prepare-update-version.yaml

name: Prepare Update Version

on:
  release:
    types: [published]

jobs:
  update-version:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        
      - name: Get release version
        id: get_version
        run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
        
      - name: Verify authorized user
        env:
          AUTHORIZED_USERS: ${{ secrets.AUTHORIZED_RELEASE_USERS }}
          CURRENT_USER: ${{ github.event.release.author.login }}
        run: |
          if [[ ! ",$AUTHORIZED_USERS," == *",$CURRENT_USER,"* ]]; then
            echo "Error: User $CURRENT_USER is not authorized to create releases"
            exit 1
          fi
          echo "User $CURRENT_USER is authorized to create releases"
          
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '==3.11'
          
      - name: Update version in pyproject.toml
        run: |
          python -c "
          import re
          with open('pyproject.toml', 'r') as f:
              content = f.read()
          content = re.sub(r'version = \"[0-9.]+\"', f'version = \"{\"${{ env.VERSION }}\"}\"', content)
          with open('pyproject.toml', 'w') as f:
              f.write(content)
          "
      
      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v7
        with:
          token: ${{ secrets.PUBLISH_GITHUB_TOKEN }}
          commit-message: "build: update version to ${{ env.VERSION }}"
          title: "build: update version to ${{ env.VERSION }}"
          body: |
            This PR updates the version in pyproject.toml to match the newly created release v${{ env.VERSION }}.
            
            This PR was automatically created by the release workflow.
            IMPORTANT: Only authorized maintainers should merge this PR to maintain publishing security.
          branch: "update-version-${{ env.VERSION }}"
          base: "main"
          labels: "version-update,restricted-merge"