version-check.yml

name: Version Check
on:
  pull_request:
    types: [opened, synchronize, ready_for_review]
    paths:
      - 'socketdev/**'
      - 'pyproject.toml'
      - 'uv.lock'
      # Included so a change to the check itself is exercised by its own PR.
      - '.github/workflows/version-check.yml'

permissions:
  contents: read
  pull-requests: write
  issues: write

jobs:
  check_version:
    # Skip on Dependabot PRs: they bump dependencies (touching uv.lock /
    # pyproject.toml) without bumping the package version, so the increment
    # check would always fail. Package-version bumps come from maintainer PRs.
    if: github.event.pull_request.user.login != 'dependabot[bot]'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0  # Fetch all history for all branches
          persist-credentials: false

      - name: Check version increment
        id: version_check
        run: |
          # Get version from current PR
          PR_VERSION=$(grep -o "__version__.*" socketdev/version.py | awk '{print $3}' | tr -d '"' | tr -d "'")
          echo "PR_VERSION=$PR_VERSION" >> $GITHUB_ENV

          # Get version from main branch. Read it straight out of the ref:
          # `git checkout origin/main` leaves the working tree detached on main,
          # so the uv.lock guard below ends up diffing main against itself and
          # never fires.
          MAIN_VERSION=$(git show origin/main:socketdev/version.py | grep -o "__version__.*" | awk '{print $3}' | tr -d '"' | tr -d "'")
          echo "MAIN_VERSION=$MAIN_VERSION" >> $GITHUB_ENV

          export PR_VERSION
          export MAIN_VERSION

          # Only enforce a bump when the PR actually changes shipped content.
          # This workflow sits in its own paths filter so edits to it are
          # exercised, but a CI-only change ships nothing and must not be told
          # to cut a release. The comparison still runs and reports either way.
          if git diff --name-only origin/main...HEAD \
             | grep -qE '^(socketdev/|pyproject\.toml$|uv\.lock$)'; then
            PACKAGE_CHANGED=true
          else
            PACKAGE_CHANGED=false
          fi
          export PACKAGE_CHANGED

          # Compare against the latest published PyPI release.
          python3 <<'PY'
          import json
          import os
          import urllib.request
          from packaging import version

          pr_ver = version.parse(os.environ["PR_VERSION"])
          main_ver = version.parse(os.environ["MAIN_VERSION"])

          with urllib.request.urlopen("https://pypi.org/pypi/socketdev/json") as response:
              pypi_data = json.load(response)

          published_versions = []
          for raw in pypi_data.get("releases", {}).keys():
              parsed = version.parse(raw)
              if not parsed.is_prerelease and not parsed.is_devrelease:
                  published_versions.append(parsed)

          pypi_ver = max(published_versions) if published_versions else version.parse("0.0.0")

          enforced = os.environ["PACKAGE_CHANGED"] == "true"

          def reject(message):
              print(message)
              if enforced:
                  raise SystemExit(1)
              print(
                  "ℹ️  Not enforced: this PR changes no packaged files, "
                  "so it ships nothing that needs a new version."
              )
              raise SystemExit(0)

          # The only hard requirement is that the version is ahead of what is
          # actually released. Treating main's version as a second floor breaks
          # the legitimate case where several PRs share one unreleased release:
          # the first bumps main to the new version and the rest ride it without
          # bumping again, which is what keeps them under a single changelog
          # header. Main is therefore only a floor when this PR moves the
          # version -- a change to it must go forwards, never backwards.
          if pr_ver <= pypi_ver:
              reject(
                  f"❌ Version {pr_ver} is already published on PyPI "
                  f"(latest release: {pypi_ver}). Bump it."
              )

          if pr_ver < main_ver:
              reject(
                  f"❌ Version moves backwards: main is {main_ver}, PR is {pr_ver}."
              )

          if pr_ver == main_ver:
              print(
                  f"✅ Riding main's unreleased {pr_ver} "
                  f"(latest PyPI release: {pypi_ver})."
              )
          else:
              print(
                  f"✅ Version properly incremented. "
                  f"Main: {main_ver}, PyPI: {pypi_ver}, PR: {pr_ver}"
              )
          PY

      - name: Require uv.lock update when pyproject changes
        run: |
          CHANGED_FILES="$(git diff --name-only origin/main...HEAD)"

          if echo "$CHANGED_FILES" | grep -qx 'pyproject.toml'; then
            if ! echo "$CHANGED_FILES" | grep -qx 'uv.lock'; then
              echo "❌ pyproject.toml changed, but uv.lock was not updated."
              echo "Run 'uv lock' and commit uv.lock with the version bump."
              exit 1
            fi
          fi

      - name: Manage PR Comment
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        if: always()
        env:
          MAIN_VERSION: ${{ env.MAIN_VERSION }}
          PR_VERSION: ${{ env.PR_VERSION }}
          CHECK_RESULT: ${{ steps.version_check.outcome }}
        with:
          script: |
            const success = process.env.CHECK_RESULT === 'success';
            const prNumber = context.payload.pull_request.number;
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const comments = await github.rest.issues.listComments({
              owner: owner,
              repo: repo,
              issue_number: prNumber,
            });

            const versionComment = comments.data.find(comment =>
              comment.user.type === 'Bot' &&
              comment.body.includes('Version Check')
            );

            if (versionComment) {
              if (success) {
                // Delete the warning comment if check passes
                await github.rest.issues.deleteComment({
                  owner: owner,
                  repo: repo,
                  comment_id: versionComment.id
                });
              } else {
                // Update existing warning
                await github.rest.issues.updateComment({
                  owner: owner,
                  repo: repo,
                  comment_id: versionComment.id,
                  body: `❌ **Version Check Failed**\n\nPlease increment...`
                });
              }
            } else if (!success) {
              // Create new warning comment only if check fails
              await github.rest.issues.createComment({
                owner: owner,
                repo: repo,
                issue_number: prNumber,
                body: `❌ **Version Check Failed**\n\nPlease increment...`
              });
            }