sync-manifest-version.yml

name: Sync manifest version from tag

on:
  push:
    tags:
      - 'v*.*.*'

concurrency:
  group: sync-manifest-version
  cancel-in-progress: true

permissions:
  contents: write

jobs:
  sync:
    name: Sync manifest.json version to release tag
    runs-on: ubuntu-latest
    environment: release
    steps:
      - name: Verify PUSH_TOKEN is configured
        env:
          TOKEN_SET: ${{ secrets.PUSH_TOKEN != '' }}
        run: |
          if [ "$TOKEN_SET" != "true" ]; then
            echo "::error::PUSH_TOKEN secret is not set in the 'release' environment. Create a PAT with 'contents:write' from an account that can bypass the main branch ruleset, and add it as PUSH_TOKEN to the 'release' environment."
            exit 1
          fi

      - name: Checkout main
        uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0
          token: ${{ secrets.PUSH_TOKEN }}

      - name: Verify tag commit is in main history
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          TAG_COMMIT=$(git rev-list -n 1 "refs/tags/${TAG_NAME}")
          if ! git merge-base --is-ancestor "$TAG_COMMIT" HEAD; then
            echo "Tag ${TAG_NAME} (${TAG_COMMIT}) is not an ancestor of main; refusing to sync manifest."
            exit 1
          fi

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.13'

      - name: Install packaging
        run: python -m pip install --quiet packaging

      - name: Update manifest.json version
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          VERSION="${TAG_NAME#v}"
          MANIFEST="custom_components/unifi_network_rules/manifest.json"

          python3 - "$MANIFEST" "$VERSION" <<'PY'
          import json, re, sys
          from packaging.version import InvalidVersion, Version

          path, new = sys.argv[1], sys.argv[2]
          with open(path) as f:
              text = f.read()
          current = json.loads(text)["version"]

          try:
              if Version(new) <= Version(current):
                  print(f"manifest.json version {current} is already >= tag {new}; skipping")
                  sys.exit(0)
          except InvalidVersion as err:
              print(f"Unable to compare versions ({err}); refusing to update")
              sys.exit(1)

          updated, n = re.subn(
              r'("version"\s*:\s*")[^"]+(")',
              lambda m: m.group(1) + new + m.group(2),
              text,
              count=1,
          )
          if n != 1:
              print("Could not locate version field in manifest.json")
              sys.exit(1)
          with open(path, "w") as f:
              f.write(updated)
          print(f"manifest.json: {current} -> {new}")
          PY

      - name: Commit and push if changed
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          git add custom_components/unifi_network_rules/manifest.json

          if git diff --cached --quiet; then
            echo "No version changes to commit"
            exit 0
          fi

          git commit -m "chore(release): sync manifest.json to ${TAG_NAME} [skip ci]"
          git push