT reach here: GitHub suppresses events triggered with the default GITHUB_TOKEN to prevent
+  # workflows from recursively triggering each other, so cd.yml calls this workflow directly instead.
   release:
     types: [ published ]
+  workflow_call:
+    inputs:
+      tag:
+        description: 'Release tag to announce (defaults to the latest release)'
+        required: false
+        type: string
+      dry_run:
+        description: 'Print the post without sending it'
+        type: boolean
+        default: false
+    secrets:
+      MASTODON_ACCESS_TOKEN:
+        required: false
   workflow_dispatch:
     inputs:
       tag:

.github/workflows/cd.yml

@@ -13,6 +13,9 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    outputs:
+      released: ${{ steps.release.outputs.released }}
+      tag: ${{ steps.release.outputs.tag }}
     steps:
       - name: Checkout repo
         uses: actions/checkout@master
@@ -25,6 +28,7 @@ jobs:
           node-version: '22'
 
       - name: Tag and release
+        id: release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -32,3 +36,17 @@ jobs:
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
           ./scripts/release.sh
+
+  # Called directly rather than left to the `release: published` event, which GitHub does not emit for
+  # releases created with the default GITHUB_TOKEN. Gated on `released` so a re-run that finds the tag
+  # already present does not announce the same version twice.
+  announce:
+    name: Announce
+    needs: release
+    if: needs.release.outputs.released == 'true'
+    uses: ./.github/workflows/cd-mastodon.yml
+    with:
+      tag: ${{ needs.release.outputs.tag }}
+      dry_run: false
+    secrets:
+      MASTODON_ACCESS_TOKEN: ${{ secrets.MASTODON_ACCESS_TOKEN }}

scripts/release.sh

@@ -9,6 +9,16 @@ cd "$(dirname "$0")"/..
 
 tag=$(node -p "require('./package.json').version")
 
+# Report back to the calling workflow (.github/workflows/cd.yml) so the announce job only runs when a
+# release was actually created. GITHUB_OUTPUT is unset when this script is run locally, hence the guard.
+set_output() {
+  if [ -n "${GITHUB_OUTPUT:-}" ]; then
+    echo "$1" >> "$GITHUB_OUTPUT"
+  fi
+}
+
+set_output "tag=$tag"
+
 tagged=$(git tag -l $tag)
 if [ -z "$tagged" ]; then
   git tag -a "$tag" -m "Release $tag"
@@ -46,9 +56,11 @@ if [ -z "$tagged" ]; then
     echo "Created release (no CHANGELOG.md entry found for $tag, used --generate-notes)"
   fi
   rm -f "$notes_file"
+  set_output "released=true"
 
 # Release to ...
 
 else
   echo "Tag $tag already exists"
+  set_output "released=false"
 fi