Skip to content

Merge pull request #167 from Ouranosinc/security-policy #2

Merge pull request #167 from Ouranosinc/security-policy

Merge pull request #167 from Ouranosinc/security-policy #2

Workflow file for this run

# This workflow requires a personal access token named `BUMP_VERSION_TOKEN` with the following privileges:
# - Contents: Read and Write
# - Metadata: Read-Only
# - Pull Requests: Read and Write
name: "Bump Patch Version"
on:
push:
branches:
- main
paths-ignore:
- .cruft.json
- .editorconfig
- .github/**.yml
- .gitignore
- .pre-commit-config.yaml
- .yamllint.yaml
- .zenodo.json
- AUTHORS.rst
- CHANGES.rst
- CONTRIBUTING.rst
- Makefile
- .readthedocs.yml
- docs/*.py
- docs/*.rst
- environment-docs.yml
- environment-dev.yml
- pyproject.toml
- tests/**.py
- tox.ini
- miranda/__init__.py
workflow_dispatch:
permissions:
contents: read
jobs:
bump_patch_version:
runs-on: ubuntu-latest
permissions:
actions: read
contents: write
steps:
- name: Harden Runner
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
files.pythonhosted.org:443
github.com:443
pypi.org:443
- uses: actions/checkout@v4
with:
persist-credentials: false
- uses: actions/setup-python@v5
with:
python-version: "3.x"
- name: Config Commit Bot
run: |
git config --local user.email "bumpversion[bot]@ouranos.ca"
git config --local user.name "bumpversion[bot]"
- name: Install bump-my-version
run: |
python -m pip install "bump-my-version>=0.18.3"
- name: Current Version
run: |
bump-my-version show current_version
CURRENT_VERSION="$(grep -E '__version__' miranda/__init__.py | cut -d ' ' -f3)"
echo "CURRENT_VERSION=${CURRENT_VERSION}" >> $GITHUB_ENV
- name: Conditional Bump Version
run: |
if [[ ${{ env.CURRENT_VERSION }} =~ -dev(\.\d+)? ]]; then
echo "Development version (ends in 'dev(\.\d+)?'), bumping 'build' version"
bump-my-version bump build
else
echo "Version is stable, bumping 'patch' version"
bump-my-version bump patch
fi
bump-my-version show-bump
- name: Push Changes
uses: ad-m/github-push-action@master
with:
force: false
github_token: ${{ secrets.BUMP_VERSION_TOKEN }}
branch: ${{ github.ref }}