bump.yaml

name: Bump the versions
on:
  workflow_dispatch:
    inputs:
      version:
        description: "What to bump?"
        required: true
        default: "patch"
        type: choice
        options:
          - "patch"
          - "minor"
          - "major"

concurrency:
  group: bump-version-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  bump:
    permissions:
      id-token: write # Needed to federate tokens.
    runs-on: ubuntu-latest
    steps:
      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80
        id: octo-sts
        with:
          scope: DataDog/build-plugins
          audience: dd-octo-sts
          policy: self.bump
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0 # Needed for "yarn version" to work.
          token: ${{ steps.octo-sts.outputs.token }}
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "package.json"

      - name: Install dependencies
        run: yarn install --immutable --immutable-cache
      - name: Bump version
        run: yarn version:all ${{ inputs.version }}
      - name: Add files
        run: git add .
      - name: Variables
        id: vars
        run: |
          VERSION=$(yarn info @datadog/build-plugins --json | jq -r '.children.Version')
          echo "Version: $VERSION"

          TAG_NAME="v$VERSION"
          echo "Tag name: $TAG_NAME"

          CURRENT_BRANCH_NAME="${{ github.head_ref || github.ref_name }}"
          echo "Current branch name: $CURRENT_BRANCH_NAME"

          BRANCH_NAME="bump-version-$TAG_NAME"
          echo "Branch name: $BRANCH_NAME"


          # Outputs for the next steps.
          echo "current_branch_name=$CURRENT_BRANCH_NAME" >> $GITHUB_OUTPUT
          echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
          echo "tag_name=$TAG_NAME" >> $GITHUB_OUTPUT
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Check remote refs
        run: |
          set -euo pipefail

          if git ls-remote --exit-code --heads origin "${{ steps.vars.outputs.branch_name }}" > /dev/null; then
            echo "::error::Remote branch '${{ steps.vars.outputs.branch_name }}' already exists. Delete it if this is a stale failed bump, or inspect it if another bump is in progress."
            exit 1
          fi

          if git ls-remote --exit-code --tags origin "${{ steps.vars.outputs.tag_name }}" > /dev/null; then
            echo "::error::Remote tag '${{ steps.vars.outputs.tag_name }}' already exists. Delete it only if it belongs to a failed bump run."
            exit 1
          fi

      - name: Configure git
        run: |
          # Set the git user.
          git config --global user.name 'Bumper Bot'
          git config --global user.email '200755185+dd-octo-sts[bot]@users.noreply.github.com'

      - name: Create commit
        run: |
          echo "Checking out branch ${{ steps.vars.outputs.branch_name }}..."
          git checkout -b ${{ steps.vars.outputs.branch_name }}

          echo "Committing..."
          git commit -m ${{ steps.vars.outputs.tag_name }} --no-verify
        env:
          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}

      - name: Create remote branch
        id: create-branch
        run: |
          echo "Pushing branch ${{ steps.vars.outputs.branch_name }}..."
          # The signed-commit action expects the remote branch to exist, but it
          # should recreate the local bump commit itself so GitHub verifies it.
          git push origin HEAD~1:refs/heads/${{ steps.vars.outputs.branch_name }}

          echo "created=true" >> $GITHUB_OUTPUT
        env:
          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}

      - name: Push commit
        uses: Asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897
        with:
          github-token: ${{ steps.octo-sts.outputs.token }}
          local_branch_name: ${{ steps.vars.outputs.branch_name }}
          remote_name: origin
          remote_branch_name: ${{ steps.vars.outputs.branch_name }}

      - name: Create tag
        id: create-tag
        run: |
          echo "Creating tag..."
          git tag -a ${{ steps.vars.outputs.tag_name }} -m ${{ steps.vars.outputs.tag_name }}

          echo "Pushing tag..."
          git push origin ${{ steps.vars.outputs.tag_name }}

          echo "created=true" >> $GITHUB_OUTPUT
        env:
          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}

      - name: Create PR
        run: |
          echo "Creating PR..."
          TITLE="[bot] Bump versions to \`${{ steps.vars.outputs.tag_name }}\`"
          PR_URL=$(gh pr create \
            --title "$TITLE" \
            --body "This PR bumps the package versions to \`${{ steps.vars.outputs.tag_name }}\`" \
            --base "${{ steps.vars.outputs.current_branch_name }}" \
            --head "${{ steps.vars.outputs.branch_name }}")
          OUTPUT="### PR Created\n**[$TITLE]($PR_URL)**"
          echo -e "$OUTPUT" >> $GITHUB_STEP_SUMMARY
        env:
          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}

      - name: Log bump
        if: success()
        continue-on-error: true
        run: |
          HEADERS=(
            -H "Content-Type: application/json"
            -H "X-Datadog-Origin: build-plugins"
            -H "DD-API-KEY: $DATADOG_API_KEY"
          )
          DATA="{
            \"ddsource\": \"github\",
            \"service\": \"build-plugins\",
            \"message\": \"Version bumped: ${{ steps.vars.outputs.version }}\",
            \"status\": \"success\",
            \"env\": \"production\",
            \"team\": \"language-foundations\",
            \"version\": \"${{ steps.vars.outputs.version }}\"
          }"
          URL="https://http-intake.logs.datadoghq.com/api/v2/logs"
          curl -X POST "${HEADERS[@]}" -d "$DATA" "$URL"
        env:
          DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }}

      - name: Cleanup failed bump refs
        if: failure()
        run: |
          set -euo pipefail

          if [[ "${{ steps.create-tag.outputs.created }}" == "true" ]]; then
            echo "Deleting tag ${{ steps.vars.outputs.tag_name }} created by this run..."
            git push --delete origin ${{ steps.vars.outputs.tag_name }} || true
          fi

          if [[ "${{ steps.create-branch.outputs.created }}" == "true" ]]; then
            echo "Deleting branch ${{ steps.vars.outputs.branch_name }} created by this run..."
            git push --delete origin ${{ steps.vars.outputs.branch_name }} || true
          fi
        env:
          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}