bump-version.yml

name: Bump Patch Version

on:
  push:
    branches:
      - main
    paths-ignore:
      - .cruft.json
      - .editorconfig
      - .flake8
      - .github/**.yml
      - .gitignore
      - .gitlab-ci.yml
      - .gitmodules
      - .pre-commit-config.yaml
      - .secrets.baseline
      - .yamllint.yaml
      - AUTHORS.rst
      - CHANGELOG.rst
      - CI/**/*.in
      - CI/**/*.py
      - CI/**/*.txt
      - CODE_OF_CONDUCT.md
      - CONTRIBUTING.rst
      - MANIFEST.in
      - Makefile
      - conda/xscen/*.yaml
      - docs/*.py
      - docs/*.rst
      - docs/notebooks
      - environment-dev.yml
      - environment.yml
      - pyproject.toml
      - src/xscen/__init__.py
      - templates
      - tests/*.py
      - tox.ini

permissions:
  contents: read

jobs:
  bump_patch_version:
    name: Bump Patch Version
    runs-on: ubuntu-latest
    permissions:
      actions: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
      - name: Generate App Token
        id: token_generator
        uses: actions/create-github-app-token@3378cda945da322a8db4b193e19d46352ebe2de5 # v1.10.4
        with:
          app-id: ${{ secrets.OURANOS_HELPER_BOT_ID }}
          private-key: ${{ secrets.OURANOS_HELPER_BOT_KEY }}
      - name: Checkout Repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          token: ${{ steps.token_generator.outputs.token }}
      - name: Set up Python3
        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
        with:
          python-version: "3.x"
      - name: Import GPG Key
        uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
        with:
          gpg_private_key: ${{ secrets.OURANOS_HELPER_BOT_GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.OURANOS_HELPER_BOT_GPG_PRIVATE_KEY_PASSWORD }}
          git_user_signingkey: true
          git_commit_gpgsign: true
          trust_level: 5
      - name: Current Version
        run: |
          CURRENT_VERSION="$(grep -E '__version__' src/xscen/__init__.py | cut -d ' ' -f3)"
          echo "current_version=${CURRENT_VERSION}"
          echo "CURRENT_VERSION=${CURRENT_VERSION}" >> $GITHUB_ENV
      - name: Install CI libraries
        run: |
          python -m pip install --require-hashes -r CI/requirements_ci.txt
      - name: Conditional Bump Version
        run: |
          if [[ ${{ env.CURRENT_VERSION }} =~ -dev(\.\d+)? ]]; then
            echo "Development version (ends in 'dev(\.\d+)?'), bumping 'build' version"
            bump-my-version bump build
          else
            echo "Version is stable, bumping 'patch' version"
            bump-my-version bump patch
          fi
          NEW_VERSION="$(grep -E '__version__' src/xscen/__init__.py | cut -d ' ' -f3)"
          echo "new_version=${NEW_VERSION}"
          echo "NEW_VERSION=${NEW_VERSION}" >> $GITHUB_ENV
      - name: Push Changes
        uses: ad-m/github-push-action@d91a481090679876dfc4178fef17f286781251df # v0.8.0
        with:
          force: false
          branch: ${{ github.ref }}