ci: guard package version bumps outside release PRs

[enyst]

Hi, I'm OpenHands-GPT-5.4.

Summary

• add a PR-only guard that blocks package version changes outside release PRs
• include openhands-agent-server in that guard alongside the other distributable packages
• add CI-script coverage for the agent-server version-bump case

Testing

• uv run pytest tests/ci_scripts/test_check_version_bumps.py
• uv run pre-commit run --files .github/scripts/check_version_bumps.py tests/ci_scripts/test_check_version_bumps.py .github/workflows/version-bump-guard.yml

---

Agent Server images for this PR

• GHCR package: https://github.com/OpenHands/agent-sdk/pkgs/container/agent-server

Variants & Base Images

Variant	Architectures	Base Image	Docs / Tags
java	amd64, arm64	eclipse-temurin:17-jdk	Link
python	amd64, arm64	nikolaik/python-nodejs:python3.13-nodejs22	Link
golang	amd64, arm64	golang:1.21-bookworm	Link

Pull (multi-arch manifest)

# Each variant is a multi-arch manifest supporting both amd64 and arm64
docker pull ghcr.io/openhands/agent-server:97247af-python

Run

docker run -it --rm \
  -p 8000:8000 \
  --name agent-server-97247af-python \
  ghcr.io/openhands/agent-server:97247af-python

All tags pushed for this build

ghcr.io/openhands/agent-server:97247af-golang-amd64
ghcr.io/openhands/agent-server:97247af-golang_tag_1.21-bookworm-amd64
ghcr.io/openhands/agent-server:97247af-golang-arm64
ghcr.io/openhands/agent-server:97247af-golang_tag_1.21-bookworm-arm64
ghcr.io/openhands/agent-server:97247af-java-amd64
ghcr.io/openhands/agent-server:97247af-eclipse-temurin_tag_17-jdk-amd64
ghcr.io/openhands/agent-server:97247af-java-arm64
ghcr.io/openhands/agent-server:97247af-eclipse-temurin_tag_17-jdk-arm64
ghcr.io/openhands/agent-server:97247af-python-amd64
ghcr.io/openhands/agent-server:97247af-nikolaik_s_python-nodejs_tag_python3.13-nodejs22-amd64
ghcr.io/openhands/agent-server:97247af-python-arm64
ghcr.io/openhands/agent-server:97247af-nikolaik_s_python-nodejs_tag_python3.13-nodejs22-arm64
ghcr.io/openhands/agent-server:97247af-golang
ghcr.io/openhands/agent-server:97247af-java
ghcr.io/openhands/agent-server:97247af-python

About Multi-Architecture Support

• Each variant tag (e.g., 97247af-python) is a multi-arch manifest supporting both amd64 and arm64
• Docker automatically pulls the correct architecture for your platform
• Individual architecture tags (e.g., 97247af-python-amd64) are also available if needed

[github-actions]

Python API breakage checks — ✅ PASSED

Result: ✅ PASSED

Action log

[github-actions]

REST API breakage checks (OpenAPI) — ❌ FAILED

Result: ❌ FAILED

⚠️ Breaking REST API changes or policy violations detected.

Log excerpt (first 1000 characters)

::error title=openhands-agent-server REST API::Breaking REST API change detected without MINOR version bump (1.14.0 -> 1.14.0).

Breaking REST API changes detected compared to baseline release:
- added '#/components/schemas/ACPAgent-Output, #/components/schemas/Agent-Output' to the '/items/anyOf[subschema #1: ConversationInfo]/agent' response property 'oneOf' list for the response status '200'
- the '/items/anyOf[subschema #1: ConversationInfo]/agent' response's property type/format changed from 'object'/'' to ''/'' for status '200'
- removed the required property '/items/anyOf[subschema #1: ConversationInfo]/agent/kind' from the response with the '200' status
- removed the required property '/items/anyOf[subschema #1: ConversationInfo]/agent/llm' from the response with the '200' status
- the 'agent' request property type/format changed from 'object'/'' to ''/''
- added '#/components/schemas/ACPAgent-Output, #/components/schemas/Agent-Output' to the 'agent' response property 'oneOf' li

Action log

[all-hands-bot]

Taste Rating: 🟢 Good taste - Clean, pragmatic CI guard

This is solid work. Straightforward implementation that solves a real problem (preventing accidental version bumps outside release PRs). The code is:

• Simple and clear - max 3 levels of nesting, well-factored functions
• Well-tested with real behavior coverage (not just mocks)
• Properly handles edge cases (multiple git ref candidates)
• No over-engineering

The error-handling pattern in find_version_changes (tracking previous_error through the loop) is slightly verbose but perfectly clear and correct.

VERDICT: ✅ Approve - Does exactly what it needs to do without unnecessary complexity.

KEY INSIGHT: Focused CI guard that eliminates a real source of release process errors with minimal code.