1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
# Auto-tag on version bump.
#
# Watches `main` and, whenever a commit lands that changes the
# top-level `version = "..."` in Cargo.toml (`[package]` for
# single-crate repos or `[workspace.package]` for workspace roots),
# creates a matching `vX.Y.Z` tag and pushes it. The tag push then
# triggers the tag-driven release workflow (cross-compile + GitHub
# Release + cargo publish for CLIs, lib publish for libs).
#
# This file is kata-managed via `pj-rust`'s template.toml
# (rendered out of `auto-tag.yml.tera`, the suffix stripped on
# the consumer side). The `.tera` suffix keeps GitHub Actions
# from running the source inside `pj-rust` itself, the same
# protection `ci.yml.tera` and `release.yml.template` use.
#
# Token: this workflow pushes the tag with `KATA_APPLY_TOKEN`
# (a PAT) rather than the default `GITHUB_TOKEN`. The default
# token would create the tag fine, but GitHub deliberately
# refuses to fire downstream workflows (release.yml) from refs
# pushed by `GITHUB_TOKEN` to prevent recursive workflow runs.
# Using the PAT — the same one `kata-apply.yml` already relies
# on for the exact same downstream-trigger reason — restores
# the tag → release.yml chain. Each consumer repo needs a
# `KATA_APPLY_TOKEN` secret set; this is documented in
# pj-base's apply-workflow notes alongside the kata-apply
# bootstrap step.
name: Auto-tag on version bump
on:
push:
branches:
permissions:
contents: write
jobs:
auto-tag:
runs-on: ubuntu-latest
steps:
# `fetch-depth: 2` so HEAD~1 (the parent commit) is in scope
# for the Cargo.toml diff. fetch-depth: 0 would also work but
# is wasteful when we only need one parent.
#
# `token: KATA_APPLY_TOKEN` makes actions/checkout persist
# the PAT as the credential the later `git push` call will
# use. Without this the tag push goes out under the default
# `GITHUB_TOKEN` and downstream workflows stay silent.
- name: Checkout
uses: actions/checkout@v7.0.1
with:
fetch-depth: 2
token: ${{ secrets.KATA_APPLY_TOKEN }}
# Extract the top-level `version = "..."` from Cargo.toml.
# Plain grep is enough: the first line matching `^version
# <optional space> = "` is the package version for both
# `[package]` (single crate) and `[workspace.package]`
# (workspace root). The whitespace tolerance is what lets
# alignment-style formatting (`version = "x"`) work
# alongside the more common `version = "x"`.
#
# `|| true` on the OLD extraction is what keeps the pipeline
# alive when HEAD~1 has no Cargo.toml (first-ever commit) OR
# the grep finds no match — without it, pipefail + set -e would
# kill the step before we get a chance to classify "no match"
# as "no previous version".
- name: Detect version bump
id: ver
shell: bash
run: |
set -euo pipefail
extract() {
grep -E '^version[[:space:]]*=[[:space:]]*"' "$1" | head -n1 | sed -E 's/.*"([^"]+)".*/\1/' || true
}
NEW=$(extract Cargo.toml)
# HEAD~1 might not have Cargo.toml (very first commit on a
# new repo) — fall back to empty string so the diff below
# still classifies it as a bump.
OLD=$(git show HEAD~1:Cargo.toml 2>/dev/null | grep -E '^version[[:space:]]*=[[:space:]]*"' | head -n1 | sed -E 's/.*"([^"]+)".*/\1/' || true)
OLD="${OLD:-}"
echo "new=$NEW" >> "$GITHUB_OUTPUT"
echo "old=$OLD" >> "$GITHUB_OUTPUT"
if [ -n "$NEW" ] && [ "$NEW" != "$OLD" ]; then
echo "bumped=true" >> "$GITHUB_OUTPUT"
echo "::notice::Detected version bump: ${OLD:-<none>} -> $NEW"
else
echo "bumped=false" >> "$GITHUB_OUTPUT"
echo "::notice::No version change ($NEW); nothing to tag."
fi
- name: Create and push tag
if: steps.ver.outputs.bumped == 'true'
shell: bash
env:
# `gh` reads this; the matching `git push` uses the PAT
# that actions/checkout persisted above. Using
# `KATA_APPLY_TOKEN` for both keeps "the tag was pushed
# by a user, not a workflow" — which is the bit GitHub
# checks before firing downstream workflows like
# release.yml.
GH_TOKEN: ${{ secrets.KATA_APPLY_TOKEN }}
run: |
set -euo pipefail
TAG="v${{ steps.ver.outputs.new }}"
# Be idempotent: if the tag already exists (e.g. someone
# ran `git tag` by hand before this workflow caught up),
# don't overwrite it — just exit successfully.
if git rev-parse --verify --quiet "refs/tags/$TAG" >/dev/null \
|| gh api "repos/${GITHUB_REPOSITORY}/git/refs/tags/$TAG" --silent 2>/dev/null; then
echo "::notice::Tag $TAG already exists; skipping."
exit 0
fi
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git tag -a "$TAG" -m "$TAG"
git push origin "$TAG"
echo "::notice::Pushed tag $TAG"