version-bump.yml

name: Version Bump

# Version bumps land on main through normal PRs (protected branch / ruleset safe).
# After a version-bump PR merges, this workflow tags v{VERSION_CLI}, which triggers
# release.yml (GitHub Release + automatic R2 publish). workflow_dispatch can open a
# bump PR or tag the current VERSION_CLI. This workflow never pushes commits to main.
on:
  push:
    branches: [main]
    paths:
      - VERSION_CLI
      - src/cortex-cli/VERSION
  workflow_dispatch:
    inputs:
      action:
        description: "Action to perform"
        required: true
        type: choice
        options:
          - tag-current-version
          - open-bump-pr
      bump_type:
        description: "Bump type (only used with open-bump-pr)"
        required: false
        type: choice
        options:
          - patch
          - minor
          - major
        default: patch

permissions:
  contents: write
  pull-requests: write

jobs:
  # Always-green job so skipped tag/PR jobs do not fail the workflow.
  gate:
    name: Workflow started
    runs-on: ubuntu-latest
    steps:
      - name: Note
        env:
          EVENT_NAME: ${{ github.event_name }}
          GIT_REF: ${{ github.ref }}
        run: |
          echo "event=${EVENT_NAME}"
          echo "ref=${GIT_REF}"
          echo "Tagging runs only for 'chore: bump version to …' merges or workflow_dispatch."

  tag-on-version-bump-merge:
    name: Tag release on version-bump merge
    runs-on: ubuntu-latest
    if: |
      github.event_name == 'push' &&
      contains(github.event.head_commit.message, 'chore: bump version to')
    outputs:
      version: ${{ steps.version.outputs.version }}
      tagged: ${{ steps.tag.outputs.tagged }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Read VERSION_CLI
        id: version
        run: |
          VERSION=$(tr -d '[:space:]' < VERSION_CLI)
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][A-Za-z0-9.]+)?$ ]]; then
            echo "::error::VERSION_CLI is missing or not a valid version"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Release version from VERSION_CLI: $VERSION"

      - name: Verify bump commit message
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          expected="chore: bump version to ${VERSION}"
          MSG=$(git log -1 --pretty=%B)
          if ! printf '%s\n' "$MSG" | grep -F -q "$expected"; then
            echo "::error::Head commit must contain '${expected}'"
            exit 1
          fi
          ./scripts/check-cli-version.sh

      - name: Create and push tag
        id: tag
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          TAG="v${VERSION}"
          if git rev-parse "$TAG" >/dev/null 2>&1; then
            echo "Tag $TAG already exists; skipping"
            echo "tagged=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "$TAG" -m "Release $TAG"
          git push origin "$TAG"
          echo "tagged=true" >> "$GITHUB_OUTPUT"
          echo "Created and pushed $TAG"

  open-bump-pr:
    name: Open version-bump PR
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch' && inputs.action == 'open-bump-pr'
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0

      - name: Bump version
        id: bump
        env:
          BUMP_TYPE: ${{ inputs.bump_type }}
        run: |
          case "$BUMP_TYPE" in
            patch|minor|major) ;;
            *)
              echo "::error::bump_type must be patch, minor, or major"
              exit 1
              ;;
          esac
          OLD_VERSION=$(tr -d '[:space:]' < VERSION_CLI)
          echo "old_version=$OLD_VERSION" >> "$GITHUB_OUTPUT"
          chmod +x ./scripts/bump-version.sh
          ./scripts/bump-version.sh "$BUMP_TYPE"
          NEW_VERSION=$(tr -d '[:space:]' < VERSION_CLI)
          echo "new_version=$NEW_VERSION" >> "$GITHUB_OUTPUT"

      - name: Create pull request
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NEW_VERSION: ${{ steps.bump.outputs.new_version }}
          OLD_VERSION: ${{ steps.bump.outputs.old_version }}
        run: |
          BRANCH="chore/bump-version-${NEW_VERSION}"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git checkout -b "$BRANCH"
          git add VERSION_CLI src/cortex-cli/VERSION Cargo.toml Cargo.lock
          git commit -m "chore: bump version to ${NEW_VERSION}"
          git push -u origin "$BRANCH"
          BODY="Automated version bump from ${OLD_VERSION} to ${NEW_VERSION}. Merge this PR (do not push to main). version-bump.yml then tags v${NEW_VERSION}; release.yml builds artifacts and publish-r2.yml publishes to software.cortex.foundation."
          gh pr create \
            --base main \
            --head "$BRANCH" \
            --title "chore: bump version to ${NEW_VERSION}" \
            --body "$BODY"

  tag-current-version:
    name: Tag current VERSION_CLI
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch' && inputs.action == 'tag-current-version'
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Read VERSION_CLI
        id: version
        run: |
          VERSION=$(tr -d '[:space:]' < VERSION_CLI)
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][A-Za-z0-9.]+)?$ ]]; then
            echo "::error::VERSION_CLI is missing or not a valid version"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          ./scripts/check-cli-version.sh

      - name: Create and push tag
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          TAG="v${VERSION}"
          if git rev-parse "$TAG" >/dev/null 2>&1; then
            echo "::error::Tag $TAG already exists"
            exit 1
          fi
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "$TAG" -m "Release $TAG"
          git push origin "$TAG"
          echo "Created and pushed $TAG (triggers release.yml)"

  summary:
    name: Summary
    runs-on: ubuntu-latest
    needs: [tag-on-version-bump-merge]
    if: always() && needs.tag-on-version-bump-merge.result != 'skipped'
    steps:
      - name: Summary
        env:
          VERSION: ${{ needs.tag-on-version-bump-merge.outputs.version }}
          TAGGED: ${{ needs.tag-on-version-bump-merge.outputs.tagged }}
        run: |
          {
            echo "## Version tag"
            echo ""
            echo "| | |"
            echo "|---|---|"
            echo "| **Version** | ${VERSION} |"
            echo "| **Tagged** | ${TAGGED} |"
          } >> "$GITHUB_STEP_SUMMARY"