_version-bump.yml

name: Version Bump

# Reusable: resolve the bump type + gate idempotency, then merge the version bump to main
# via the generic update-repository task. Called by cd.yml. Outputs the resolved bump_type
# ('skip' when nothing to do) and target version so the caller can gate + publish.
on:
  workflow_call:
    outputs:
      bump_type:
        description: "Resolved bump type (major/minor/patch), or 'skip' when no bump was made."
        value: ${{ jobs.resolve.outputs.bump_type }}
      version:
        description: "Target version that was bumped to (empty when skipped)."
        value: ${{ jobs.resolve.outputs.version }}
      sha:
        description: "Merged bump commit SHA on main (empty when skipped)."
        value: ${{ jobs.bump-and-update.outputs.merged_sha }}

permissions: {}

jobs:
  resolve:
    name: Resolve bump type
    runs-on: ubuntu-24.04
    permissions:
      actions: write        # cancel this run when there's nothing to release
      contents: read
      pull-requests: read
    outputs:
      bump_type: ${{ steps.gate.outputs.bump_type }}
      version: ${{ steps.gate.outputs.version }}
    steps:
      - name: Check out repo
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Resolve bump type and gate idempotency
        id: gate
        env:
          GH_TOKEN: ${{ github.token }}
          _SHA: ${{ github.sha }}
        run: |
          # Resolve the bump from the merged PR's version label. This label is enforced on PRs,
          # so a merge to main must carry exactly one of version:{major,minor,patch,skip}:
          #   major|minor|patch → bump; skip → exit clean (this is also what stops the bump PR's
          #   own merge from looping CD, so no paths-ignore is needed); anything else → fail.
          # The commit→PR association can lag briefly after a squash merge, so retry the lookup
          # before concluding there's no PR (a persistent miss is a real misconfiguration → fail).
          PR_JSON=""
          PR_NUMBER=""
          for i in 1 2 3 4 5; do
            PR_JSON=$(gh api "repos/bitwarden/workflow-linter/commits/${_SHA}/pulls" 2>/dev/null || true)
            PR_NUMBER=$(jq -r '.[0].number // empty' <<< "$PR_JSON" 2>/dev/null || true)
            [[ -n "$PR_NUMBER" ]] && break
            echo "PR for [${_SHA}] not resolved yet (attempt $i); retrying..." | tee -a "$GITHUB_STEP_SUMMARY"
            sleep $((i * 3))
          done

          if [[ -z "$PR_NUMBER" ]]; then
            echo "::error::No PR found for [${_SHA}] after retries. CD requires a merged PR carrying a version:{major,minor,patch,skip} label — verify the repo's version-label enforcement is configured." | tee -a "$GITHUB_STEP_SUMMARY"
            exit 1
          fi

          LABEL=$(jq -r '[.[0].labels[].name | select(startswith("version:"))][0] // empty' <<< "$PR_JSON")
          BUMP_TYPE="${LABEL#version:}"
          case "$BUMP_TYPE" in
            major|minor|patch)
              echo "PR #$PR_NUMBER label: version:$BUMP_TYPE" | tee -a "$GITHUB_STEP_SUMMARY"
              ;;
            skip)
              echo "bump_type=skip" >> "$GITHUB_OUTPUT"
              echo "PR #$PR_NUMBER labeled version:skip; no bump or publish." | tee -a "$GITHUB_STEP_SUMMARY"
              exit 0
              ;;
            *)
              echo "::error::PR #$PR_NUMBER for [${_SHA}] has no valid version:{major,minor,patch,skip} label (found: '${LABEL:-none}'). This label is enforced on PRs — verify the repo's version-label check is configured." | tee -a "$GITHUB_STEP_SUMMARY"
              exit 1
              ;;
          esac

          # Idempotency gate: compute the target version and skip if its release tag exists.
          CURRENT=$(grep -oE '__version__ = "[^"]+"' src/bitwarden_workflow_linter/__about__.py | cut -d'"' -f2)
          if [[ -z "$CURRENT" ]]; then
            echo "::error::Could not parse __version__ from __about__.py" | tee -a "$GITHUB_STEP_SUMMARY"
            exit 1
          fi
          IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"
          case "$BUMP_TYPE" in
            major) TARGET="$((MAJOR + 1)).0.0" ;;
            minor) TARGET="$MAJOR.$((MINOR + 1)).0" ;;
            patch) TARGET="$MAJOR.$MINOR.$((PATCH + 1))" ;;
            *)
              echo "::error::Unknown bump type: '$BUMP_TYPE' (expected major/minor/patch/skip)" | tee -a "$GITHUB_STEP_SUMMARY"
              exit 1
              ;;
          esac
          echo "Current version: $CURRENT → target: v$TARGET" | tee -a "$GITHUB_STEP_SUMMARY"

          # Idempotency gate. Distinguish a genuine "release not found" (→ proceed with the
          # bump) from a transient API error (→ fail closed). Swallowing every non-zero exit
          # as "absent" would let a network blip trigger a duplicate bump/publish and defeat
          # idempotency, so only a real not-found result proceeds.
          if RELEASE_OUT=$(gh release view "v$TARGET" --repo bitwarden/workflow-linter 2>&1); then
            echo "Release v$TARGET already exists — skipping." | tee -a "$GITHUB_STEP_SUMMARY"
            echo "bump_type=skip" >> "$GITHUB_OUTPUT"
          elif grep -qiE 'not found|404' <<< "$RELEASE_OUT"; then
            {
              echo "bump_type=$BUMP_TYPE"
              echo "version=$TARGET"
            } >> "$GITHUB_OUTPUT"
          else
            echo "::error::Could not determine whether release v$TARGET exists (transient API error?): $RELEASE_OUT" | tee -a "$GITHUB_STEP_SUMMARY"
            exit 1
          fi

      # A skip (version:skip label, or the target release already exists) is a normal no-op,
      # not a release. Cancel the run so it reads as "cancelled" rather than a green success
      # that implies a release happened. Catches both skip paths via the gate output.
      - name: Cancel run when nothing to release
        if: steps.gate.outputs.bump_type == 'skip'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          echo "No release needed — cancelling this run so it isn't marked successful." | tee -a "$GITHUB_STEP_SUMMARY"
          gh api --method POST "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/cancel"
          # Block until the cancellation lands so the run finalizes as "cancelled". If it never
          # takes effect, fail rather than silently reporting success.
          for _ in $(seq 1 60); do sleep 5; done
          echo "::error::Cancellation did not take effect within 5 minutes."
          exit 1

  bump-and-update:
    name: Bump version and merge it to main
    needs: resolve
    if: needs.resolve.outputs.bump_type != 'skip'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write          # Azure OIDC for the trigger-actions composite
    outputs:
      merged_sha: ${{ steps.merged.outputs.sha }}
    steps:
      - name: Check out repo
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version-file: ".python-version"

      - name: Install hatch
        run: pip install hatch

      - name: Bump version
        env:
          BUMP_TYPE: ${{ needs.resolve.outputs.bump_type }}
        run: hatch version "$BUMP_TYPE"

      - name: Upload modified files
        id: upload
        uses: bitwarden/gh-actions/upload-modified-files@main
        with:
          artifact_name: modified-files

      - name: Merge the bump to main
        uses: bitwarden/gh-actions/trigger-actions@main
        with:
          azure_subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          azure_tenant_id: ${{ secrets.AZURE_TENANT_ID }}
          azure_client_id: ${{ secrets.AZURE_CLIENT_ID }}
          task: update-repository
          # pr_labels: version:skip satisfies the required "Enforce version label" check on
          # the bump PR; the bump touches only __about__.py so it never re-triggers CD.
          # wait_for_merge defaults true, so this blocks until the bump PR merges.
          data: '{"artifact_name": "${{ steps.upload.outputs.artifact_name }}", "target_branch": "main", "pr_labels": "version:skip", "pr_title": "Bump version to ${{ needs.resolve.outputs.version }}"}'

      # The trigger-actions step above blocks until the bump PR merges, so main HEAD is now
      # the merged bump commit. Resolve it here and hand it back so publish builds/tags it.
      - name: Resolve merged commit
        id: merged
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # Standalone assignment so `bash -e` aborts on a failed fetch (a command
          # substitution inside `echo` would not), plus a non-empty guard — never emit an
          # empty sha that publish would then build/tag at a bad ref.
          SHA=$(gh api repos/bitwarden/workflow-linter/commits/main --jq .sha)
          if [[ -z "$SHA" ]]; then
            echo "::error::Failed to resolve merged commit on main"
            exit 1
          fi
          echo "sha=$SHA" >> "$GITHUB_OUTPUT"