bump-version.yml

# This workflow requires a personal access token named `BUMP_VERSION_TOKEN` with the following privileges:
# - Contents: Read and Write
# - Metadata: Read-Only
# - Pull Requests: Read and Write

name: "Bump Patch Version"

on:
  push:
    branches:
      - main
    paths-ignore:
      - .cruft.json
      - .editorconfig
      - .github/**.yml
      - .gitignore
      - .pre-commit-config.yaml
      - .yamllint.yaml
      - .zenodo.json
      - AUTHORS.rst
      - CHANGELOG.rst
      - CONTRIBUTING.rst
      - Makefile
      - .readthedocs.yml
      - docs/*.py
      - docs/*.rst
      - environment-docs.yml
      - environment-dev.yml
      - pyproject.toml
      - tests/**.py
      - tox.ini
      - figanos/__init__.py
  workflow_dispatch:

permissions:
  contents: read

jobs:
  bump_patch_version:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
      - name: Checkout Repository
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
          persist-credentials: false
          fetch-depth: 0
      - name: Set up Python3
        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
        with:
          python-version: "3.x"
      - name: Config Commit Bot
        run: |
          git config --local user.email "bumpversion[bot]@ouranos.ca"
          git config --local user.name "bumpversion[bot]"
      - name: Install bump-my-version
        run: |
          python -m pip install "bump-my-version>=0.18.3"
      - name: Current Version
        run: |
          bump-my-version show current_version
          CURRENT_VERSION="$(grep -E '__version__' src/figanos/__init__.py | cut -d ' ' -f3)"
          echo "CURRENT_VERSION=${CURRENT_VERSION}" >> $GITHUB_ENV
      - name: Conditional Bump Version
        run: |
          if [[ ${{ env.CURRENT_VERSION }} =~ -dev(\.\d+)? ]]; then
            echo "Development version (ends in 'dev(\.\d+)?'), bumping 'build' version"
            bump-my-version bump build
          else
            echo "Version is stable, bumping 'patch' version"
            bump-my-version bump patch
          fi
          bump-my-version show-bump
      - name: Push Changes
        uses: ad-m/github-push-action@d91a481090679876dfc4178fef17f286781251df # v0.8.0
        with:
          force: false
          github_token: ${{ secrets.BUMP_VERSION_TOKEN }}
          branch: ${{ github.ref }}