Meta: do not create tag when there are no public changes

.github/scripts/changelog.sh

@@ -1,25 +1,26 @@
 #!/bin/bash
 
+set -e
+
 release_has_public_changes=false
 
 url=$(git remote get-url origin | sed -r 's/(.*)\.git/\1/')
-
 previous_tag=$(git describe --tags --abbrev=0 HEAD~)
 
 echo "Changes since $previous_tag:"
 echo
 
 # Loop through all commits since previous tag
-for rev in $(git log $previous_tag..HEAD --format="%H" --reverse --no-merges)
+for rev in $(git log "$previous_tag"..HEAD --format="%H" --reverse --no-merges)
 do
-    summary=$(git log $rev~..$rev --format="%s")
+    summary=$(git log "$rev"~.."$rev" --format="%s")
     # Exclude commits starting with "Meta"
     if [[ $summary != Meta* ]]
     then
         # Print markdown list of commit headlines
         echo "* [$summary]($url/commit/$rev)"
         # Append commit body indented (blank lines and signoff trailer removed)
-        git log $rev~..$rev --format="%b" | sed '/^\s*$/d' | sed '/^Signed-off-by:/d' | \
+        git log "$rev"~.."$rev" --format="%b" | sed '/^\s*$/d' | sed '/^Signed-off-by:/d' | \
         while read -r line
         do
             # Escape markdown formatting symbols _ * `
@@ -34,3 +35,20 @@ then
     echo "No public changes since $previous_tag." >&2
     exit 1
 fi
+
+head_tag=$(git describe --exact-match 2>/dev/null || true)
+
+git log --color=always --format="%C(auto)%h %s%d" | head
+
+if [[ ${head_tag} =~ [\d{2}\.\d{2}\.\d+] ]]; then
+    echo "Version tag ${head_tag} already exists."
+else
+    git config --local user.email "[email protected]"
+    git config --local user.name "github-actions"
+    version=$(date +'%y.%m.0')
+    git tag -a "${version}" -m "Release ${version}"
+    git push origin "${version}"
+    git log --color=always --format="%C(auto)%h %s%d" | head -1
+    echo "Pushed new tag:"
+    echo "${url}/releases/tag/${version}"
+fi

.github/workflows/release.yaml

@@ -15,13 +15,21 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          # The COMMIT_KEY secret contains a private SSH key. The associated public key
+          # has been added as a deploy key in the GitHub project. See:
+          # https://docs.github.com/en/developers/overview/managing-deploy-keys#deploy-keys
+          # This is necessary to make commits done by github-actions able to trigger
+          # further github-actions. See: https://stackoverflow.com/q/60418323/3018229.
+          ssh-key: "${{secrets.COMMIT_KEY}}"
 
       - name: Create Package
         run: tar -czf forgit-${{github.ref_name}}.tar.gz --exclude LICENSE --exclude README.md *
 
-      - name: Generate Changelog
+      - name: Generate Changelog and Tag
         id: changelog
         run: .github/scripts/changelog.sh > CHANGELOG.md
+        env:
+          REPO_URL: ${{github.server_url}}/${{github.repository}}
         continue-on-error: true
 
       - name: Release