verctl 0.4.1

Stack-agnostic version PRs from Changesets-format fragments
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112

name: CI

on:
  # The Version PR is opened, then labeled. The version check reads the
  # label from the event, so adding or removing a label starts a run too.
  pull_request:
    types: [opened, synchronize, reopened, labeled, unlabeled]
  push:
    branches: [main]

permissions:
  contents: read

env:
  GIT_CONFIG_COUNT: "1"
  GIT_CONFIG_KEY_0: init.defaultBranch
  GIT_CONFIG_VALUE_0: main
  CARGO_TERM_COLOR: always
  MISE_ENV: ci

concurrency:
  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref_name }}-${{ github.event.pull_request.base.sha || github.sha }}
  cancel-in-progress: true

jobs:
  # runs-on must be known before a job exists, so the machine cannot come
  # from a tool running inside that job. This reads [ci] and hands
  # the labels down, the same bootstrap the publish lane uses for assets.
  #
  # examples/workflows/ci.yml plans with the released tarball and needs no
  # compiler. This one builds the verctl it plans with: `mise run ver` runs
  # this checkout, so a new verb plans its own pull request.
  plan:
    name: Plan
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.plan.outputs.matrix }}
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up mise
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.10.3
          cache: true
      - run: mise install --locked
      - name: Cache builds with mbx
        uses: jdx/mr-boxington-action@9df1d4b18b2147788a7ee7a2c7b84ecf62fd89d3 # v1.5.0
      - name: Plan validation jobs
        id: plan
        run: mise run ver ci --github-output "$GITHUB_OUTPUT"

  verify:
    name: ${{ matrix.name }}
    needs: plan
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.plan.outputs.matrix) }}
    runs-on: ${{ matrix.labels }}
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - name: Set up mise
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.10.3
          cache: true
      - run: mise install --locked
      - name: Cache builds with mbx
        uses: jdx/mr-boxington-action@9df1d4b18b2147788a7ee7a2c7b84ecf62fd89d3 # v1.5.0
      - name: Verify
        run: mise run verify
      - name: Advisories
        run: mise run deny:advisories
      # next carries the next minor release's breaking changes while
      # Cargo.toml still names the last release, so the check would read them
      # as a patch. It skips pull requests into next and the one that merges
      # this repository's next into main; the Version PR that follows bumps the
      # minor, and every later pull request into main checks against that
      # release. Pushes skip it: every change reaches main through a pull
      # request that already ran it, and the push of the next merge would fail.
      - name: Semver
        if: >-
          github.event_name == 'pull_request'
          && github.base_ref != 'next'
          && !(github.head_ref == 'next'
          && github.event.pull_request.head.repo.full_name == github.repository)
        run: mise run semver

  template:
    name: Template
    # A pull request from a fork gets no secrets and cannot read the private
    # template, so the check is skipped there instead of failing.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # Mints a token from the vsh-templates-reader App, installs only uv and
      # python, and fails when the newest template tag would change a file.
      - name: Check the template version
        uses: victor-software-house/ctl-core/.github/actions/copier-check@6db8b6422ea7b1fca93304407800d984d4fae0c7 # main, 2026-10-12
        with:
          client-id: ${{ secrets.TEMPLATES_APP_CLIENT_ID }}
          private-key: ${{ secrets.TEMPLATES_APP_PRIVATE_KEY }}