.cspell.json

@@ -5,7 +5,7 @@
   "dictionaryDefinitions": [
     {
       "name": "organization-dictionary",
-      "path": "./.github/.cspell/organization-dictionary.txt",
+      "path": "https://raw.githubusercontent.com/taiki-e/github-actions/HEAD/.github/.cspell/organization-dictionary.txt",
       "addWords": true
     },
     {
@@ -26,23 +26,26 @@
   ],
   "ignoreRegExpList": [
     // Copyright notice
-    "Copyright ((\\(c\\)|\\(C\\)|©) )?.*",
+    "Copyright .*",
+    "SPDX-(File|Snippet)CopyrightText: .*",
     // GHA actions/workflows
-    "uses: .+@",
+    "uses: .+@[\\w_.-]+",
     // GHA context (repo name, owner name, etc.)
-    "github.\\w+ (=|!)= '.+'",
+    "github.[\\w_.-]+ (=|!)= '[^']+'",
     // GH username
     "( |\\[)@[\\w_-]+",
     // Git config username
-    "git config user.name .*",
+    "git config( --[^ ]+)? user.name .*",
+    // Username in TODO|FIXME comment
+    "(TODO|FIXME)\\([\\w_., -]+\\)",
     // Cargo.toml authors
-    "authors *= *\\[.*\\]",
-    "\".* <[\\w_.+-]+@[\\w.-]+>\""
+    "authors *= *\\[[^\\]]*\\]",
+    "\"[^\"]* <[\\w_.+-]+@[\\w.-]+>\""
   ],
   "languageSettings": [
     {
       "languageId": ["*"],
-      "dictionaries": ["rust"]
+      "dictionaries": ["bash", "cpp-refined", "rust"]
     }
   ],
   "ignorePaths": []

.editorconfig

@@ -11,12 +11,14 @@ indent_style = space
 insert_final_newline = true
 trim_trailing_whitespace = true
 
-[*.{json,md,yml}]
+[*.{css,html,json,md,rb,sh,yml,yaml}]
 indent_size = 2
 
-[*.{js,yml}]
+[*.{js,yml,yaml}]
 quote_type = single
 
 [*.sh]
+# https://google.github.io/styleguide/shellguide.html#s5.3-pipelines
 binary_next_line = true
+# https://google.github.io/styleguide/shellguide.html#s5.5-case-statement
 switch_case_indent = true

.git-blame-ignore-revs

@@ -0,0 +1,2 @@
+# Change indent size of shell script files to match scripts in CI config
+13b0ad97d118e7f8ae400f2959fe2586b9e0730c

.gitattributes

@@ -1 +1,3 @@
 * text=auto eol=lf
+tools/tidy.sh linguist-detectable=false
+.github/.cspell/rust-dependencies.txt linguist-generated

.github/.cspell/project-dictionary.txt

@@ -1,3 +1 @@
 coreutils
-gtar
-toolchains

.github/workflows/ci.yml

@@ -10,13 +10,22 @@ on:
       - main
       - dev
   schedule:
-    - cron: '0 1 * * *'
+    - cron: '0 0 * * *'
   workflow_dispatch:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -CeEuxo pipefail {0}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
 
 jobs:
   tidy:
-    uses: taiki-e/workflows/.github/workflows/tidy-no-rust.yml@main
+    uses: taiki-e/github-actions/.github/workflows/tidy.yml@main
+    permissions:
+      contents: read
+      pull-requests: write # for gh pr edit --add-assignee
+      repository-projects: read # for gh pr edit --add-assignee
+    secrets: inherit

.github/workflows/release.yml

@@ -1,8 +1,7 @@
 name: Release
 
 permissions:
-  # TODO: once `releases: write` is supported, use it instead.
-  contents: write
+  contents: read
 
 on:
   push:
@@ -11,16 +10,18 @@ on:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -CeEuxo pipefail {0}
 
 jobs:
   create-release:
     if: github.repository_owner == 'taiki-e'
     runs-on: ubuntu-latest
+    timeout-minutes: 60
+    environment: release
+    permissions:
+      contents: write # for taiki-e/create-gh-release-action
     steps:
-      - uses: actions/checkout@v3
-        with:
-          persist-credentials: false
+      - uses: taiki-e/checkout-action@v1
       - uses: taiki-e/create-gh-release-action@v1
         with:
           changelog: CHANGELOG.md

.markdownlint-cli2.yaml

@@ -0,0 +1,11 @@
+# https://github.com/DavidAnson/markdownlint/blob/HEAD/doc/Rules.md
+config:
+  line-length: false # MD013
+  no-duplicate-heading: false # MD024
+  no-blanks-blockquote: false # MD028 (this warns valid GFM alerts usage)
+  no-inline-html: false # MD033
+  no-emphasis-as-heading: false # MD036
+
+# https://github.com/DavidAnson/markdownlint-cli2#markdownlint-cli2jsonc
+noBanner: true
+noProgress: true

.shellcheckrc

@@ -2,13 +2,34 @@
 # https://github.com/koalaman/shellcheck/blob/HEAD/shellcheck.1.md#rc-files
 
 # See also:
-# https://www.shellcheck.net/wiki/Optional
+# https://github.com/koalaman/shellcheck/wiki/Optional
 # https://google.github.io/styleguide/shellguide.html
 
-# https://www.shellcheck.net/wiki/SC2292
+# https://github.com/koalaman/shellcheck/wiki/SC2249
+# enable=add-default-case
+
+# https://github.com/koalaman/shellcheck/wiki/SC2244
+enable=avoid-nullary-conditions
+
+# https://github.com/koalaman/shellcheck/wiki/SC2312
+# enable=check-extra-masked-returns
+
+# https://github.com/koalaman/shellcheck/wiki/SC2310
+# https://github.com/koalaman/shellcheck/wiki/SC2311
+# enable=check-set-e-suppressed
+
+# enable=check-unassigned-uppercase
+
+# https://github.com/koalaman/shellcheck/wiki/SC2230
+enable=deprecate-which
+
+# https://github.com/koalaman/shellcheck/wiki/SC2248
+enable=quote-safe-variables
+
+# https://github.com/koalaman/shellcheck/wiki/SC2292
 # https://google.github.io/styleguide/shellguide.html#s6.3-tests
 enable=require-double-brackets
 
-# https://www.shellcheck.net/wiki/SC2250
+# https://github.com/koalaman/shellcheck/wiki/SC2250
 # https://google.github.io/styleguide/shellguide.html#s5.6-variable-expansion
 enable=require-variable-braces

CHANGELOG.md

@@ -10,6 +10,56 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+- Update `parse-changelog` to 0.6.12.
+
+## [1.9.1] - 2025-03-29
+
+- Increase version for workaround Dependabot issue.
+
+## [1.8.4] - 2025-01-20
+
+- Update `parse-changelog` to 0.6.11.
+
+## [1.8.3] - 2025-01-10
+
+- Update `parse-changelog` to 0.6.10. This includes performance improvements.
+
+## [1.8.2] - 2024-04-19
+
+- Update `parse-changelog` to 0.6.7. This includes diagnostics improvements.
+
+## [1.8.1] - 2024-04-13
+
+- Update `parse-changelog` to 0.6.6.
+
+## [1.8.0] - 2023-10-05
+
+- Fix performance degradation introduced in 1.7.2.
+
+- Update `parse-changelog` to 0.6.3.
+
+- Verify checksum of downloaded `parse-changelog` tarball.
+
+- Support AArch64 host.
+
+## [1.7.2] - 2023-09-09
+
+- Improve robustness for temporary network failures.
+
+## [1.7.1] - 2023-08-06
+
+- Update `parse-changelog` to 0.6.2.
+
+## [1.7.0] - 2023-03-22
+
+- Add `allow-missing-changelog` input option to allow create the release even if the changelog entry corresponding to the version is missing. ([#23](https://github.com/taiki-e/create-gh-release-action/pull/23), thanks @lmajano)
+
+- Switch to composite action. ([#24](https://github.com/taiki-e/create-gh-release-action/pull/24))
+
+## [1.6.3] - 2023-03-19
+
+- Diagnostics improvements.
+
 ## [1.6.2] - 2022-12-24
 
 - Support self-hosted runner that does not set `GITHUB_OUTPUT` environment variable. ([#17](https://github.com/taiki-e/create-gh-release-action/pull/17))
@@ -80,7 +130,17 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/create-gh-release-action/compare/v1.6.2...HEAD
+[Unreleased]: https://github.com/taiki-e/create-gh-release-action/compare/v1.9.1...HEAD
+[1.9.1]: https://github.com/taiki-e/create-gh-release-action/compare/v1.8.4...v1.9.1
+[1.8.4]: https://github.com/taiki-e/create-gh-release-action/compare/v1.8.3...v1.8.4
+[1.8.3]: https://github.com/taiki-e/create-gh-release-action/compare/v1.8.2...v1.8.3
+[1.8.2]: https://github.com/taiki-e/create-gh-release-action/compare/v1.8.1...v1.8.2
+[1.8.1]: https://github.com/taiki-e/create-gh-release-action/compare/v1.8.0...v1.8.1
+[1.8.0]: https://github.com/taiki-e/create-gh-release-action/compare/v1.7.2...v1.8.0
+[1.7.2]: https://github.com/taiki-e/create-gh-release-action/compare/v1.7.1...v1.7.2
+[1.7.1]: https://github.com/taiki-e/create-gh-release-action/compare/v1.7.0...v1.7.1
+[1.7.0]: https://github.com/taiki-e/create-gh-release-action/compare/v1.6.3...v1.7.0
+[1.6.3]: https://github.com/taiki-e/create-gh-release-action/compare/v1.6.2...v1.6.3
 [1.6.2]: https://github.com/taiki-e/create-gh-release-action/compare/v1.6.1...v1.6.2
 [1.6.1]: https://github.com/taiki-e/create-gh-release-action/compare/v1.6.0...v1.6.1
 [1.6.0]: https://github.com/taiki-e/create-gh-release-action/compare/v1.5.0...v1.6.0

README.md

@@ -1,6 +1,7 @@
 # create-gh-release-action
 
-[![build status](https://img.shields.io/github/actions/workflow/status/taiki-e/create-gh-release-action/ci.yml?branch=main&style=flat-square&logo=github)](https://github.com/taiki-e/create-gh-release-action/actions)
+[![release](https://img.shields.io/github/release/taiki-e/create-gh-release-action?style=flat-square&logo=github)](https://github.com/taiki-e/create-gh-release-action/releases/latest)
+[![github actions](https://img.shields.io/github/actions/workflow/status/taiki-e/create-gh-release-action/ci.yml?branch=main&style=flat-square&logo=github)](https://github.com/taiki-e/create-gh-release-action/actions)
 
 GitHub Action for creating GitHub Releases based on changelog.
 
@@ -13,6 +14,7 @@ GitHub Action for creating GitHub Releases based on changelog.
   - [Example workflow: No changelog](#example-workflow-no-changelog)
   - [Example workflow: Reject releases from outside of main branch](#example-workflow-reject-releases-from-outside-of-main-branch)
   - [Other examples](#other-examples)
+- [Supported events](#supported-events)
 - [Compatibility](#compatibility)
 - [Related Projects](#related-projects)
 - [License](#license)
@@ -33,27 +35,28 @@ Currently, changelog format and supported tag names have the following rule:
   [If the `changelog` option is not specified, the changelog is ignored and only the release created.](#example-workflow-no-changelog)
 
 - The supported tag format is `v?MAJOR.MINOR.PATCH(-PRERELEASE)?(+BUILD_METADATA)?`.
-  (leading "v", pre-release version, and build metadata are optional.)
+  (leading "v", pre-release version, and build metadata are optional.) The optional prefix is also supported.
   This is based on [Semantic Versioning][semver]
 
 ### Inputs
 
-| Name      | Required     | Description                                                                 | Type    | Default |
-|-----------|:------------:|-----------------------------------------------------------------------------|---------|---------|
-| token     | **true** [^1]| GitHub token for creating GitHub Releases (see [action.yml](action.yml) for more) | String |         |
-| changelog | false        | Path to changelog (variables `$tag`, `$version`, `$prefix`, and any string) | String  |         |
-| title     | false        | Format of title (variables `$tag`, `$version`, `$prefix`, and any string)   | String  | `$tag`  |
-| draft     | false        | Create a draft release (`true` or `false`)                                  | Boolean | `false` |
-| branch    | false        | Reject releases from commits not contained in branches that match the specified pattern (regular expression) | String  |         |
-| prefix    | false        | An optional pattern that matches a prefix for the release tag, before the version number (see [action.yml](action.yml) for more) | String |         |
-| ref       | false        | Fully-formed tag ref for this release (see [action.yml](action.yml) for more) | String |         |
+| Name      | Required  | Description                                                                 | Type    | Default |
+| --------- |:---------:| --------------------------------------------------------------------------- | ------- | ------- |
+| token     | **✓** [^1]| GitHub token for creating GitHub Releases (see [action.yml](action.yml) for more) | String |         |
+| changelog |           | Path to changelog (variables `$tag`, `$version`, `$prefix`, and any string) | String  |         |
+| allow-missing-changelog |  | Create the release even if the changelog entry corresponding to the version is missing. The default value of the changelog will be an empty string. | Boolean | `false` |
+| title     |           | Format of title (variables `$tag`, `$version`, `$prefix`, and any string)   | String  | `$tag`  |
+| draft     |           | Create a draft release (`true` or `false`)                                  | Boolean | `false` |
+| branch    |           | Reject releases from commits not contained in branches that match the specified pattern (regular expression) | String  |         |
+| prefix    |           | An optional pattern that matches a prefix for the release tag, before the version number (see [action.yml](action.yml) for more) | String |         |
+| ref       |           | Fully-formed tag ref for this release (see [action.yml](action.yml) for more) | String |         |
 
 [^1]: Required one of `token` input option or `GITHUB_TOKEN` environment variable.
 
 ### Outputs
 
 | Name            | Description                                                                                                    |
-|-----------------|----------------------------------------------------------------------------------------------------------------|
+| --------------- | -------------------------------------------------------------------------------------------------------------- |
 | computed-prefix | The computed prefix, including '-' and 'v'.                                                                    |
 | version         | The version number extracted from the tag. The tag name is a concatenation of `computed-prefix` and `version`. |
 
@@ -74,7 +77,7 @@ jobs:
   create-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: taiki-e/create-gh-release-action@v1
         with:
           # (Optional) Path to changelog.
@@ -100,7 +103,7 @@ jobs:
   create-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: taiki-e/create-gh-release-action@v1
         with:
           # (Optional) Path to changelog.
@@ -133,7 +136,7 @@ jobs:
   create-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: taiki-e/create-gh-release-action@v1
         with:
           # (Optional)
@@ -167,7 +170,7 @@ jobs:
   create-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: taiki-e/create-gh-release-action@v1
         with:
           # (Required) GitHub token for creating GitHub Releases.
@@ -193,7 +196,7 @@ jobs:
   create-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: taiki-e/create-gh-release-action@v1
         with:
           # (Optional) Path to changelog.
@@ -210,23 +213,63 @@ jobs:
 - [cargo-hack](https://github.com/taiki-e/cargo-hack/blob/202e6e59d491c9202ce148c9ef423853267226db/.github/workflows/release.yml#L25-L45)
 - [tracing](https://github.com/tokio-rs/tracing/blob/2aa0cb010d8a7fa0de610413b5acd4557a00dd34/.github/workflows/release.yml#L10-L24)
 
+## Supported events
+
+The following two events are supported by default:
+
+- tags ([`on.push.tags`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push))
+
+  For example:
+
+  ```yaml
+  on:
+    push:
+      tags:
+        - v[0-9]+.*
+  ```
+
+- GitHub release ([`on.release`](https://docs.github.com/en/actions/reference/events-that-trigger-workflows#release))
+
+  For example:
+
+  ```yaml
+  on:
+    release:
+      types: [created]
+  ```
+
+You can create a release from arbitrary event to arbitrary tag by specifying the `ref` input option.
+
+For example, to create a release to the `my_tag` tag, specify `ref` input option as follows:
+
+```yaml
+with:
+  ref: refs/tags/my_tag
+```
+
 ## Compatibility
 
-This action has been tested for action runners hosted by GitHub.
-To use this action in self-hosted runners or in containers, you will need to install at least the following:
+This action has been tested for GitHub-hosted runners (Ubuntu, macOS, Windows).
+
+To use this action in self-hosted runners or in containers, at least the following tools are required:
 
-- bash, GNU Coreutils, GNU grep, GNU tar
+- bash
+- GNU tar
 - curl
 - git
-- gh (GitHub CLI)
+- [gh (GitHub CLI)](https://github.com/cli/cli#installation)
 
 ## Related Projects
 
 - [upload-rust-binary-action]: GitHub Action for building and uploading Rust binary to GitHub Releases.
-- [parse-changelog]: Simple changelog parser, written in Rust. Used in this action.
-- [install-action]: GitHub Action for installing development tools.
+- [parse-changelog]: Simple changelog parser, written in Rust. This action uses this tool for changelog parsing.
 - [setup-cross-toolchain-action]: GitHub Action for setup toolchains for cross compilation and cross testing for Rust.
+- [install-action]: GitHub Action for installing development tools (mainly from GitHub Releases).
+- [cache-cargo-install-action]: GitHub Action for `cargo install` with cache.
+- [checkout-action]: GitHub Action for checking out a repository. (Simplified actions/checkout alternative that does not depend on Node.js.)
 
+[cache-cargo-install-action]: https://github.com/taiki-e/cache-cargo-install-action
+[checkout-action]: https://github.com/taiki-e/checkout-action
 [install-action]: https://github.com/taiki-e/install-action
 [keepachangelog]: https://keepachangelog.com/en/1.0.0
 [parse-changelog]: https://github.com/taiki-e/parse-changelog

action.yml

@@ -5,6 +5,12 @@ inputs:
   changelog:
     description: Path to changelog (variables `$tag`, `$version`, `$prefix`, and any string)
     required: false
+  allow-missing-changelog:
+    description: >
+      Create the release even if the changelog entry corresponding to the version is missing.
+      The default value of the changelog will be an empty string.
+    required: false
+    default: 'false'
   title:
     description: Format of title (variables `$tag`, `$version`, `$prefix`, and any string)
     required: false
@@ -53,10 +59,28 @@ outputs:
   computed-prefix:
     description: >
       The computed prefix, including '-' and 'v' if found.
+    value: ${{ steps.main.outputs.computed-prefix }}
   version:
     description:
       The version number extracted from the tag. The tag name is a concatenation of computed-prefix
       and version.
+    value: ${{ steps.main.outputs.version }}
+
+# Note:
+# - inputs.* should be manually mapped to INPUT_* due to https://github.com/actions/runner/issues/665
+# - Use GITHUB_*/RUNNER_* instead of github.*/runner.* due to https://github.com/actions/runner/issues/2185
 runs:
-  using: node16
-  main: main.js
+  using: composite
+  steps:
+    - id: main
+      run: bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
+      shell: bash
+      env:
+        INPUT_CHANGELOG: ${{ inputs.changelog }}
+        INPUT_ALLOW_MISSING_CHANGELOG: ${{ inputs.allow-missing-changelog }}
+        INPUT_TITLE: ${{ inputs.title }}
+        INPUT_DRAFT: ${{ inputs.draft }}
+        INPUT_BRANCH: ${{ inputs.branch }}
+        INPUT_PREFIX: ${{ inputs.prefix }}
+        INPUT_TOKEN: ${{ inputs.token }}
+        INPUT_REF: ${{ inputs.ref }}

main.sh

@@ -1,62 +1,86 @@
-#!/bin/bash
-set -euo pipefail
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+set -CeEuo pipefail
 IFS=$'\n\t'
 
-# https://github.com/taiki-e/parse-changelog/releases
-parse_changelog_version="0.5.2"
-
+retry() {
+  for i in {1..10}; do
+    if "$@"; then
+      return 0
+    else
+      sleep "${i}"
+    fi
+  done
+  "$@"
+}
 bail() {
-    echo "::error::$*"
-    exit 1
+  printf '::error::%s\n' "$*"
+  exit 1
 }
 warn() {
-    echo "::warning::$*"
+  printf '::warning::%s\n' "$*"
+}
+download_and_checksum() {
+  local url="${1:?}"
+  local checksum="${2:?}"
+  retry curl --proto '=https' --tlsv1.2 -fsSL --retry 10 "${url}" -o tmp
+  if type -P sha256sum >/dev/null; then
+    sha256sum -c - >/dev/null <<<"${checksum} *tmp"
+  elif type -P shasum >/dev/null; then
+    # GitHub-hosted macOS runner does not install GNU Coreutils by default.
+    # https://github.com/actions/runner-images/issues/90
+    shasum -a 256 -c - >/dev/null <<<"${checksum} *tmp"
+  else
+    warn "checksum requires 'sha256sum' or 'shasum' command; consider installing one of them; skipped checksum for $(basename -- "${url}")"
+  fi
 }
 
 if [[ $# -gt 0 ]]; then
-    bail "invalid argument '$1'"
+  bail "invalid argument '$1'"
 fi
 
+# Input options
 title="${INPUT_TITLE:?}"
 changelog="${INPUT_CHANGELOG:-}"
+allow_missing_changelog="${INPUT_ALLOW_MISSING_CHANGELOG:-}"
 draft="${INPUT_DRAFT:-}"
 branch="${INPUT_BRANCH:-}"
 prefix="${INPUT_PREFIX:-}"
 token="${INPUT_TOKEN:-"${GITHUB_TOKEN:-}"}"
 ref="${INPUT_REF:-"${GITHUB_REF:-}"}"
 
 if [[ -z "${token}" ]]; then
-    bail "neither GITHUB_TOKEN environment variable nor 'token' input option is set"
+  bail "neither GITHUB_TOKEN environment variable nor 'token' input option is set"
 fi
 
 if [[ "${ref}" != "refs/tags/"* ]]; then
-    bail "tag ref should start with 'refs/tags/': '${ref}'"
+  bail "tag ref should start with 'refs/tags/': '${ref}'; this action only supports events from tag or release by default; see <https://github.com/taiki-e/create-gh-release-action#supported-events> for more"
 fi
 tag="${ref#refs/tags/}"
 
 release_options=("${tag}")
 parse_changelog_options=()
 if [[ ! "${tag}" =~ ^${prefix}-?v?(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$ ]]; then
-    # TODO: In the next major version, reject underscores in pre-release strings and build metadata.
-    if [[ ! "${tag}" =~ ^${prefix}-?v?[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z_\.-]+)?(\+[0-9A-Za-z_\.-]+)?$ ]]; then
-        bail "invalid tag format '${tag}'"
-    fi
-    warn "underscores are not allowed in semver's pre-release strings and build metadata; this will be rejected in the next major version of create-gh-release-action: '${tag}'"
-    # parse-changelog 0.5+'s default version format strictly adheres to semver.
-    parse_changelog_options+=(--version-format '^\d+\.\d+\.\d+(-[\w\.-]+)?(\+[\w\.-]+)?$')
+  # TODO: In the next major version, reject underscores in pre-release strings and build metadata.
+  if [[ ! "${tag}" =~ ^${prefix}-?v?[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z_\.-]+)?(\+[0-9A-Za-z_\.-]+)?$ ]]; then
+    bail "invalid tag format '${tag}'"
+  fi
+  warn "underscores are not allowed in semver's pre-release strings and build metadata; this will be rejected in the next major version of create-gh-release-action: '${tag}'"
+  # parse-changelog 0.5+'s default version format strictly adheres to semver.
+  parse_changelog_options+=(--version-format '^\d+\.\d+\.\d+(-[\w\.-]+)?(\+[\w\.-]+)?$')
 fi
 # TODO: In the next major version, reject underscores in pre-release strings and build metadata.
 if [[ "${tag}" =~ ^${prefix}-?v?[0-9\.]+-[0-9A-Za-z_\.-]+(\+[0-9A-Za-z_\.-]+)?$ ]]; then
-    release_options+=("--prerelease")
+  release_options+=("--prerelease")
 fi
 
 version="${tag}"
 # extract the portion of the tag matching the prefix pattern
-if [[ ! "${prefix}" = "" ]]; then
-    prefix=$(grep <<<"${tag}" -Eo "^${prefix}")
-    prefix="${prefix%-}"
-    version="${tag#"${prefix}"}"
-    version="${version#-}"
+if [[ -n "${prefix}" ]]; then
+  prefix=$(grep -Eo "^${prefix}" <<<"${tag}")
+  prefix="${prefix%-}"
+  version="${tag#"${prefix}"}"
+  version="${version#-}"
 fi
 version="${version#v}"
 
@@ -69,58 +93,89 @@ changelog="${changelog/\$tag/${tag}}"
 changelog="${changelog/\$version/${version}}"
 changelog="${changelog/\$prefix/${prefix}}"
 case "${draft}" in
-    true) release_options+=("--draft") ;;
-    false) ;;
-    *) bail "'draft' input option must be 'true' or 'false': '${draft}'" ;;
+  true) release_options+=("--draft") ;;
+  false) ;;
+  *) bail "'draft' input option must be 'true' or 'false': '${draft}'" ;;
+esac
+case "${allow_missing_changelog}" in
+  true | false) ;;
+  *) bail "'allow_missing_changelog' input option must be 'true' or 'false': '${allow_missing_changelog}'" ;;
 esac
 
 if [[ -n "${branch}" ]]; then
-    git fetch &>/dev/null
-    if ! git branch -r --contains | grep -Eq "(^|\s)origin/(${branch})$"; then
-        git branch -r --contains
-        bail "creating of release is only allowed on commits contained in branches that match the specified pattern '${branch}'"
-    fi
+  git fetch &>/dev/null
+  if ! git branch -r --contains | grep -Eq "(^|\s)origin/(${branch})$"; then
+    git branch -r --contains
+    bail "creating of release is only allowed on commits contained in branches that match the specified pattern '${branch}'"
+  fi
 fi
 
+notes=''
 if [[ -n "${changelog}" ]]; then
-    tar="tar"
-    case "${OSTYPE}" in
-        linux*) parse_changelog_target="x86_64-unknown-linux-musl" ;;
-        darwin*)
-            parse_changelog_target="x86_64-apple-darwin"
-            tar="gtar"
-            if ! type -P gtar &>/dev/null; then
-                brew install gnu-tar &>/dev/null
-            fi
-            ;;
-        cygwin* | msys*) parse_changelog_target="x86_64-pc-windows-msvc" ;;
-        *) bail "unrecognized OSTYPE '${OSTYPE}'" ;;
-    esac
-    # https://github.com/taiki-e/parse-changelog
-    curl --proto '=https' --tlsv1.2 -fsSL --retry 10 --retry-connrefused "https://github.com/taiki-e/parse-changelog/releases/download/v${parse_changelog_version}/parse-changelog-${parse_changelog_target}.tar.gz" \
-        | "${tar}" xzf -
-    parse_changelog_options+=("${changelog}" "${version}")
-    notes=$(./parse-changelog "${parse_changelog_options[@]}")
-    rm -f ./parse-changelog
+  # https://github.com/taiki-e/install-action/blob/HEAD/manifests/parse-changelog.json
+  parse_changelog_version='0.6.12'
+  exe=''
+  case "$(uname -s)" in
+    Linux)
+      # AArch64 macOS/Windows can run x86_64 binaries, so handles architecture only on Linux.
+      case "$(uname -m)" in
+        aarch64 | arm64)
+          parse_changelog_target=aarch64-unknown-linux-musl
+          parse_changelog_checksum='6cfb4707d0b90a8cf9f2c3b4d3e161d50333f4f4d180bf1e775786eec69c7820'
+          ;;
+        *)
+          parse_changelog_target=x86_64-unknown-linux-musl
+          parse_changelog_checksum='619b7512735e294e9f758df6ed6d85a562d126460d71d3349d9f08e667a29225'
+          ;;
+      esac
+      ;;
+    Darwin)
+      parse_changelog_target=x86_64-apple-darwin
+      parse_changelog_checksum='d88b967f24eee717a34126bd1104a8eeeb561894693d9a2e760b6cf1c0edfbc9'
+      ;;
+    MINGW* | MSYS* | CYGWIN* | Windows_NT)
+      exe=.exe
+      parse_changelog_target=x86_64-pc-windows-msvc
+      parse_changelog_checksum='29527cf19d1bbc772dcbc9776ec09c28e6e5f75c36c0eeea60ab631d6f2b8c62'
+      ;;
+    *) bail "unrecognized OS type '$(uname -s)'" ;;
+  esac
+  action_dir="${HOME}/.create-gh-release-action"
+  mkdir -p -- "${action_dir}/bin"
+  (
+    cd -- "${action_dir}/bin"
+    download_and_checksum "https://github.com/taiki-e/parse-changelog/releases/download/v${parse_changelog_version}/parse-changelog-${parse_changelog_target}.tar.gz" "${parse_changelog_checksum}"
+    tar xzf tmp
+  )
+  parse_changelog_options+=("${changelog}" "${version}")
+
+  # If allow_missing_changelog is true then default to empty value if version not found
+  if [[ "${allow_missing_changelog}" == "true" ]]; then
+    notes=$("${action_dir}/bin/parse-changelog${exe}" "${parse_changelog_options[@]}" || true)
+  else
+    notes=$("${action_dir}/bin/parse-changelog${exe}" "${parse_changelog_options[@]}")
+  fi
+
+  rm -rf -- "${action_dir}"
 fi
 
 # https://cli.github.com/manual/gh_release_view
 if GITHUB_TOKEN="${token}" gh release view "${tag}" &>/dev/null; then
-    # https://cli.github.com/manual/gh_release_delete
-    GITHUB_TOKEN="${token}" gh release delete "${tag}" -y
+  # https://cli.github.com/manual/gh_release_delete
+  GITHUB_TOKEN="${token}" gh release delete "${tag}" -y || true
 fi
 
 # https://cli.github.com/manual/gh_release_create
-GITHUB_TOKEN="${token}" gh release create "${release_options[@]}" --title "${title}" --notes "${notes:-}"
+GITHUB_TOKEN="${token}" retry gh release create "${release_options[@]}" --title "${title}" --notes "${notes}"
 
 # Set (computed) prefix and version outputs for future step use.
 computed_prefix=${tag%"${version}"}
 if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
-    echo "computed-prefix=${computed_prefix}" >>"${GITHUB_OUTPUT}"
-    echo "version=${version}" >>"${GITHUB_OUTPUT}"
+  printf 'computed-prefix=%s\n' "${computed_prefix}" >>"${GITHUB_OUTPUT}"
+  printf 'version=%s\n' "${version}" >>"${GITHUB_OUTPUT}"
 else
-    # Self-hosted runner may not set GITHUB_OUTPUT.
-    warn "GITHUB_OUTPUT is not set; skip setting 'computed-prefix' and 'version' outputs"
-    echo "computed-prefix: ${computed_prefix}"
-    echo "version: ${version}"
+  # Self-hosted runner may not set GITHUB_OUTPUT.
+  warn "GITHUB_OUTPUT is not set; skip setting 'computed-prefix' and 'version' outputs"
+  printf 'computed-prefix: %s\n' "${computed_prefix}"
+  printf 'version: %s\n' "${version}"
 fi

tools/.tidy-check-license-headers

@@ -0,0 +1 @@
+git ls-files

tools/publish.sh

@@ -1,10 +1,9 @@
-#!/bin/bash
-set -euo pipefail
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+set -CeEuo pipefail
 IFS=$'\n\t'
-cd "$(dirname "$0")"/..
-
-# shellcheck disable=SC2154
-trap 's=$?; echo >&2 "$0: Error on line "${LINENO}": ${BASH_COMMAND}"; exit ${s}' ERR
+trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
+cd -- "$(dirname -- "$0")"/..
 
 # Publish a new release.
 #
@@ -14,19 +13,36 @@ trap 's=$?; echo >&2 "$0: Error on line "${LINENO}": ${BASH_COMMAND}"; exit ${s}
 # Note: This script requires the following tools:
 # - parse-changelog <https://github.com/taiki-e/parse-changelog>
 
+retry() {
+  for i in {1..10}; do
+    if "$@"; then
+      return 0
+    else
+      sleep "${i}"
+    fi
+  done
+  "$@"
+}
 bail() {
-    echo >&2 "error: $*"
-    exit 1
+  printf >&2 'error: %s\n' "$*"
+  exit 1
 }
 
 version="${1:?}"
 version="${version#v}"
-tag="v${version}"
+tag_prefix="v"
+tag="${tag_prefix}${version}"
+changelog="CHANGELOG.md"
 if [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$ ]]; then
-    bail "invalid version format '${version}'"
+  bail "invalid version format '${version}'"
 fi
 if [[ $# -gt 1 ]]; then
-    bail "invalid argument '$2'"
+  bail "invalid argument '$2'"
+fi
+if { sed --help 2>&1 || true; } | grep -Eq -e '-i extension'; then
+  in_place=(-i '')
+else
+  in_place=(-i)
 fi
 
 # Make sure there is no uncommitted change.
@@ -35,65 +51,79 @@ git diff --exit-code --staged
 
 # Make sure the same release has not been created in the past.
 if gh release view "${tag}" &>/dev/null; then
-    bail "tag '${tag}' has already been created and pushed"
+  bail "tag '${tag}' has already been created and pushed"
 fi
 
-if ! git branch | grep -q '\* main'; then
-    bail "current branch is not 'main'"
+# Make sure that the release was created from an allowed branch.
+if ! git branch | grep -Eq '\* main$'; then
+  bail "current branch is not 'main'"
+fi
+if ! git remote -v | grep -F origin | grep -Eq 'github\.com[:/]taiki-e/'; then
+  bail "cannot publish a new release from fork repository"
 fi
 
-tags=$(git --no-pager tag)
+release_date=$(date -u '+%Y-%m-%d')
+tags=$(git --no-pager tag | { grep -E "^${tag_prefix}[0-9]+" || true; })
 if [[ -n "${tags}" ]]; then
-    # Make sure the same release does not exist in CHANGELOG.md.
-    release_date=$(date -u '+%Y-%m-%d')
-    if grep -Eq "^## \\[${version//./\\.}\\] - ${release_date}$" CHANGELOG.md; then
-        bail "release ${version} already exist in CHANGELOG.md"
-    fi
-    if grep -Eq "^\\[${version//./\\.}\\]: " CHANGELOG.md; then
-        bail "link to ${version} already exist in CHANGELOG.md"
-    fi
-
-    # Update changelog.
-    remote_url=$(grep -E '^\[Unreleased\]: https://' CHANGELOG.md | sed 's/^\[Unreleased\]: //' | sed 's/\.\.\.HEAD$//')
-    before_tag=$(sed <<<"${remote_url}" 's/^.*\/compare\///')
-    remote_url=$(sed <<<"${remote_url}" 's/\/compare\/v.*$//')
-    sed -i "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n## [${version}] - ${release_date}/" CHANGELOG.md
-    sed -i "s#^\[Unreleased\]: https://.*#[Unreleased]: ${remote_url}/compare/v${version}...HEAD\\n[${version}]: ${remote_url}/compare/${before_tag}...v${version}#" CHANGELOG.md
-    if ! grep -Eq "^## \\[${version//./\\.}\\] - ${release_date}$" CHANGELOG.md; then
-        bail "failed to update CHANGELOG.md"
-    fi
-    if ! grep -Eq "^\\[${version//./\\.}\\]: " CHANGELOG.md; then
-        bail "failed to update CHANGELOG.md"
-    fi
+  # Make sure the same release does not exist in changelog.
+  if grep -Eq "^## \\[${version//./\\.}\\]" "${changelog}"; then
+    bail "release ${version} already exist in ${changelog}"
+  fi
+  if grep -Eq "^\\[${version//./\\.}\\]: " "${changelog}"; then
+    bail "link to ${version} already exist in ${changelog}"
+  fi
+  # Update changelog.
+  remote_url=$(grep -E '^\[Unreleased\]: https://' "${changelog}" | sed -E 's/^\[Unreleased\]: //; s/\.\.\.HEAD$//')
+  prev_tag="${remote_url#*/compare/}"
+  remote_url="${remote_url%/compare/*}"
+  sed -E "${in_place[@]}" \
+    -e "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n## [${version}] - ${release_date}/" \
+    -e "s#^\[Unreleased\]: https://.*#[Unreleased]: ${remote_url}/compare/${tag}...HEAD\\n[${version}]: ${remote_url}/compare/${prev_tag}...${tag}#" "${changelog}"
+  if ! grep -Eq "^## \\[${version//./\\.}\\] - ${release_date}$" "${changelog}"; then
+    bail "failed to update ${changelog}"
+  fi
+  if ! grep -Eq "^\\[${version//./\\.}\\]: " "${changelog}"; then
+    bail "failed to update ${changelog}"
+  fi
+else
+  # Make sure the release exists in changelog.
+  if ! grep -Eq "^## \\[${version//./\\.}\\] - ${release_date}$" "${changelog}"; then
+    bail "release ${version} does not exist in ${changelog} or has wrong release date"
+  fi
+  if ! grep -Eq "^\\[${version//./\\.}\\]: " "${changelog}"; then
+    bail "link to ${version} does not exist in ${changelog}"
+  fi
 fi
 
 # Make sure that a valid release note for this version exists.
 # https://github.com/taiki-e/parse-changelog
-echo "============== CHANGELOG =============="
-parse-changelog CHANGELOG.md "${version}"
-echo "======================================="
+changes=$(parse-changelog "${changelog}" "${version}")
+if [[ -z "${changes}" ]]; then
+  bail "changelog for ${version} has no body"
+fi
+printf '============== CHANGELOG ==============\n'
+printf '%s\n' "${changes}"
+printf '=======================================\n'
 
 if [[ -n "${tags}" ]]; then
-    # Create a release commit.
-    git add CHANGELOG.md
+  # Create a release commit.
+  (
+    set -x
+    git add "${changelog}"
     git commit -m "Release ${version}"
+  )
 fi
 
 set -x
 
 git tag "${tag}"
-git push origin main
-git push origin --tags
+retry git push origin refs/heads/main
+retry git push origin refs/tags/"${tag}"
 
 major_version_tag="v${version%%.*}"
 git checkout -b "${major_version_tag}"
-git push origin refs/heads/"${major_version_tag}"
-if git --no-pager tag | grep -Eq "^${major_version_tag}$"; then
-    git tag -d "${major_version_tag}"
-    git push --delete origin refs/tags/"${major_version_tag}"
-fi
-git tag "${major_version_tag}"
+retry git push origin refs/heads/"${major_version_tag}"
+git tag -f "${major_version_tag}"
+retry git push origin -f refs/tags/"${major_version_tag}"
 git checkout main
 git branch -d "${major_version_tag}"
-
-git push origin --tags