Skip to content

Commit 27336dc

Browse files
cursoragentechobt
cursoragent
and
echobt
committed
fix(release): tag on version-bump PR merge, no direct main push
Co-authored-by: Mathis <echobt@users.noreply.github.com>
1 parent be70d96 commit 27336dc

6 files changed

Lines changed: 141 additions & 49 deletions

File tree

‎.github/workflows/version-bump.yml‎

Lines changed: 127 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,90 +1,180 @@
11
name: Version Bump
22

3-
# Patch-bump and tag on every merge to main. workflow_dispatch keeps
4-
# explicit patch/minor/major control. Skip commits that are already bumps
5-
# so the bot cannot loop.
3+
# Version bumps land on main through normal PRs (protected branch / ruleset safe).
4+
# After a version-bump PR merges, this workflow tags v{VERSION_CLI}, which triggers
5+
# release.yml. workflow_dispatch can open a bump PR or tag the current VERSION_CLI.
66
on:
77
push:
88
branches: [main]
99
workflow_dispatch:
1010
inputs:
11-
bump_type:
12-
description: "Version bump type"
11+
action:
12+
description: "Action to perform"
1313
required: true
1414
type: choice
15+
options:
16+
- tag-current-version
17+
- open-bump-pr
18+
bump_type:
19+
description: "Bump type (only used with open-bump-pr)"
20+
required: false
21+
type: choice
1522
options:
1623
- patch
1724
- minor
1825
- major
19-
create_release:
20-
description: "Create release after bump"
21-
required: false
22-
type: boolean
23-
default: true
26+
default: patch
2427

2528
permissions:
2629
contents: write
30+
pull-requests: write
2731

2832
jobs:
29-
bump-version:
30-
name: Bump Version
33+
tag-on-version-bump-merge:
34+
name: Tag release on version-bump merge
3135
runs-on: ubuntu-latest
3236
if: |
33-
github.event_name == 'workflow_dispatch' ||
34-
(
35-
github.event_name == 'push' &&
36-
!contains(github.event.head_commit.message, 'chore: bump version')
37-
)
37+
github.event_name == 'push' &&
38+
contains(github.event.head_commit.message, 'chore: bump version to')
3839
outputs:
39-
new_version: ${{ steps.bump.outputs.new_version }}
40-
old_version: ${{ steps.bump.outputs.old_version }}
40+
version: ${{ steps.version.outputs.version }}
41+
tagged: ${{ steps.tag.outputs.tagged }}
4142
steps:
4243
- uses: actions/checkout@v4
4344
with:
4445
fetch-depth: 0
45-
token: ${{ secrets.GITHUB_TOKEN }}
4646

47-
- name: Configure Git
47+
- name: Read VERSION_CLI
48+
id: version
49+
run: |
50+
VERSION=$(tr -d '[:space:]' < VERSION_CLI)
51+
if [ -z "$VERSION" ]; then
52+
echo "::error::VERSION_CLI is empty"
53+
exit 1
54+
fi
55+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
56+
echo "Release version from VERSION_CLI: $VERSION"
57+
58+
- name: Verify bump commit message
4859
run: |
60+
VERSION="${{ steps.version.outputs.version }}"
61+
MSG="${{ github.event.head_commit.message }}"
62+
if ! echo "$MSG" | grep -q "chore: bump version to ${VERSION}"; then
63+
echo "::error::Head commit must be 'chore: bump version to ${VERSION}' (got: ${MSG})"
64+
exit 1
65+
fi
66+
./scripts/check-cli-version.sh
67+
68+
- name: Create and push tag
69+
id: tag
70+
env:
71+
VERSION: ${{ steps.version.outputs.version }}
72+
run: |
73+
TAG="v${VERSION}"
74+
if git rev-parse "$TAG" >/dev/null 2>&1; then
75+
echo "Tag $TAG already exists; skipping"
76+
echo "tagged=false" >> "$GITHUB_OUTPUT"
77+
exit 0
78+
fi
4979
git config user.name "github-actions[bot]"
5080
git config user.email "github-actions[bot]@users.noreply.github.com"
81+
git tag -a "$TAG" -m "Release $TAG"
82+
git push origin "$TAG"
83+
echo "tagged=true" >> "$GITHUB_OUTPUT"
84+
echo "Created and pushed $TAG"
85+
86+
open-bump-pr:
87+
name: Open version-bump PR
88+
runs-on: ubuntu-latest
89+
if: github.event_name == 'workflow_dispatch' && inputs.action == 'open-bump-pr'
90+
steps:
91+
- uses: actions/checkout@v4
92+
with:
93+
ref: main
94+
fetch-depth: 0
5195

5296
- name: Bump version
5397
id: bump
5498
run: |
5599
OLD_VERSION=$(tr -d '[:space:]' < VERSION_CLI)
56100
echo "old_version=$OLD_VERSION" >> "$GITHUB_OUTPUT"
57-
58-
Bump="${{ github.event_name == 'workflow_dispatch' && inputs.bump_type || 'patch' }}"
59101
chmod +x ./scripts/bump-version.sh
60-
./scripts/bump-version.sh "$Bump"
61-
102+
./scripts/bump-version.sh "${{ inputs.bump_type }}"
62103
NEW_VERSION=$(tr -d '[:space:]' < VERSION_CLI)
63104
echo "new_version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
64-
echo "Version bumped from $OLD_VERSION to $NEW_VERSION"
65105
66-
- name: Commit version bump
106+
- name: Create pull request
107+
env:
108+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
67109
run: |
110+
NEW_VERSION="${{ steps.bump.outputs.new_version }}"
111+
BRANCH="chore/bump-version-${NEW_VERSION}"
112+
git config user.name "github-actions[bot]"
113+
git config user.email "github-actions[bot]@users.noreply.github.com"
114+
git checkout -b "$BRANCH"
68115
git add VERSION_CLI src/cortex-cli/VERSION Cargo.toml Cargo.lock
69-
git commit -m "chore: bump version to ${{ steps.bump.outputs.new_version }}"
70-
git push origin HEAD
116+
git commit -m "chore: bump version to ${NEW_VERSION}"
117+
git push -u origin "$BRANCH"
118+
gh pr create \
119+
--base main \
120+
--head "$BRANCH" \
121+
--title "chore: bump version to ${NEW_VERSION}" \
122+
--body "$(cat <<EOF
123+
## Summary
124+
125+
Automated version bump from ${{ steps.bump.outputs.old_version }} to ${NEW_VERSION}.
126+
127+
## Release path
128+
129+
1. Merge this PR (no direct pushes to \`main\`).
130+
2. \`version-bump.yml\` tags \`v${NEW_VERSION}\` on merge.
131+
3. The tag triggers \`release.yml\` to build artifacts and create the GitHub Release.
132+
4. Publish to R2 manually via \`publish-r2.yml\` workflow_dispatch when ready.
133+
EOF
134+
)"
135+
136+
tag-current-version:
137+
name: Tag current VERSION_CLI
138+
runs-on: ubuntu-latest
139+
if: github.event_name == 'workflow_dispatch' && inputs.action == 'tag-current-version'
140+
steps:
141+
- uses: actions/checkout@v4
142+
with:
143+
fetch-depth: 0
144+
145+
- name: Read VERSION_CLI
146+
id: version
147+
run: |
148+
VERSION=$(tr -d '[:space:]' < VERSION_CLI)
149+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
150+
./scripts/check-cli-version.sh
71151
72152
- name: Create and push tag
73-
if: github.event_name == 'push' || inputs.create_release
153+
env:
154+
VERSION: ${{ steps.version.outputs.version }}
74155
run: |
75-
git tag "v${{ steps.bump.outputs.new_version }}"
76-
git push origin "v${{ steps.bump.outputs.new_version }}"
156+
TAG="v${VERSION}"
157+
if git rev-parse "$TAG" >/dev/null 2>&1; then
158+
echo "::error::Tag $TAG already exists"
159+
exit 1
160+
fi
161+
git config user.name "github-actions[bot]"
162+
git config user.email "github-actions[bot]@users.noreply.github.com"
163+
git tag -a "$TAG" -m "Release $TAG"
164+
git push origin "$TAG"
165+
echo "Created and pushed $TAG (triggers release.yml)"
77166
78-
notify:
167+
summary:
79168
name: Summary
80169
runs-on: ubuntu-latest
81-
needs: bump-version
170+
needs: [tag-on-version-bump-merge]
171+
if: always() && needs.tag-on-version-bump-merge.result != 'skipped'
82172
steps:
83173
- name: Summary
84174
run: |
85-
echo "## Version bump" >> "$GITHUB_STEP_SUMMARY"
175+
echo "## Version tag" >> "$GITHUB_STEP_SUMMARY"
86176
echo "" >> "$GITHUB_STEP_SUMMARY"
87177
echo "| | |" >> "$GITHUB_STEP_SUMMARY"
88178
echo "|---|---|" >> "$GITHUB_STEP_SUMMARY"
89-
echo "| **Previous** | ${{ needs.bump-version.outputs.old_version }} |" >> "$GITHUB_STEP_SUMMARY"
90-
echo "| **New** | ${{ needs.bump-version.outputs.new_version }} |" >> "$GITHUB_STEP_SUMMARY"
179+
echo "| **Version** | ${{ needs.tag-on-version-bump-merge.outputs.version }} |" >> "$GITHUB_STEP_SUMMARY"
180+
echo "| **Tagged** | ${{ needs.tag-on-version-bump-merge.outputs.tagged }} |" >> "$GITHUB_STEP_SUMMARY"

‎.rules/git.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,6 @@
99
- tests added
1010
- no secrets
1111
- CI on PRs to `main` is required: fmt, clippy `-D warnings`, test, audit, TUI checks.
12-
- Versioning: `.github/workflows/version-bump.yml` patch-bumps and tags on merge to `main`. Do not add another version bot.
12+
- Versioning: bump `VERSION_CLI` / `Cargo.toml` / `src/cortex-cli/VERSION` in a PR; merge tags `v*.*.*` via `.github/workflows/version-bump.yml`. Do not add another version bot or push directly to `main`.
1313
- Do not commit `Cargo.lock` deletions. This is a binary workspace; the lockfile is source of truth.
1414
- PR titles and bodies: Cortex CLI / Cortex Code. Never Grok.

‎AGENTS.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Short contract for agents working in this repository. Prefer linking over restat
66

77
**Do not** write `Grok`, `Grok Bot`, or `Grok-core` in code, docs, PR titles, or UI copy.
88

9-
Working branch: **`main`**. Releases are annotated tags `v*.*.*` cut on `main` by `.github/workflows/version-bump.yml` (patch bump + tag on merge; `workflow_dispatch` for minor/major).
9+
Working branch: **`main`**. Version bumps land on `main` via PR; `.github/workflows/version-bump.yml` tags `v*.*.*` after a `chore: bump version to …` merge (or `workflow_dispatch` to tag `VERSION_CLI` / open a bump PR). Tags trigger `release.yml`.
1010

1111
## Workspace map
1212

‎README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -169,11 +169,11 @@ through `generate_tui_demo` and rasterises the frames into `docs/media/intro.gif
169169

170170
## Release and CI secrets
171171

172-
Merges to `main` run [`.github/workflows/version-bump.yml`](.github/workflows/version-bump.yml),
173-
which patch-bumps the version and tags it. Tags run
174-
[`release.yml`](.github/workflows/release.yml), which can publish to
175-
[software.cortex.foundation](https://software.cortex.foundation) via
176-
[`publish-r2.yml`](.github/workflows/publish-r2.yml).
172+
Version bumps merge to `main` in a normal PR (`chore: bump version to …`).
173+
That merge runs [`.github/workflows/version-bump.yml`](.github/workflows/version-bump.yml),
174+
which tags `v*.*.*`. Tags run [`release.yml`](.github/workflows/release.yml).
175+
Publish to [software.cortex.foundation](https://software.cortex.foundation) explicitly via
176+
[`publish-r2.yml`](.github/workflows/publish-r2.yml) `workflow_dispatch`.
177177

178178
This repository does not invent cloud accounts. The secret *names* CI expects are
179179
listed in [docs/CI_SECRETS.md](./docs/CI_SECRETS.md). Values never go in git.

‎docs/CI_SECRETS.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@ None of these values belong in git.
88

99
No secrets. `fmt`, `clippy`, `test`, `audit`, and TUI jobs use the public crates.io index and `GITHUB_TOKEN`.
1010

11-
## Version bump (`.github/workflows/version-bump.yml`)
11+
## Version bump / tag (`.github/workflows/version-bump.yml`)
1212

1313
| Secret | Used for |
1414
|--------|----------|
15-
| `GITHUB_TOKEN` | Commit the bump on `main` and push tag `vX.Y.Z` (default Actions token is enough if repo settings allow) |
15+
| `GITHUB_TOKEN` | Open version-bump PRs and push release tags `vX.Y.Z` (no direct commits to protected `main`) |
1616

1717
## Release artifacts (`.github/workflows/release.yml`)
1818

‎docs/CONTRIBUTING.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -107,9 +107,11 @@ update the matching reference page in the same PR.
107107

108108
## Releases
109109

110-
Merging to `main` triggers `.github/workflows/version-bump.yml`, which
111-
patch-bumps the version and tags it. Minor and major bumps are a manual
112-
`workflow_dispatch`. The version lives in `VERSION_CLI`,
110+
Bump the version in a PR (`./scripts/bump-version.sh patch|minor|major`, commit
111+
`chore: bump version to X.Y.Z`). Merging that PR runs
112+
`.github/workflows/version-bump.yml`, which tags `vX.Y.Z` and triggers
113+
`release.yml`. Use `workflow_dispatch` on the same workflow to open an automated
114+
bump PR or tag the current `VERSION_CLI`. The version lives in `VERSION_CLI`,
113115
`[workspace.package].version` and `src/cortex-cli/VERSION`, and
114116
`./scripts/check-cli-version.sh` verifies the three agree — do not introduce a
115117
second scheme.

0 commit comments

Comments
 (0)