Release automatically when the version changes

.github/workflows/ci.yml

@@ -28,3 +28,70 @@ jobs:
 
       - name: Test
         run: make test
+
+  # After a merge to the default branch, tag the version declared in
+  # lib/Net/IPData.pm and create its GitHub release, unless that tag exists.
+  release:
+    needs: test
+    if: github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    concurrency:
+      group: release
+      cancel-in-progress: false
+    outputs:
+      tag: ${{ steps.version.outputs.tag }}
+      created: ${{ steps.release.outputs.created }}
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Read the module version
+        id: version
+        run: |
+          VERSION=$(sed -nE "s/.*VERSION *= *['\"]([^'\"]+)['\"].*/\1/p" lib/Net/IPData.pm | head -1)
+          if [ -z "$VERSION" ]; then
+            echo "::error::no \$VERSION found in lib/Net/IPData.pm"
+            exit 1
+          fi
+          echo "Module version $VERSION, tag v$VERSION"
+          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Create the tag and the GitHub release
+        id: release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.version.outputs.tag }}
+        run: |
+          set +e
+          git ls-remote --exit-code --tags origin "refs/tags/$TAG" > /dev/null
+          status=$?
+          set -e
+          case $status in
+            0)
+              echo "Tag $TAG already exists; nothing to release"
+              echo "created=false" >> "$GITHUB_OUTPUT"
+              ;;
+            2)
+              gh release create "$TAG" --target "$GITHUB_SHA" --title "$TAG" --generate-notes
+              echo "Created tag and release $TAG"
+              echo "created=true" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "::error::git ls-remote failed with status $status"
+              exit "$status"
+              ;;
+          esac
+
+  # A tag created with the workflow's own token starts no other workflow run,
+  # so the CPAN upload happens here, in the same run, through the callable
+  # release workflow.
+  publish:
+    needs: release
+    if: needs.release.outputs.created == 'true'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/release.yml
+    with:
+      tag: ${{ needs.release.outputs.tag }}
+    secrets: inherit

.github/workflows/release.yml

@@ -3,12 +3,21 @@ name: Release to CPAN
 on:
   release:
     types: [published]
+  workflow_call:
+    inputs:
+      tag:
+        description: Tag of the release to upload (for example v1.2.0)
+        required: true
+        type: string
 
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+        with:
+          # the tag passed by the calling workflow, or the published release's tag
+          ref: ${{ inputs.tag || github.event.release.tag_name }}
 
       - uses: shogo82148/actions-setup-perl@v1
         with:

Changes

@@ -1,5 +1,10 @@
 Revision history for Net-IPData
 
+Unreleased
+    - Releases are made by CI: merging a pull request that bumps $VERSION
+      tags vX.Y.Z, creates the GitHub release and uploads the distribution
+      to CPAN; a merge whose version is already tagged publishes nothing
+
 1.1.0  2026-11-03
     - The API server's TLS certificate is now verified with every HTTP::Tiny
       version: verify_SSL => 1 is passed explicitly (HTTP::Tiny before 0.083

README.md

@@ -312,6 +312,15 @@ Run the full suite including live API tests:
 IPDATA_API_KEY=your_key_here make test
 ```
 
+## Releasing
+
+Releases are made by CI; nothing is tagged by hand. To publish a new version:
+
+1. In a pull request, bump `$VERSION` in `lib/Net/IPData.pm` and give the `Unreleased` entry in `Changes` its version number and date.
+2. Merge it. CI tags the merge commit `vX.Y.Z`, creates the GitHub release with generated notes and uploads the distribution to CPAN.
+
+A merge whose version is already tagged publishes nothing. The release trigger is kept, so publishing a GitHub release by hand still uploads its tag to CPAN.
+
 ## License
 
 This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.