Add GitHub Actions workflow for auto-tagging and notifications

.github/workflows/auto-tag-notify.yml

@@ -0,0 +1,57 @@
+name: Auto-tag and notify downstream
+
+on:
+  # Use pull_request_target so secrets are available even for fork-based PRs
+  pull_request_target:
+    types: [closed]
+    branches: [zopen2]
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+
+jobs:
+  auto-tag-and-notify:
+    if: >
+      (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true) ||
+      github.event_name == 'release'
+    runs-on: ubuntu-latest
+    steps:
+      # Pin all actions to immutable commit SHAs for supply-chain security
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          # For pull_request_target: checkout the merge commit on zopen2
+          # For release: checkout the release tag
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.merge_commit_sha || github.event.release.tag_name }}
+          fetch-depth: 0
+
+      # --- Tag creation (only on PR merge) ---
+      - name: Bump version and push tag
+        if: github.event_name == 'pull_request_target'
+        id: tag_version
+        uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # 1.75.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DEFAULT_BUMP: patch
+          WITH_V: true
+          TAG_CONTEXT: branch
+
+      - name: Create release with notes
+        if: github.event_name == 'pull_request_target' && steps.tag_version.outputs.new_tag
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+        with:
+          tag_name: ${{ steps.tag_version.outputs.new_tag }}
+          name: ${{ steps.tag_version.outputs.new_tag }}
+          generate_release_notes: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # --- Downstream notification (runs even if tagging fails) ---
+      - name: Notify downstream zoslibport
+        if: '!cancelled()'
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          token: ${{ secrets.BUMP_TOKEN }}
+          repository: zopencommunity/zoslibport
+          event-type: upstream-release