spiegel_podman/.github/workflows/dev-bump.yml
Daniel Hast d97883bcc5
ci: use --sandbox for dynamically generated sed scripts
sed scripts are capable of doing file I/O and executing arbitrary
commands. The `--sandbox` option prevents this by rejecting sed commands
with such capabilities; it's good practice to use this whenever the sed
script is dynamically generated (e.g. if it involves a variable
expansion).

Also fixed an error in one sed script where `.*` had been placed outside
of the quoted string (and would therefore be subject to shell globbing),
presumably due to single-quotes having been changed to double-quotes at
some point in the past.

Signed-off-by: Daniel Hast <hast.daniel@protonmail.com>
(cherry picked from commit 3f4af378f4)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2026-06-08 15:22:46 +02:00

158 lines
6.1 KiB
YAML

name: Bump to -dev version
on:
push:
tags:
- '*'
jobs:
bump:
name: Bump to -dev
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
with:
ref: ${{ github.ref_name }}
token: ${{ secrets.PODMANBOT_TOKEN }}
- name: Bump
id: bump
run: |
ref=${{ github.ref_name }}
version=${ref#v}
if [[ $version == *-rc* ]]; then
devbump="${version%-*}-dev"
echo "::notice:: is a rc - bumping z down to $devbump"
else
arr=($(echo "$version" | tr . '\n'))
arr[2]=$((${arr[2]}+1))
devbump="$(IFS=. ; echo "${arr[*]}")-dev"
echo "::notice:: bumping z up to $devbump"
fi
sed --sandbox -i -e "s/const RawVersion = \".*\"/const RawVersion = \"${devbump}\"/g" version/rawversion/version.go
echo "devbump=$devbump" >> $GITHUB_OUTPUT
- name: Push
run: |
# Make committer the user who triggered the action, either through cutting a release or manual trigger
# GitHub gives everyone a noreply email associated with their account, use that email for the sign-off
git config --local user.name ${{ github.actor }}
git config --local user.email "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
bumpbranch="bump-${{ steps.bump.outputs.devbump }}"
git checkout -b $bumpbranch
git add version/rawversion/version.go
git commit --signoff -m "Bump Podman to v${{ steps.bump.outputs.devbump }}"
git remote add podmanbot https://github.com/podmanbot/podman
git push -f podmanbot "$bumpbranch"
- name: Check open PRs
id: checkpr
env:
GH_TOKEN: ${{ secrets.PODMANBOT_TOKEN }}
run: |
prs=$(gh pr list \
--repo ${{ github.repository }} \
--head bump-${{ steps.bump.outputs.devbump }} \
--state open \
--json title \
--jq 'length')
if ((prs > 0)); then
echo "SKIPPING: PR already exists to update from ${{ github.ref_name }}."
else
echo "prexists=false" >> "$GITHUB_OUTPUT"
fi
- name: Open PR
if: steps.checkpr.outputs.prexists == 'false'
id: pr
run: |
bumpbranch="bump-${{ steps.bump.outputs.devbump }}"
ref=${{ github.ref_name }}
base=${ref%.*}
body=$(printf '```release-note\nNone\n```\n')
gh pr create \
--title "Bump Podman to v${{ steps.bump.outputs.devbump }}" \
--body "$body" \
--head "podmanbot:$bumpbranch" \
--base "$base" \
--repo ${{ github.repository }}
env:
GH_TOKEN: ${{ secrets.PODMANBOT_TOKEN }}
mainbump:
name: Bump on main
runs-on: ubuntu-latest
env:
GH_TOKEN: ${{ github.token }}
steps:
- uses: actions/checkout@v5
with:
ref: main
token: ${{ secrets.PODMANBOT_TOKEN }}
- name: Check version on main
id: check
run: |
mainvers=`grep -P '(?<=const RawVersion = ")(\d.\d)' -o version/rawversion/version.go`
ref=${{ github.ref_name }}
releasevers=${ref#v}
if echo "${mainvers},${releasevers}" | tr ',' '\n' | sort -V -C
then
echo "bump=true" >> $GITHUB_OUTPUT
echo "Main is lower than release, so we need to bump main"
else
echo "::notice:: SKIPPING: Main is higher than release, no need to bump"
fi
- name: Bump main
id: bump
if: steps.check.outputs.bump == 'true'
run: |
ref=${{ github.ref_name }}
releasevers=${ref#v}
arr=($(echo "$releasevers" | tr . '\n'))
arr[1]=$((${arr[1]}+1))
arr[2]=0
devbump="$(IFS=. ; echo "${arr[*]}")-dev"
echo "::notice:: Bumping main to: $devbump"
sed --sandbox -i -e "s/const RawVersion = \".*\"/const RawVersion = \"${devbump}\"/g" version/rawversion/version.go
echo "devbump=$devbump" >> $GITHUB_OUTPUT
- name: Push
if: steps.check.outputs.bump == 'true'
run: |
# Make committer the user who triggered the action, either through cutting a release or manual trigger
# GitHub gisves everyone a noreply email associated with their account, use that email for the sign-off
git config --local user.name ${{ github.actor }}
git config --local user.email "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
bumpbranch="bump-main-${{ steps.bump.outputs.devbump }}"
git checkout -b $bumpbranch
git add version/rawversion/version.go
git commit --signoff -m "Bump main to v${{ steps.bump.outputs.devbump }}"
git remote add podmanbot https://github.com/podmanbot/podman
git push -f podmanbot "$bumpbranch"
- name: Check open PRs
id: checkpr
if: steps.check.outputs.bump == 'true'
env:
GH_TOKEN: ${{ secrets.PODMANBOT_TOKEN }}
run: |
prs=$(gh pr list \
--repo ${{ github.repository }} \
--head bump-main-${{ steps.bump.outputs.devbump }} \
--state open \
--json title \
--jq 'length')
if ((prs > 0)); then
echo "SKIPPING: PR already exists to update to ${{ steps.bump.outputs.devbump }}."
else
echo "prexists=false" >> "$GITHUB_OUTPUT"
fi
- name: Open PR
if: steps.check.outputs.bump == 'true' && steps.checkpr.outputs.prexists == 'false'
run: |
bumpbranch="bump-main-${{ steps.bump.outputs.devbump }}"
body=$(printf '```release-note\nNone\n```\n')
gh pr create \
--title "Bump main to v${{ steps.bump.outputs.devbump }}" \
--body "$body" \
--head "podmanbot:$bumpbranch" \
--base "main" \
--repo ${{ github.repository }}
env:
GH_TOKEN: ${{ secrets.PODMANBOT_TOKEN }}