gha/examples/bump-dev-version.yml at main · Morrison-Lab/gha · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
# Copy to .github/workflows/bump-dev-version.yml in your repo.
# Bumps DESCRIPTION's dev-version counter after every merge to main, and opens
# (or auto-merges) a PR to carry it in. Pairs with version-check.yml, which
# now fails a PR that touches Version: itself -- see that workflow's own
# caller stub for why. Requires Settings -> Actions -> General -> "Allow
# GitHub Actions to create and approve pull requests" (the integrated
# GITHUB_TOKEN opens the PR) and, for auto-merge, Settings -> General ->
# "Allow auto-merge".
name: Bump dev version

on:
  push:
    branches: [main]

jobs:
  bump:
    permissions:
      contents: write
      pull-requests: write
    uses: Morrison-Lab/gha/.github/workflows/bump-dev-version.yml@v2
    # Every input is optional; each is shown below at its default value.
    # To set one, delete the leading "# " from the `with:` line and from that
    # input's line. The indentation left behind is already correct.
    # with:
    #   description-path: DESCRIPTION  # default
    #   auto-merge: true               # default; set false to review by hand
    #   pr-labels: no changelog        # when check-news.yml runs on automation PRs
    secrets:
      # A PAT or App token, needed for two independent reasons:
      #   1. To push the bump commit when pr-branch is protected by a ruleset
      #      that blocks the integrated GITHUB_TOKEN. Without it, checkout and
      #      open-sync-pr fall back to GITHUB_TOKEN (the original reason -- the
      #      sibling open-sync-pr stubs document only this one).
      #   2. To let auto-merge (the default) complete when the repo has required
      #      status checks. A GITHUB_TOKEN-authored bump PR does not trigger the
      #      pull_request runs those checks need, so they never report and the
      #      merge is blocked forever. Authoring the PR with a real user's token
      #      makes its checks run. Required checks block manual merges too, so
      #      turning off auto-merge does not avoid this.
      # A fine-grained PAT needs Pull requests: Read and write in addition to
      # Contents: write; the workflow probes pull-request write access before
      # any bump work (via a POST that expects validation failure).
      # Omit the token only when neither applies: an unprotected pr-branch and
      # no required checks.
      WORKFLOW_TOKEN: ${{ secrets.WORKFLOW_TOKEN }}