bump-version.yml

# This workflow requires a personal access token named `BUMP_VERSION_TOKEN` with the following privileges:
# - Contents: Read and Write
# - Metadata: Read-Only
# - Pull Requests: Read and Write

name: "Bump Patch Version"

on:
  push:
    branches:
      - main
    paths-ignore:
      - .cruft.json
      - .editorconfig
      - .github/**.yml
      - .gitignore
      - .pre-commit-config.yaml
      - .yamllint.yaml
      - .zenodo.json
      - AUTHORS.rst
      - CHANGELOG.rst
      - CI/**/*.in
      - CI/**/*.py
      - CI/**/*.txt
      - CODE_OF_CONDUCT.md
      - CONTRIBUTING.rst
      - Makefile
      - .readthedocs.yml
      - docs/*.py
      - docs/*.rst
      - environment-docs.yml
      - environment-dev.yml
      - pyproject.toml
      - tests/**.py
      - tox.ini
      - src/xsdba/__init__.py
  workflow_dispatch:

permissions:
  contents: read

jobs:
  bump_patch_version:
    runs-on: ubuntu-latest
    permissions:
      actions: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
      - name: Generate App Token
        id: token_generator
        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
        with:
          app-id: ${{ secrets.OURANOS_HELPER_BOT_ID }}
          private-key: ${{ secrets.OURANOS_HELPER_BOT_KEY }}
      - name: Checkout Repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          token: ${{ steps.token_generator.outputs.token }}
      - name: Set up Python3
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: "3.x"
      - name: Import GPG Key
        uses: crazy-max/ghaction-import-gpg@cb9bde2e2525e640591a934b1fd28eef1dcaf5e5 # v6.2.0
        with:
          gpg_private_key: ${{ secrets.OURANOS_HELPER_BOT_GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.OURANOS_HELPER_BOT_GPG_PRIVATE_KEY_PASSWORD }}
          git_user_signingkey: true
          git_commit_gpgsign: true
          trust_level: 5
      - name: Current Version
        run: |
          CURRENT_VERSION="$(grep -E '__version__'  src/xsdba/__init__.py | cut -d ' ' -f3)"
          echo "current_version=${CURRENT_VERSION}"
          echo "CURRENT_VERSION=${CURRENT_VERSION}" >> $GITHUB_ENV
      - name: Install CI libraries
        run: |
          python -m pip install --require-hashes -r CI/requirements_ci.txt
      - name: Conditional Bump
        run: |
          if [[ ${{ env.CURRENT_VERSION }} =~ -dev(\.\d+)? ]]; then
            echo "Development version (ends in 'dev(\.\d+)?'), bumping 'build' version"
            bump-my-version bump build
          else
            echo "Version is stable, bumping 'patch' version"
            bump-my-version bump patch
          fi
          NEW_VERSION="$(grep -E '__version__' src/xsdba/__init__.py | cut -d ' ' -f3)"
          echo "new_version=${NEW_VERSION}"
          echo "NEW_VERSION=${NEW_VERSION}" >> $GITHUB_ENV
      - name: Push Changes
        uses: ad-m/github-push-action@d91a481090679876dfc4178fef17f286781251df # v0.8.0
        with:
          force: false
          branch: ${{ github.ref }}