bump-version #95
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow is called by the start release workflow to bump this | |
| # repo's semgrep version to the newly release version; triggered by | |
| # the start-release workflow. | |
| jobs: | |
| bump-version: | |
| runs-on: ubuntu-latest | |
| permissions: {} | |
| env: | |
| NEW_SEMGREP_VERSION: ${{ inputs.version }} | |
| steps: | |
| - id: token | |
| name: Get token for semgrep-ci GitHub App | |
| uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 | |
| with: | |
| client-id: ${{ secrets.SEMGREP_CI_CLIENT_ID }} | |
| private-key: ${{ secrets.SEMGREP_CI_APP_KEY }} | |
| repositories: pre-commit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Bump version in this repo | |
| run: scripts/bump-version.sh "${NEW_SEMGREP_VERSION}" | |
| - name: Open bump-version PR | |
| id: cpr | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 | |
| with: | |
| token: ${{ steps.token.outputs.token }} | |
| branch: "gha/bump-version-${{ inputs.version }}-${{ github.run_id }}-${{ github.run_attempt }}" | |
| base: ${{ github.event.repository.default_branch }} | |
| title: "chore: update pre-commit to semgrep ${{ inputs.version }}" | |
| body: "Bump Semgrep Version to ${{ inputs.version }}" | |
| commit-message: "Bump setup to ${{ inputs.version }}" | |
| sign-commits: true | |
| - name: Tag release on bump branch | |
| if: steps.cpr.outputs.pull-request-operation != 'none' | |
| env: | |
| GH_TOKEN: ${{ steps.token.outputs.token }} | |
| SHA: ${{ steps.cpr.outputs.pull-request-head-sha }} | |
| run: | | |
| gh api -X POST "repos/${{ github.repository }}/git/refs" \ | |
| -f ref="refs/tags/v${NEW_SEMGREP_VERSION}" \ | |
| -f sha="${SHA}" | |
| name: bump-version | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: "Version of semgrep to use" | |
| required: true | |
| type: string |