| 1 | name: Auto-tag on version bump |
| 2 | |
| 3 | # When the workspace version on `main` advances past the latest existing |
| 4 | # `vX.Y.Z` tag, push the matching tag automatically. The push then triggers |
| 5 | # `release.yml`, which runs parity, builds binaries, drafts the GitHub |
| 6 | # Release, and publishes the npm wrapper. |
| 7 | # |
| 8 | # IMPORTANT: tag pushes signed by the default `GITHUB_TOKEN` do NOT trigger |
| 9 | # downstream `on: push: tags` workflows (GitHub Actions safety rule). For |
| 10 | # this auto-tag flow to actually fire `release.yml`, store a PAT (or |
| 11 | # fine-grained token) with `contents: write` on this repo as the |
| 12 | # `RELEASE_TAG_PAT` secret. Without it, the tag is created but `release.yml` |
| 13 | # does NOT run automatically — you'd have to push the tag again manually |
| 14 | # (`git push origin v$VERSION` from a developer machine) to trigger release. |
| 15 | |
| 16 | on: |
| 17 | push: |
| 18 | branches: [main] |
| 19 | paths: |
| 20 | - 'Cargo.toml' |
| 21 | - 'npm/deepseek-tui/package.json' |
| 22 | workflow_dispatch: |
| 23 | |
| 24 | permissions: |
| 25 | contents: write |
| 26 | |
| 27 | jobs: |
| 28 | tag: |
| 29 | runs-on: ubuntu-latest |
| 30 | steps: |
| 31 | - uses: actions/checkout@v4 |
| 32 | with: |
| 33 | fetch-depth: 0 |
| 34 | # Prefer PAT so the resulting tag push triggers release.yml. |
| 35 | # Falls back to GITHUB_TOKEN, which will tag but NOT trigger. |
| 36 | token: ${{ secrets.RELEASE_TAG_PAT || github.token }} |
| 37 | |
| 38 | - name: Read workspace version |
| 39 | id: ver |
| 40 | run: | |
| 41 | v="$(grep -E '^version = "' Cargo.toml | head -n1 | sed -E 's/^version = "([^"]+)".*/\1/')" |
| 42 | if [ -z "$v" ]; then |
| 43 | echo "::error::Could not parse workspace version from Cargo.toml" >&2 |
| 44 | exit 1 |
| 45 | fi |
| 46 | echo "version=$v" >> "$GITHUB_OUTPUT" |
| 47 | echo "tag=v$v" >> "$GITHUB_OUTPUT" |
| 48 | echo "Workspace version: $v" |
| 49 | |
| 50 | - name: Check whether tag already exists |
| 51 | id: check |
| 52 | env: |
| 53 | TAG: ${{ steps.ver.outputs.tag }} |
| 54 | run: | |
| 55 | git fetch --tags --quiet |
| 56 | if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null \ |
| 57 | || git ls-remote --tags origin "refs/tags/${TAG}" | grep -q .; then |
| 58 | echo "exists=true" >> "$GITHUB_OUTPUT" |
| 59 | echo "Tag ${TAG} already exists; nothing to do." |
| 60 | else |
| 61 | echo "exists=false" >> "$GITHUB_OUTPUT" |
| 62 | echo "Tag ${TAG} does not exist; will create." |
| 63 | fi |
| 64 | |
| 65 | - name: Verify version consistency |
| 66 | if: steps.check.outputs.exists == 'false' |
| 67 | run: ./scripts/release/check-versions.sh |
| 68 | |
| 69 | - name: Create and push tag |
| 70 | if: steps.check.outputs.exists == 'false' |
| 71 | env: |
| 72 | TAG: ${{ steps.ver.outputs.tag }} |
| 73 | run: | |
| 74 | git config user.name "github-actions[bot]" |
| 75 | git config user.email "41898282+github-actions[bot]@users.noreply.github.com" |
| 76 | git tag "${TAG}" |
| 77 | git push origin "${TAG}" |
| 78 | echo "Pushed ${TAG}. release.yml should now run (requires RELEASE_TAG_PAT for trigger)." |
| 79 | |
| 80 | - name: Warn if PAT missing |
| 81 | if: steps.check.outputs.exists == 'false' && env.HAS_PAT != 'true' |
| 82 | env: |
| 83 | HAS_PAT: ${{ secrets.RELEASE_TAG_PAT != '' }} |
| 84 | run: | |
| 85 | echo "::warning::RELEASE_TAG_PAT secret is not set. The tag was pushed using GITHUB_TOKEN, which does NOT trigger release.yml. Manually re-push the tag from a developer machine, or run 'gh workflow run release.yml --ref ${{ steps.ver.outputs.tag }}'." |
| 86 |