version.yaml

# Copyright 2024 Chainguard, Inc.
# SPDX-License-Identifier: Apache-2.0

name: Bump Version

on:
  workflow_dispatch:
    inputs:
      update:
        description: "Semver update type (patch, minor, major)"
        required: true
        default: "minor"

permissions:
  contents: read

env:
  VERSION_FILE: "pkg/release/version.go"

jobs:
  version:
    if: ${{ github.repository == 'chainguard-dev/malcontent' }}
    runs-on: ubuntu-24.04-arm
    permissions:
      contents: write
      id-token: write
      pull-requests: write
    steps:
      - uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
        with:
          egress-policy: block
          allowed-endpoints: >
            *.blob.core.windows.net:443
            *.githubapp.com:443
            api.github.com:443
            fulcio.sigstore.dev:443
            github.com:443
            octo-sts.dev:443
            rekor.sigstore.dev:443
            release-assets.githubusercontent.com:443
            tuf-repo-cdn.sigstore.dev:443
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: chainguard-dev/actions/setup-gitsign@de68b87302e6266db5fb5220246f8aa46fe94b67
      - name: Set up Octo-STS
        uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
        id: octo-sts
        with:
          scope: chainguard-dev/malcontent
          identity: release
      - name: Update Version
        id: update
        env:
          UPDATE_TYPE: ${{ github.event.inputs.update }}
        run: |
          CURRENT_VERSION=$(awk -F'"' '/ID string =/ {print $2}' "${VERSION_FILE}")

          if [[ ! "${CURRENT_VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Error: CURRENT_VERSION is not a valid semver"
            exit 1
          fi

          IFS='.' read -ra VERSION_PARTS <<< "${CURRENT_VERSION:1}"

          case "${UPDATE_TYPE}" in
            major)
              VERSION=$(printf "v%d.0.0" $((${VERSION_PARTS[0]}+1)))
              ;;
            minor)
              VERSION=$(printf "v%s.%d.0" ${VERSION_PARTS[0]} $((${VERSION_PARTS[1]}+1)))
              ;;
            patch)
              VERSION=$(printf "v%s.%s.%d" ${VERSION_PARTS[0]} ${VERSION_PARTS[1]} $((${VERSION_PARTS[2]}+1)))
              ;;
            *)
              echo "Error: Invalid update type"
              exit 1
              ;;
          esac

          if [[ ! "${VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Error: VERSION is not a valid semver"
            exit 1
          fi

          echo "Current malcontent version: ${CURRENT_VERSION}"
          echo "New malcontent version: ${VERSION}"

          sed -i "s/ID string = \"v[0-9]*\.[0-9]*\.[0-9]*\"/ID string = \"${VERSION}\"/" "${VERSION_FILE}"

          BRANCH="malcontent-version-bump-$VERSION"
          git checkout -b "$BRANCH"
          git add "${VERSION_FILE}"
          git commit -m "Bump malcontent version to ${VERSION}"
          git push origin "${BRANCH}"

          echo "BRANCH=${BRANCH}" >> "${GITHUB_OUTPUT}"
          echo "VERSION=${VERSION}" >> "${GITHUB_OUTPUT}"
      - name: Create Pull Request
        env:
          BRANCH: ${{ steps.update.outputs.BRANCH }}
          GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
          VERSION: ${{ steps.update.outputs.VERSION }}
        run: |
          gh pr create -t "Update malcontent to ${VERSION}" -b "PR to update the version in ${VERSION_FILE} to ${VERSION}" -B main -H "${BRANCH}"