feat(ci): ensure exactly one version bump

Check in CI that the version of a crate has been bumped exactly once since the last release.

Based on discussion in #5781.

Pull-Request: #5804.

scripts/ensure-version-bump-and-changelog.sh

@@ -10,6 +10,9 @@ MERGE_BASE=$(git merge-base "$HEAD_SHA" "$PR_BASE") # Find the merge base. This
 SRC_DIFF_TO_BASE=$(git diff "$HEAD_SHA".."$MERGE_BASE" --name-status -- "$DIR_TO_CRATE/src" "$DIR_TO_CRATE/Cargo.toml")
 CHANGELOG_DIFF=$(git diff "$HEAD_SHA".."$MERGE_BASE" --name-only -- "$DIR_TO_CRATE/CHANGELOG.md")
 
+RELEASED_VERSION=$(git tag --sort=version:refname | grep "^$CRATE-v" | tail -n1 | grep -Po "\d+\.\d+\.\d+")
+
+
 # If the source files of this crate weren't touched in this PR, exit early.
 if [ -z "$SRC_DIFF_TO_BASE" ]; then
   exit 0;
@@ -21,8 +24,22 @@ if [ -z "$CHANGELOG_DIFF" ]; then
     exit 1
 fi
 
-# Code was touched, ensure the version used in the manifest hasn't been released yet.
-if git tag | grep -q "^$CRATE-v${CRATE_VERSION}$"; then
-    echo "v$CRATE_VERSION of '$CRATE' has already been released, please bump the version."
-    exit 1
-fi
+IFS='.' read -r -a current <<< "$CRATE_VERSION"
+IFS='.' read -r -a released <<< "$RELEASED_VERSION"
+
+for i in $(seq 0 2); 
+do
+  case $((current[i]-released[i])) in
+    0)  continue ;;
+    1)  if [[ -n $(printf "%s\n" "${current[@]:i+1}" | grep -vFx '0') ]]; then
+          echo "Patch version has been bumped even though minor isn't released yet".
+          exit 1
+        fi
+        exit 0 ;;
+    *)  echo "Version of '$CRATE' has been bumped more than once since last release v$RELEASED_VERSION."
+        exit 1 ;;
+    esac
+done
+
+echo "v$CRATE_VERSION of '$CRATE' has already been released, please bump the version."
+exit 1