bump_version.yml

# This workflow is called by the start release workflow to bump this
# repo's semgrep version to the newly release version; triggered by
# the start-release workflow.

jobs:
  bump-version:
    runs-on: ubuntu-latest
    permissions: {}
    env:
      NEW_SEMGREP_VERSION: ${{ inputs.version }}
    steps:
      - id: token
        name: Get token for semgrep-ci GitHub App
        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        with:
          client-id: ${{ secrets.SEMGREP_CI_CLIENT_ID }}
          private-key: ${{ secrets.SEMGREP_CI_APP_KEY }}
          repositories: pre-commit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Bump version in this repo
        run: scripts/bump-version.sh "${NEW_SEMGREP_VERSION}"

      - name: Open bump-version PR
        id: cpr
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          token: ${{ steps.token.outputs.token }}
          branch: "gha/bump-version-${{ inputs.version }}-${{ github.run_id }}-${{ github.run_attempt }}"
          base: ${{ github.event.repository.default_branch }}
          title: "chore: update pre-commit to semgrep ${{ inputs.version }}"
          body: "Bump Semgrep Version to ${{ inputs.version }}"
          commit-message: "Bump setup to ${{ inputs.version }}"
          sign-commits: true

      - name: Tag release on bump branch
        if: steps.cpr.outputs.pull-request-operation != 'none'
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
          SHA: ${{ steps.cpr.outputs.pull-request-head-sha }}
        run: |
          gh api -X POST "repos/${{ github.repository }}/git/refs" \
            -f ref="refs/tags/v${NEW_SEMGREP_VERSION}" \
            -f sha="${SHA}"

name: bump-version
on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version of semgrep to use"
        required: true
        type: string