|
| 1 | +name: Version Guard |
| 2 | + |
| 3 | +# Publishing is version-gated on main, so a source change merged without a |
| 4 | +# version bump silently never ships — that is exactly how PyPI fell 3.5 weeks |
| 5 | +# behind the repo. Fail the PR instead, unless the change is deliberately |
| 6 | +# unreleased (apply the skip-version-guard label). |
| 7 | +# |
| 8 | +# Lives in its own workflow (not ci.yml) so the labeled/unlabeled trigger types |
| 9 | +# — needed for the skip label to re-evaluate without a manual re-run — don't |
| 10 | +# re-run and cancel the whole CI matrix on every label change. |
| 11 | +on: |
| 12 | + pull_request: |
| 13 | + types: [opened, synchronize, reopened, labeled, unlabeled] |
| 14 | + |
| 15 | +concurrency: |
| 16 | + group: version-guard-${{ github.ref }} |
| 17 | + cancel-in-progress: true |
| 18 | + |
| 19 | +permissions: |
| 20 | + contents: read |
| 21 | + |
| 22 | +jobs: |
| 23 | + version-guard: |
| 24 | + if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-version-guard') }} |
| 25 | + runs-on: ubuntu-latest |
| 26 | + timeout-minutes: 5 |
| 27 | + steps: |
| 28 | + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 |
| 29 | + with: |
| 30 | + persist-credentials: false |
| 31 | + # The checkout is refs/pull/N/merge — a synthetic merge commit whose |
| 32 | + # first parent is the CURRENT base tip. Depth 2 makes HEAD^1 |
| 33 | + # resolvable; comparing against it (rather than the event's |
| 34 | + # pull_request.base.sha snapshot, which goes stale as the base moves) |
| 35 | + # means a release merged to main after the PR opened still counts. |
| 36 | + fetch-depth: 2 |
| 37 | + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 |
| 38 | + with: |
| 39 | + python-version: '3.13' |
| 40 | + - name: Require a version bump when package source changes |
| 41 | + run: | |
| 42 | + set -euo pipefail |
| 43 | + changed=$(git diff --name-only HEAD^1 HEAD) |
| 44 | + fail=0 |
| 45 | +
|
| 46 | + # pyproject.toml is included: dependency/extras changes alter the |
| 47 | + # shipped artifact just like src changes do. |
| 48 | + if echo "$changed" | grep -q '^\(src/floe_guard/\|pyproject\.toml\)'; then |
| 49 | + old=$(git show "HEAD^1:pyproject.toml" | python -c "import sys,tomllib;print(tomllib.loads(sys.stdin.read())['project']['version'])") |
| 50 | + new=$(python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])") |
| 51 | + if [ "$old" = "$new" ]; then |
| 52 | + echo "::error::Python package source or packaging metadata changed but pyproject.toml version is still $new — bump it (or label the PR skip-version-guard)." |
| 53 | + fail=1 |
| 54 | + fi |
| 55 | + fi |
| 56 | +
|
| 57 | + if echo "$changed" | grep -q '^js/\(src/\|package\.json\)'; then |
| 58 | + old=$(git show "HEAD^1:js/package.json" | python -c "import sys,json;print(json.loads(sys.stdin.read())['version'])") |
| 59 | + new=$(python -c "import json;print(json.load(open('js/package.json'))['version'])") |
| 60 | + if [ "$old" = "$new" ]; then |
| 61 | + echo "::error::js package source or packaging metadata changed but js/package.json version is still $new — bump it (or label the PR skip-version-guard)." |
| 62 | + fail=1 |
| 63 | + fi |
| 64 | + fi |
| 65 | +
|
| 66 | + exit "$fail" |
0 commit comments