release-bump-version.yml

name: "Legacy packages: Bump Version"

on:
  workflow_dispatch:
    inputs:
      service:
        description: "Legacy package (Cua Driver, Lume, and Sandbox use Release Please)"
        required: true
        type: choice
        options:
          - pypi/cua
          - pypi/agent
          - pypi/auto
          - pypi/bench
          - pypi/bench-ui
          - pypi/cli
          - pypi/computer
          - pypi/computer-server
          - pypi/cloud
          - pypi/core
          - pypi/mcp-server
          - pypi/sandbox-apps
          - pypi/som
          - pypi/train
          - npm/cli
          - npm/computer
          - npm/core
          - npm/fleet
          - npm/playground
          - npm/cuabot
          - docker/cuabot
          - docker/kasm
          - docker/xfce-cua
          - docker/xfce
          - docker/lumier
          - docker/qemu-android
          - docker/qemu-linux
          - docker/qemu-windows
      bump_type:
        description: "Version bump type"
        required: true
        type: choice
        options:
          - patch
          - minor
          - major
      target_branch:
        description: "Branch to push the bump commit + tag to"
        required: false
        type: string
        default: "main"

permissions: {}

jobs:
  authorize:
    name: Authorize version bump
    runs-on: ubuntu-latest
    steps:
      - name: Allow only the release owner or trusted automation
        env:
          ACTOR: ${{ github.actor }}
          TRIGGERING_ACTOR: ${{ github.triggering_actor }}
        run: |
          case "$ACTOR:$TRIGGERING_ACTOR" in
            "f-trycua:f-trycua"|"r33drichards:r33drichards"|"cua-release-bot[bot]:cua-release-bot[bot]")
              echo "Version bump authorized for $ACTOR."
              ;;
            *)
              echo "::error::Only f-trycua may manually bump package versions."
              exit 1
              ;;
          esac

  bump-version:
    needs: authorize
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Set package directory and type
        id: package
        run: |
          case "${{ inputs.service }}" in
            "pypi/cua")
              echo "directory=libs/python/cua" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "pypi/agent")
              echo "directory=libs/python/agent" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "pypi/auto")
              echo "directory=libs/python/cua-auto" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "pypi/bench")
              echo "directory=libs/cua-bench" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "pypi/bench-ui")
              echo "directory=libs/python/bench-ui" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "pypi/cli")
              echo "directory=libs/python/cua-cli" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "pypi/computer")
              echo "directory=libs/python/computer" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "pypi/cloud")
              echo "directory=libs/python/cua-cloud" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "pypi/computer-server")
              echo "directory=libs/python/computer-server" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "pypi/core")
              echo "directory=libs/python/core" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "pypi/mcp-server")
              echo "directory=libs/python/mcp-server" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "pypi/sandbox-apps")
              echo "directory=libs/python/cua-sandbox-apps" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "pypi/som")
              echo "directory=libs/python/som" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "pypi/train")
              echo "directory=libs/python/cua-train" >> $GITHUB_OUTPUT
              echo "type=python" >> $GITHUB_OUTPUT
              ;;
            "npm/cli")
              echo "directory=libs/typescript/cua-cli" >> $GITHUB_OUTPUT
              echo "type=npm" >> $GITHUB_OUTPUT
              ;;
            "npm/computer")
              echo "directory=libs/typescript/computer" >> $GITHUB_OUTPUT
              echo "type=npm" >> $GITHUB_OUTPUT
              ;;
            "npm/core")
              echo "directory=libs/typescript/core" >> $GITHUB_OUTPUT
              echo "type=npm" >> $GITHUB_OUTPUT
              ;;
            "npm/fleet")
              echo "directory=libs/typescript/fleet" >> $GITHUB_OUTPUT
              echo "type=npm" >> $GITHUB_OUTPUT
              ;;
            "npm/playground")
              echo "directory=libs/typescript/playground" >> $GITHUB_OUTPUT
              echo "type=npm" >> $GITHUB_OUTPUT
              ;;
            "npm/cuabot")
              echo "directory=libs/cuabot" >> $GITHUB_OUTPUT
              echo "type=npm" >> $GITHUB_OUTPUT
              ;;
            "docker/cuabot")
              echo "directory=libs/cuabot" >> $GITHUB_OUTPUT
              echo "type=docker" >> $GITHUB_OUTPUT
              echo "bumpversion_config=.bumpversion.docker.cfg" >> $GITHUB_OUTPUT
              ;;
            "docker/kasm")
              echo "directory=libs/kasm" >> $GITHUB_OUTPUT
              echo "type=docker" >> $GITHUB_OUTPUT
              ;;
            "docker/xfce-cua")
              echo "directory=libs/xfce-cua" >> $GITHUB_OUTPUT
              echo "type=docker" >> $GITHUB_OUTPUT
              ;;
            "docker/xfce")
              echo "directory=libs/xfce" >> $GITHUB_OUTPUT
              echo "type=docker" >> $GITHUB_OUTPUT
              ;;
            "docker/lumier")
              echo "directory=libs/lumier" >> $GITHUB_OUTPUT
              echo "type=docker" >> $GITHUB_OUTPUT
              ;;
            "docker/qemu-android")
              echo "directory=libs/qemu-docker/android" >> $GITHUB_OUTPUT
              echo "type=docker" >> $GITHUB_OUTPUT
              ;;
            "docker/qemu-linux")
              echo "directory=libs/qemu-docker/linux" >> $GITHUB_OUTPUT
              echo "type=docker" >> $GITHUB_OUTPUT
              ;;
            "docker/qemu-windows")
              echo "directory=libs/qemu-docker/windows" >> $GITHUB_OUTPUT
              echo "type=docker" >> $GITHUB_OUTPUT
              ;;
            *)
              echo "Unknown service: ${{ inputs.service }}"
              exit 1
              ;;
          esac

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ inputs.target_branch || 'main' }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install bump2version
        run: pip install bump2version

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Reject an existing release tag
        run: |
          reject_existing_tag() {
            local dir=$1
            local config_file=${2:-.bumpversion.cfg}
            cd "$dir"
            NEW_VERSION=$(bump2version --config-file "$config_file" --dry-run --list ${{ inputs.bump_type }} 2>/dev/null | grep -m1 '^new_version=' | sed 's/new_version=//')
            TAG_NAME=$(grep -m1 '^tag_name' "$config_file" | sed 's/tag_name *= *//' | sed "s|{new_version}|$NEW_VERSION|")
            if git show-ref --verify --quiet "refs/tags/$TAG_NAME" || \
              git ls-remote --exit-code --tags origin "refs/tags/$TAG_NAME" >/dev/null 2>&1; then
              echo "::error::release tag $TAG_NAME already exists; release tags are immutable"
              exit 1
            fi
            cd - > /dev/null
          }

          BUMPVERSION_CONFIG="${{ steps.package.outputs.bumpversion_config }}"
          reject_existing_tag "${{ steps.package.outputs.directory }}" "${BUMPVERSION_CONFIG:-.bumpversion.cfg}"

      - name: Run bump2version
        run: |
          cd ${{ steps.package.outputs.directory }}
          CONFIG_FLAG=""
          if [ -n "${{ steps.package.outputs.bumpversion_config }}" ]; then
            CONFIG_FLAG="--config-file ${{ steps.package.outputs.bumpversion_config }}"
          fi
          bump2version $CONFIG_FLAG ${{ inputs.bump_type }}

      - name: Collect created tag
        id: collect_tags
        run: |
          # Only one tag is created per bump (no cascades)
          ALL_TAGS=$(git tag --points-at HEAD | tr '\n' ' ' | xargs)
          echo "Tags to push: $ALL_TAGS"
          echo "tags=$ALL_TAGS" >> $GITHUB_OUTPUT

      - name: Capture bumped cua version
        if: ${{ inputs.service == 'pypi/cua' }}
        id: cua_version
        run: |
          cd libs/python/cua
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "cua version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped agent version
        if: ${{ inputs.service == 'pypi/agent' }}
        id: agent_version
        run: |
          cd libs/python/agent
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "Agent version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped auto version
        if: ${{ inputs.service == 'pypi/auto' }}
        id: auto_version
        run: |
          cd libs/python/cua-auto
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "Auto version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped bench version
        if: ${{ inputs.service == 'pypi/bench' }}
        id: bench_version
        run: |
          cd libs/cua-bench
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "Bench version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped bench-ui version
        if: ${{ inputs.service == 'pypi/bench-ui' }}
        id: bench_ui_version
        run: |
          cd libs/python/bench-ui
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "Bench-ui version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped cli version
        if: ${{ inputs.service == 'pypi/cli' }}
        id: cli_version
        run: |
          cd libs/python/cua-cli
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "CLI version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped computer version
        if: ${{ inputs.service == 'pypi/computer' }}
        id: computer_version
        run: |
          cd libs/python/computer
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "Computer version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped cloud version
        if: ${{ inputs.service == 'pypi/cloud' }}
        id: cloud_version
        run: |
          cd libs/python/cua-cloud
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "Cloud version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped computer-server version
        if: ${{ inputs.service == 'pypi/computer-server' }}
        id: computer_server_version
        run: |
          cd libs/python/computer-server
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "Computer-server version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped core version
        if: ${{ inputs.service == 'pypi/core' }}
        id: core_version
        run: |
          cd libs/python/core
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "Core version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped mcp-server version
        if: ${{ inputs.service == 'pypi/mcp-server' }}
        id: mcp_server_version
        run: |
          cd libs/python/mcp-server
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "MCP-server version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped sandbox-apps version
        if: ${{ inputs.service == 'pypi/sandbox-apps' }}
        id: sandbox_apps_version
        run: |
          cd libs/python/cua-sandbox-apps
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "Sandbox-apps version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped som version
        if: ${{ inputs.service == 'pypi/som' }}
        id: som_version
        run: |
          cd libs/python/som
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "SOM version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped train version
        if: ${{ inputs.service == 'pypi/train' }}
        id: train_version
        run: |
          cd libs/python/cua-train
          VERSION=$(python -c "import tomllib; from pathlib import Path; data = tomllib.loads(Path('pyproject.toml').read_text()); print(data['project']['version'])")
          echo "Train version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped npm/cli version
        if: ${{ inputs.service == 'npm/cli' }}
        id: npm_cli_version
        run: |
          VERSION=$(grep -oP '"version": "\K[^"]+' libs/typescript/cua-cli/package.json)
          echo "npm/cli version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped npm/computer version
        if: ${{ inputs.service == 'npm/computer' }}
        id: npm_computer_version
        run: |
          VERSION=$(grep -oP '"version": "\K[^"]+' libs/typescript/computer/package.json)
          echo "npm/computer version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped npm/core version
        if: ${{ inputs.service == 'npm/core' }}
        id: npm_core_version
        run: |
          VERSION=$(grep -oP '"version": "\K[^"]+' libs/typescript/core/package.json)
          echo "npm/core version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped npm/playground version
        if: ${{ inputs.service == 'npm/playground' }}
        id: npm_playground_version
        run: |
          VERSION=$(grep -oP '"version": "\K[^"]+' libs/typescript/playground/package.json)
          echo "npm/playground version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Capture bumped cuabot version
        if: ${{ inputs.service == 'npm/cuabot' }}
        id: cuabot_version
        run: |
          VERSION=$(grep -oP '"version": "\K[^"]+' libs/cuabot/package.json)
          echo "cuabot version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: ${{ github.event.repository.name }}

      - name: Push release to target branch
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          TARGET_BRANCH: ${{ inputs.target_branch || 'main' }}
        run: |
          # Configure git to use the app token
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"

          # Verify the token works
          echo "Verifying GitHub App token..."
          gh auth status

          # Get all tags created by bump2version
          ALL_TAGS="${{ steps.collect_tags.outputs.tags }}"
          echo "Tags to push: $ALL_TAGS"

          # Use the first tag for naming the temp branch
          FIRST_TAG=$(echo "$ALL_TAGS" | awk '{print $1}')
          TEMP_BRANCH="temp-release-${FIRST_TAG}"
          echo "Temp branch: $TEMP_BRANCH"

          # Retry loop for handling concurrent bumps
          MAX_RETRIES=5
          RETRY_COUNT=0

          while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
            RETRY_COUNT=$((RETRY_COUNT + 1))
            echo ""
            echo "=== Attempt $RETRY_COUNT/$MAX_RETRIES ==="

            # Fetch latest target branch to check if we need to rebase
            git fetch origin "${TARGET_BRANCH}"

            # Check if our HEAD is a descendant of origin/<branch> (fast-forward possible)
            if ! git merge-base --is-ancestor "origin/${TARGET_BRANCH}" HEAD; then
              echo "Branch ${TARGET_BRANCH} has moved forward, rebasing..."

              # Rebase our commit(s) onto the latest branch
              git rebase "origin/${TARGET_BRANCH}"

              # Update the tag to point to the rebased commit
              for tag in $ALL_TAGS; do
                git tag -f "$tag" HEAD
                echo "Updated tag $tag to rebased HEAD"
              done
            fi

            # Get the current commit SHA (may have changed after rebase)
            COMMIT_SHA=$(git rev-parse HEAD)
            echo "Commit SHA: $COMMIT_SHA"

            # Push to temp branch
            echo "Pushing to temp branch..."
            git push origin "HEAD:refs/heads/${TEMP_BRANCH}" --force

            # Try to update target branch via API
            echo "Updating ${TARGET_BRANCH} branch via API..."
            if gh api -X PATCH "/repos/${{ github.repository }}/git/refs/heads/${TARGET_BRANCH}" \
              -f sha="${COMMIT_SHA}" \
              -F force=false 2>&1; then

              echo "Successfully updated ${TARGET_BRANCH} branch!"

              # Create tag via API (only after main is successfully updated)
              echo "Creating tag via API..."
              for tag in $ALL_TAGS; do
                echo "Creating tag: $tag"
                gh api /repos/${{ github.repository }}/git/refs \
                  -f ref="refs/tags/${tag}" \
                  -f sha="${COMMIT_SHA}"
                echo "Tag $tag created successfully!"
              done

              # Clean up temp branch
              echo "Cleaning up temp branch..."
              git push origin --delete "${TEMP_BRANCH}" || true

              exit 0
            fi

            echo "Failed to update ${TARGET_BRANCH} (not a fast-forward), will retry..."
            sleep 2
          done

          echo "ERROR: Failed to update ${TARGET_BRANCH} branch after $MAX_RETRIES attempts"
          exit 1

  # NOTE: Publishing is handled by tag-triggered workflows (cd-py-*.yml, cd-ts-*.yml, cd-swift-lume.yml)
  # When bump-version pushes a tag (e.g., agent-v0.7.10), the corresponding CD workflow
  # is automatically triggered by the tag push event. No need to call them here.