Floor the version check at the published release, not main #173

Workflow file for this run

.github/workflows/version-check.yml at f3f9853

	name: Version Check
	on:
	pull_request:
	types: [opened, synchronize, ready_for_review]
	paths:
	- 'socketdev/**'
	- 'pyproject.toml'
	- 'uv.lock'
	# Included so a change to the check itself is exercised by its own PR.
	- '.github/workflows/version-check.yml'

	permissions:
	contents: read
	pull-requests: write
	issues: write

	jobs:
	check_version:
	# Skip on Dependabot PRs: they bump dependencies (touching uv.lock /
	# pyproject.toml) without bumping the package version, so the increment
	# check would always fail. Package-version bumps come from maintainer PRs.
	if: github.event.pull_request.user.login != 'dependabot[bot]'
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	fetch-depth: 0 # Fetch all history for all branches
	persist-credentials: false

	- name: Check version increment
	id: version_check
	run: \|
	# Get version from current PR
	PR_VERSION=$(grep -o "__version__.*" socketdev/version.py \| awk '{print $3}' \| tr -d '"' \| tr -d "'")
	echo "PR_VERSION=$PR_VERSION" >> $GITHUB_ENV

	# Get version from main branch. Read it straight out of the ref:
	# `git checkout origin/main` leaves the working tree detached on main,
	# so the uv.lock guard below ends up diffing main against itself and
	# never fires.
	MAIN_VERSION=$(git show origin/main:socketdev/version.py \| grep -o "__version__.*" \| awk '{print $3}' \| tr -d '"' \| tr -d "'")
	echo "MAIN_VERSION=$MAIN_VERSION" >> $GITHUB_ENV

	export PR_VERSION
	export MAIN_VERSION

	# Only enforce a bump when the PR actually changes shipped content.
	# This workflow sits in its own paths filter so edits to it are
	# exercised, but a CI-only change ships nothing and must not be told
	# to cut a release. The comparison still runs and reports either way.
	if git diff --name-only origin/main...HEAD \
	\| grep -qE '^(socketdev/\|pyproject\.toml$\|uv\.lock$)'; then
	PACKAGE_CHANGED=true
	else
	PACKAGE_CHANGED=false
	fi
	export PACKAGE_CHANGED

	# Compare against the latest published PyPI release.
	python3 <<'PY'
	import json
	import os
	import urllib.request
	from packaging import version

	pr_ver = version.parse(os.environ["PR_VERSION"])
	main_ver = version.parse(os.environ["MAIN_VERSION"])

	with urllib.request.urlopen("https://pypi.org/pypi/socketdev/json") as response:
	pypi_data = json.load(response)

	published_versions = []
	for raw in pypi_data.get("releases", {}).keys():
	parsed = version.parse(raw)
	if not parsed.is_prerelease and not parsed.is_devrelease:
	published_versions.append(parsed)

	pypi_ver = max(published_versions) if published_versions else version.parse("0.0.0")

	enforced = os.environ["PACKAGE_CHANGED"] == "true"

	def reject(message):
	print(message)
	if enforced:
	raise SystemExit(1)
	print(
	"ℹ️ Not enforced: this PR changes no packaged files, "
	"so it ships nothing that needs a new version."
	)
	raise SystemExit(0)

	# The only hard requirement is that the version is ahead of what is
	# actually released. Treating main's version as a second floor breaks
	# the legitimate case where several PRs share one unreleased release:
	# the first bumps main to the new version and the rest ride it without
	# bumping again, which is what keeps them under a single changelog
	# header. Main is therefore only a floor when this PR moves the
	# version -- a change to it must go forwards, never backwards.
	if pr_ver <= pypi_ver:
	reject(
	f"❌ Version {pr_ver} is already published on PyPI "
	f"(latest release: {pypi_ver}). Bump it."
	)

	if pr_ver < main_ver:
	reject(
	f"❌ Version moves backwards: main is {main_ver}, PR is {pr_ver}."
	)

	if pr_ver == main_ver:
	print(
	f"✅ Riding main's unreleased {pr_ver} "
	f"(latest PyPI release: {pypi_ver})."
	)
	else:
	print(
	f"✅ Version properly incremented. "
	f"Main: {main_ver}, PyPI: {pypi_ver}, PR: {pr_ver}"
	)
	PY

	- name: Require uv.lock update when pyproject changes
	run: \|
	CHANGED_FILES="$(git diff --name-only origin/main...HEAD)"

	if echo "$CHANGED_FILES" \| grep -qx 'pyproject.toml'; then
	if ! echo "$CHANGED_FILES" \| grep -qx 'uv.lock'; then
	echo "❌ pyproject.toml changed, but uv.lock was not updated."
	echo "Run 'uv lock' and commit uv.lock with the version bump."
	exit 1
	fi
	fi

	- name: Manage PR Comment
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	if: always()
	env:
	MAIN_VERSION: ${{ env.MAIN_VERSION }}
	PR_VERSION: ${{ env.PR_VERSION }}
	CHECK_RESULT: ${{ steps.version_check.outcome }}
	with:
	script: \|
	const success = process.env.CHECK_RESULT === 'success';
	const prNumber = context.payload.pull_request.number;
	const owner = context.repo.owner;
	const repo = context.repo.repo;
	const comments = await github.rest.issues.listComments({
	owner: owner,
	repo: repo,
	issue_number: prNumber,
	});

	const versionComment = comments.data.find(comment =>
	comment.user.type === 'Bot' &&
	comment.body.includes('Version Check')
	);

	if (versionComment) {
	if (success) {
	// Delete the warning comment if check passes
	await github.rest.issues.deleteComment({
	owner: owner,
	repo: repo,
	comment_id: versionComment.id
	});
	} else {
	// Update existing warning
	await github.rest.issues.updateComment({
	owner: owner,
	repo: repo,
	comment_id: versionComment.id,
	body: `❌ Version Check Failed\n\nPlease increment...`
	});
	}
	} else if (!success) {
	// Create new warning comment only if check fails
	await github.rest.issues.createComment({
	owner: owner,
	repo: repo,
	issue_number: prNumber,
	body: `❌ Version Check Failed\n\nPlease increment...`
	});
	}

Navigation Menu

Uh oh!

Floor the version check at the published release, not main #173

Workflow file

Floor the version check at the published release, not main #173

Uh oh!

Workflow file for this run