bump-version.yml

name: Bump Patch Version

on:
  push:
    branches:
      - main
    paths-ignore:
      - .cruft.json
      - .editorconfig
      - .flake8
      - .github/**.yml
      - .gitignore
      - .gitlab-ci.yml
      - .gitmodules
      - .pre-commit-config.yaml
      - .secrets.baseline
      - .yamllint.yaml
      - AUTHORS.rst
      - CHANGELOG.rst
      - CI/**/*.in
      - CI/**/*.py
      - CI/**/*.txt
      - CODE_OF_CONDUCT.md
      - CONTRIBUTING.rst
      - MANIFEST.in
      - Makefile
      - conda/xscen/*.yaml
      - docs/*.py
      - docs/*.rst
      - docs/notebooks
      - environment-dev.yml
      - environment.yml
      - pyproject.toml
      - src/xscen/__init__.py
      - templates
      - tests/*.py
      - tox.ini

permissions:
  contents: read

jobs:
  bump_patch_version:
    name: Bump Patch Version
    runs-on: ubuntu-latest
    permissions:
      actions: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
      - name: Generate App Token
        id: token_generator
        uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
        with:
          app-id: ${{ secrets.OURANOS_HELPER_BOT_ID }}
          private-key: ${{ secrets.OURANOS_HELPER_BOT_KEY }}
      - name: Checkout Repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          token: ${{ steps.token_generator.outputs.token }}
          persist-credentials: false
      - name: Set up Python3
        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
        with:
          python-version: "3.x"
      - name: Import GPG Key
        uses: crazy-max/ghaction-import-gpg@cb9bde2e2525e640591a934b1fd28eef1dcaf5e5 # v6.2.0
        with:
          gpg_private_key: ${{ secrets.OURANOS_HELPER_BOT_GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.OURANOS_HELPER_BOT_GPG_PRIVATE_KEY_PASSWORD }}
          git_user_signingkey: true
          git_commit_gpgsign: true
          trust_level: 5
      - name: Install CI libraries
        run: |
          python -m pip install --require-hashes -r CI/requirements_ci.txt
      - name: Conditional Bump Version
        run: |
          CURRENT_VERSION=$(bump-my-version show current_version)
          if [[ ${CURRENT_VERSION} =~ -dev(\.\d+)? ]]; then
            echo "Development version (ends in 'dev(\.\d+)?'), bumping 'build' version"
            bump-my-version bump build
          else
            echo "Version is stable, bumping 'patch' version"
            bump-my-version bump patch
          fi
          echo "new_version=$(bump-my-version show current_version)"
      - name: Push Changes
        uses: ad-m/github-push-action@d91a481090679876dfc4178fef17f286781251df # v0.8.0
        with:
          branch: ${{ github.ref }}
          force: false
          github_token: ${{ steps.token_generator.outputs.token }}