matrix-authentication-service/.github/workflows/release.yaml

name: Trigger a release
on:
  workflow_dispatch:
    secrets:
      BOT_GITHUB_TOKEN:
        required: true
    inputs:
      bump:
        type: choice
        description: "What semver bump to use for the release"
        required: true
        options:
          - "prerelease"
          - "premajor"
          - "preminor"
          - "major"
          - "minor"
          - "patch"
        default: "minor"


jobs:
  set-version:
    name: Bump version and push a tag
    runs-on: ubuntu-22.04
    permissions:
      contents: write

    steps:
      - name: Checkout the code
        uses: actions/checkout@v4.1.5

      - name: Install Rust toolchain
        run: |
          rustup toolchain install stable
          rustup default stable

      - name: Extract the current version
        id: current
        run: echo "version=$(cargo metadata --format-version 1 | jq -r '.packages[] | select(.name == "mas-cli") | .version')" >> "$GITHUB_OUTPUT"

      - name: Compute the new version
        id: next
        run: echo "version=$(npx --yes semver@7.5.4 -i "${{ github.event.inputs.bump }}" --preid rc "${{ steps.current.outputs.version }}")" >> "$GITHUB_OUTPUT"

      - name: Set the crates version
        run: |
          sed -i "s/^package.version = .*/package.version = \"${{ steps.next.outputs.version }}\"/" Cargo.toml
          sed -i "/path = \".\/crates\//s/version = \".*\"/version = \"=${{ steps.next.outputs.version }}\"/" Cargo.toml

      - name: Run `cargo metadata` to make sure the lockfile is up to date
        run: cargo metadata --format-version 1

      - name: Set the tools/syn2mas version
        working-directory: tools/syn2mas
        run: npm version "${{ steps.next.outputs.version }}" --no-git-tag-version

      - name: Commit and tag using the GitHub API
        uses: actions/github-script@v7.0.1
        id: commit
        env:
          VERSION: ${{ steps.next.outputs.version }}
        with:
          result-encoding: string
          # Commit & tag with the actions token, so that they get signed
          script: |
            const fs = require("fs/promises");
            const [owner, repo] = process.env.GITHUB_REPOSITORY.split("/");
            const version = process.env.VERSION;
            const parent = context.sha;

            const files = [
              "Cargo.toml",
              "Cargo.lock",
              "tools/syn2mas/package.json",
              "tools/syn2mas/package-lock.json",
            ];

            const tree = [];
            for (const file of files) {
              const content = await fs.readFile(file);
              const blob = await github.rest.git.createBlob({
                owner,
                repo,
                content: content.toString("base64"),
                encoding: "base64",
              });
              console.log(`Created blob for ${file}:`, blob.data.url);

              tree.push({
                path: file,
                mode: "100644",
                type: "blob",
                sha: blob.data.sha,
              });
            }

            const treeObject = await github.rest.git.createTree({
              owner,
              repo,
              tree,
              base_tree: parent,
            });
            console.log("Created tree:", treeObject.data.url);

            const commit = await github.rest.git.createCommit({
              owner,
              repo,
              message: version,
              parents: [parent],
              tree: treeObject.data.sha,
            });
            console.log("Created commit:", commit.data.url);

            const tag = await github.rest.git.createTag({
              owner,
              repo,
              tag: `v${version}`,
              message: version,
              type: "commit",
              object: commit.data.sha,
            });
            console.log("Created tag:", tag.data.url);

            return commit.data.sha;

      - name: Update the refs
        uses: actions/github-script@v7.0.1
        env:
          VERSION: ${{ steps.next.outputs.version }}
          COMMIT: ${{ steps.commit.outputs.result }}
        with:
          # Update the refs with the bot token, so that workflows are triggered
          github-token: ${{ secrets.BOT_GITHUB_TOKEN }}
          script: |
            const [owner, repo] = process.env.GITHUB_REPOSITORY.split("/");
            const version = process.env.VERSION;
            const commit = process.env.COMMIT;
            const branch = process.env.GITHUB_REF_NAME;

            const tag = await github.rest.git.createRef({
              owner,
              repo,
              ref: `refs/tags/v${version}`,
              sha: commit,
            });
            console.log("Created tag ref:", tag.data.url);

            const ref = await github.rest.git.updateRef({
              owner,
              repo,
              ref: `heads/${branch}`,
              sha: commit,
            });
            console.log("Updated branch ref:", ref.data.url);