This repository was archived by the owner on Sep 18, 2026. It is now read-only.
chore: sync VERSION file to 2.1.1 #164
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Version Bump | |
| on: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: write | |
| jobs: | |
| version-bump: | |
| runs-on: ubuntu-latest | |
| # Only run if commit is not from semantic-release itself | |
| if: "!contains(github.event.head_commit.message, 'chore(release):')" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ secrets.VERSION_BUMP_TOKEN }} | |
| # Without this, actions/checkout leaves a VERSION_BUMP_TOKEN | |
| # credential header behind in a $RUNNER_TEMP config file that the | |
| # checkout pulls in via `includeIf` - readable off disk for the rest | |
| # of the job by the pip install below and everything it pulls in. | |
| # That token can push to main. The steps that push take the token | |
| # from the environment instead. | |
| persist-credentials: false | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.12' | |
| # Pinned: an unpinned `pip install` takes the highest version on PyPI, so | |
| # a compromised release would land in this job - which holds a token that | |
| # can push to main - as soon as it was published. PyPI does not allow | |
| # re-uploading an existing version, so an exact pin closes that window. | |
| # It pins the top-level package only; the transitive dependencies are | |
| # still resolved at install time. Bump deliberately - including if 10.6.1 | |
| # is ever yanked, because an exact pin installs a yanked version anyway. | |
| - name: Install python-semantic-release | |
| run: pip install 'python-semantic-release==10.6.1' | |
| - name: Configure Git | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| # semantic-release authenticates itself: it builds a push URL from | |
| # GITHUB_SERVER_URL, GITHUB_ACTOR, GITHUB_REPOSITORY and GH_TOKEN and uses | |
| # that both to check the upstream has not moved and to push the release | |
| # commit and tag. The origin remote only has to exist - it does not have | |
| # to carry credentials. | |
| - name: Semantic Release | |
| env: | |
| GH_TOKEN: ${{ secrets.VERSION_BUMP_TOKEN }} | |
| run: | | |
| # Run semantic-release (it handles version bump, commit, tag, and push) | |
| semantic-release version | |
| # Last step in the job, and the only one left that needs push rights. | |
| # Keep the credential inline on the push rather than storing it with | |
| # `git remote set-url`: that way it is exposed for the length of one | |
| # command instead of sitting in .git/config on disk. | |
| - name: Sync VERSION file | |
| env: | |
| GH_TOKEN: ${{ secrets.VERSION_BUMP_TOKEN }} | |
| run: | | |
| # Sync VERSION file with pyproject.toml version | |
| VERSION=$(grep -oP 'version = "\K[^"]+' pyproject.toml | head -1) | |
| if [ "$(cat VERSION)" != "$VERSION" ]; then | |
| echo "$VERSION" > VERSION | |
| git add VERSION | |
| git commit -m "chore: sync VERSION file to $VERSION" | |
| git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:main | |
| fi |