matrix-authentication-service/.github/workflows/release-bump.yaml

# Copyright 2025, 2026 Element Creations Ltd.
# Copyright 2025 New Vector Ltd.
#
# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
# Please see LICENSE files in the repository root for full details.

name: Bump the version on a release branch
on:
  workflow_dispatch:
    inputs:
      rc:
        description: "Is it a release candidate?"
        type: boolean
        default: false
      merge-back:
        description: "Should we merge back the release branch to main?"
        type: boolean
        default: true

jobs:
  compute-version:
    name: Compute the next version
    runs-on: ubuntu-24.04

    permissions:
      contents: read

    outputs:
      version: ${{ steps.next.outputs.version }}

    steps:
      - name: Fail the workflow if not on a release branch
        if: ${{ !startsWith(github.ref_name, 'release/v') }}
        run: exit 1

      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        run: rustup toolchain install

      - name: Install pnpm, Node.js and the dependencies
        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
        with:
          cache: true
          require-lockfile: true

      - name: Extract the current version
        id: current
        run: echo "version=$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[] | select(.name == "mas-cli") | .version')" >> "$GITHUB_OUTPUT"

      - name: Compute the new minor RC
        id: next
        env:
          BUMP: ${{ inputs.rc && 'prerelease' || 'patch' }}
          VERSION: ${{ steps.current.outputs.version }}
        run: echo "version=$(pnpm exec semver -i "$BUMP" --preid rc "$VERSION")" >> "$GITHUB_OUTPUT"

  tag:
    uses: ./.github/workflows/tag.yaml
    needs: [compute-version]
    with:
      version: ${{ needs.compute-version.outputs.version }}
    secrets:
      BOT_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}

  merge-back:
    uses: ./.github/workflows/merge-back.yaml
    needs: [tag]
    if: inputs.merge-back
    with:
      sha: ${{ needs.tag.outputs.sha }}
    secrets:
      BOT_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}

  update-branch:
    name: Update the release branch
    runs-on: ubuntu-24.04

    permissions:
      pull-requests: write

    needs: [tag, compute-version]
    steps:
      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          sparse-checkout: |
            .github/scripts
          persist-credentials: false

      - name: Update the release branch
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          BRANCH: "${{ github.ref_name }}"
          SHA: ${{ needs.tag.outputs.sha }}
        with:
          github-token: ${{ secrets.BOT_GITHUB_TOKEN }}
          script: |
            const script = require('./.github/scripts/update-release-branch.cjs');
            await script({ core, github, context });