devstuff 2.3.0__tar.gz → 2.4.0__tar.gz

devstuff-2.4.0/.github/workflows/bump.yml

@@ -0,0 +1,180 @@
+name: Bump version
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - master
+
+# Serialize bump runs against master regardless of which PR triggered them.
+concurrency:
+  group: bump-master
+  cancel-in-progress: false
+
+jobs:
+  bump:
+    name: cz bump
+    runs-on: ubuntu-latest
+    # Only run for PRs that were actually merged, not closed unmerged.
+    # A raw `git push` — which is how this job publishes its own commit —
+    # never fires pull_request events, so there's no infinite-loop risk
+    # from this job triggering itself (unlike the old push-to-master
+    # trigger, which needed an explicit "bump:" message guard for that).
+    if: github.event.pull_request.merged == true
+    permissions:
+      contents: write
+    env:
+      # secrets can't be referenced directly in step `if:` conditions, so
+      # surface presence via an env var instead.
+      HAS_GH_PAT: ${{ secrets.GH_PAT != '' }}
+
+    steps:
+      - name: Require GH_PAT
+        # GH_PAT (a Personal Access Token with repo write scope) is required
+        # so that the tag push re-triggers publish.yml — GitHub Actions does
+        # not re-process events from pushes made with GITHUB_TOKEN. Fail loudly
+        # instead of silently pushing a tag that will never publish.
+        if: env.HAS_GH_PAT != 'true'
+        run: |
+          echo "::error::GH_PAT secret is not set. It is required so the tag push triggers publish.yml (GITHUB_TOKEN pushes are not re-processed by Actions)."
+          exit 1
+
+      - uses: actions/checkout@v4
+        with:
+          ref: master  # the merge already happened server-side by the time this runs
+          fetch-depth: 0  # commitizen needs full history to determine bump type
+          token: ${{ secrets.GH_PAT }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Run cz bump
+        id: bump
+        run: |
+          if uv run --group dev cz bump --yes; then
+            echo "bumped=true" >> "$GITHUB_OUTPUT"
+          else
+            EXIT=$?
+            if [ "$EXIT" -eq 21 ]; then
+              echo "No conventional commits found since last tag — nothing to bump."
+              echo "bumped=false" >> "$GITHUB_OUTPUT"
+            else
+              exit "$EXIT"
+            fi
+          fi
+
+      # Build-only PRs: `cz bump` exits 21 because `build` is deliberately not
+      # in bump_map (we don't want it consuming a PATCH slot from the main
+      # release line). Instead, ship a PEP 440 post-release — vX.Y.Z.postN —
+      # which is publishable to PyPI, sorts after vX.Y.Z but before the next
+      # vX.(Y+1).0, and is still recognised by `cz bump` as the current
+      # version tag (tag_format is `v$version` and `X.Y.Z.postN` is valid
+      # PEP 440), so the next regular bump stays coherent. A PR mixing `build`
+      # with feat/fix/etc. is handled by the `cz bump` path above — the build
+      # commits just fold into that release's changelog — so this step only
+      # fires when there was nothing else to release.
+      - name: Build-patch post-release
+        id: buildpatch
+        if: steps.bump.outputs.bumped == 'false'
+        run: |
+          set -euo pipefail
+
+          last_tag="$(git describe --tags --abbrev=0)"
+          commits="$(git log "${last_tag}..HEAD" --pretty=format:%s)"
+
+          # No build commits -> genuinely nothing to release.
+          if ! printf '%s\n' "$commits" | grep -qE '^build(\(.+\))?!?:'; then
+            echo "No build commits since ${last_tag} — nothing to release."
+            echo "buildpatch=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Safety net: if a higher-precedence release type slipped through,
+          # bail rather than ship a competing post-release. (cz bump exiting 21
+          # already implies this, but guard against future bump_map changes.)
+          if printf '%s\n' "$commits" | grep -qE '^(feat|fix|refactor|perf|deps)(\(.+\))?!?:'; then
+            echo "Higher-precedence release commits present alongside build — deferring to the main release track."
+            echo "buildpatch=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Current version -> release segment (strip any existing post/dev).
+          current_version="$(grep -E '^version = ' pyproject.toml | head -1 | sed -E 's/^version = "(.*)"$/\1/')"
+          base="$(printf '%s' "$current_version" | sed -E 's/(\.post[0-9]+|\.dev[0-9]+).*$//')"
+
+          # Next post number for this base (vX.Y.Z.post1, .post2, ...).
+          prev_n="$(git tag --list "v${base}.post*" | sed -E 's/^v.*\.post([0-9]+)$/\1/' | sort -n | tail -1 || true)"
+          next_n=$(( ${prev_n:-0} + 1 ))
+          new_version="${base}.post${next_n}"
+          new_tag="v${new_version}"
+
+          echo "Bumping build patch: ${current_version} -> ${new_version} (${new_tag})"
+
+          # Bump version in pyproject.toml.
+          sed -i -E "s/^version = \".*\"/version = \"${new_version}\"/" pyproject.toml
+
+          # Prepend a Build section to the changelog (matches cz's heading style).
+          date="$(date +%Y-%m-%d)"
+          build_entries="$(
+            printf '%s\n' "$commits" | grep -E '^build(\(.+\))?!?:' | while IFS= read -r subject; do
+              msg="$(printf '%s' "$subject" | sed -E 's/^build(\([^)]+\))?(!)?: //')"
+              scope="$(printf '%s' "$subject" | sed -nE 's/^build\(([^)]+)\).*/\1/p')"
+              if [ -n "$scope" ]; then
+                printf -- '- **%s**: %s\n' "$scope" "$msg"
+              else
+                printf -- '- %s\n' "$msg"
+              fi
+            done
+          )"
+          {
+            printf '## %s (%s)\n\n### Build\n\n%s\n' "$new_tag" "$date" "$build_entries"
+            cat CHANGELOG.md
+          } > CHANGELOG.md.new
+          mv CHANGELOG.md.new CHANGELOG.md
+
+          # Sync the lockfile against the new version before committing so the
+          # tag points at a single self-contained commit (no amend/retag needed).
+          uv lock
+          git add pyproject.toml CHANGELOG.md uv.lock
+          git commit -m "bump: version ${current_version} → ${new_version} (build patch)"
+          git tag -a "$new_tag" -m "$new_tag" HEAD
+
+          git push --follow-tags
+          if ! git ls-remote --exit-code --tags origin "refs/tags/${new_tag}" >/dev/null; then
+            echo "::error::${new_tag} was not found on origin after push --follow-tags (publish.yml build_patch job will not trigger)."
+            exit 1
+          fi
+
+          echo "buildpatch=true" >> "$GITHUB_OUTPUT"
+          echo "new_tag=${new_tag}" >> "$GITHUB_OUTPUT"
+
+      - name: Sync lockfile
+        if: steps.bump.outputs.bumped == 'true'
+        run: |
+          uv lock
+          git add uv.lock
+          if ! git diff --staged --quiet; then
+            # cz bump already tagged the pre-lock commit; amending moves HEAD
+            # to a new SHA, so the tag must be recreated to point at it.
+            # Must stay annotated (-a) — `git push --follow-tags` only
+            # pushes annotated tags, so a lightweight retag here would
+            # silently never reach the remote.
+            tag="$(git describe --tags --exact-match HEAD)"
+            git commit --amend --no-edit
+            git tag -f -a "$tag" -m "$tag" HEAD
+          fi
+
+      - name: Push commit and tag
+        if: steps.bump.outputs.bumped == 'true'
+        run: |
+          git push --follow-tags
+          tag="$(git describe --tags --exact-match HEAD)"
+          if ! git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null; then
+            echo "::error::${tag} was not found on origin after push --follow-tags (publish.yml will not trigger)."
+            exit 1
+          fi

devstuff-2.4.0/.github/workflows/publish.yml

@@ -0,0 +1,96 @@
+name: Publish to PyPI
+
+# A `v*` tag push triggers this workflow. Two release tracks share that
+# prefix, so they're routed by job-level `if` conditions on the tag name
+# rather than by disjoint trigger globs (GitHub Actions globs can't negate,
+# so `v*` would match both and a glob-only split would double-publish):
+#
+#   - Regular releases    vX.Y.Z          -> build / publish
+#   - Build-patch post    vX.Y.Z.postN    -> build_patch / publish_build_patch
+#
+# The post-release track exists so a PR that contains only `build`-type
+# commits still ships a publishable, PEP 440-distinct version. bump.yml
+# decides which tag to create; this file only reacts to whichever one lands.
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  build:
+    name: Build distribution
+    if: ${{ !contains(github.ref, '.post') }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Build wheel and source distribution
+        run: uv build
+
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: Publish to PyPI
+    if: ${{ !contains(github.ref, '.post') }}
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/devstuff
+    permissions:
+      id-token: write  # required for OIDC trusted publishing
+    steps:
+      - name: Download dist artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  build_patch:
+    name: Build build-patch distribution
+    if: ${{ contains(github.ref, '.post') }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Build wheel and source distribution
+        run: uv build
+
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist-build-patch
+          path: dist/
+
+  publish_build_patch:
+    name: Publish build-patch to PyPI
+    if: ${{ contains(github.ref, '.post') }}
+    needs: build_patch
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/devstuff
+    permissions:
+      id-token: write  # required for OIDC trusted publishing
+    steps:
+      - name: Download dist artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist-build-patch
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

{devstuff-2.3.0 → devstuff-2.4.0}/CHANGELOG.md

@@ -1,3 +1,9 @@
+## v2.4.0 (2026-08-20)
+
+### Features
+
+- **ci**: publish build-patch updates as PEP 440 post-releases
+
 ## v2.3.0 (2026-08-13)
 
 ### Features

{devstuff-2.3.0 → devstuff-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: devstuff
-Version: 2.3.0
+Version: 2.4.0
 Summary: Development environment setup CLI for Linux
 Project-URL: Repository, https://github.com/thesawdawg/dev-setup-py
 Author-email: Sawyer <sawyerksu@gmail.com>

{devstuff-2.3.0 → devstuff-2.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devstuff"
-version = "2.3.0"
+version = "2.4.0"
 description = "Development environment setup CLI for Linux"
 readme = "README.md"
 requires-python = ">=3.11"

{devstuff-2.3.0 → devstuff-2.4.0}/uv.lock

@@ -167,7 +167,7 @@ wheels = [
 
 [[package]]
 name = "devstuff"
-version = "2.3.0"
+version = "2.4.0"
 source = { editable = "." }
 dependencies = [
     { name = "click" },

devstuff-2.3.0/.github/workflows/bump.yml

@@ -1,95 +0,0 @@
-name: Bump version
-
-on:
-  pull_request:
-    types: [closed]
-    branches:
-      - master
-
-# Serialize bump runs against master regardless of which PR triggered them.
-concurrency:
-  group: bump-master
-  cancel-in-progress: false
-
-jobs:
-  bump:
-    name: cz bump
-    runs-on: ubuntu-latest
-    # Only run for PRs that were actually merged, not closed unmerged.
-    # A raw `git push` — which is how this job publishes its own commit —
-    # never fires pull_request events, so there's no infinite-loop risk
-    # from this job triggering itself (unlike the old push-to-master
-    # trigger, which needed an explicit "bump:" message guard for that).
-    if: github.event.pull_request.merged == true
-    permissions:
-      contents: write
-    env:
-      # secrets can't be referenced directly in step `if:` conditions, so
-      # surface presence via an env var instead.
-      HAS_GH_PAT: ${{ secrets.GH_PAT != '' }}
-
-    steps:
-      - name: Require GH_PAT
-        # GH_PAT (a Personal Access Token with repo write scope) is required
-        # so that the tag push re-triggers publish.yml — GitHub Actions does
-        # not re-process events from pushes made with GITHUB_TOKEN. Fail loudly
-        # instead of silently pushing a tag that will never publish.
-        if: env.HAS_GH_PAT != 'true'
-        run: |
-          echo "::error::GH_PAT secret is not set. It is required so the tag push triggers publish.yml (GITHUB_TOKEN pushes are not re-processed by Actions)."
-          exit 1
-
-      - uses: actions/checkout@v4
-        with:
-          ref: master  # the merge already happened server-side by the time this runs
-          fetch-depth: 0  # commitizen needs full history to determine bump type
-          token: ${{ secrets.GH_PAT }}
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v5
-
-      - name: Configure git
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-      - name: Run cz bump
-        id: bump
-        run: |
-          if uv run --group dev cz bump --yes; then
-            echo "bumped=true" >> "$GITHUB_OUTPUT"
-          else
-            EXIT=$?
-            if [ "$EXIT" -eq 21 ]; then
-              echo "No conventional commits found since last tag — nothing to bump."
-              echo "bumped=false" >> "$GITHUB_OUTPUT"
-            else
-              exit "$EXIT"
-            fi
-          fi
-
-      - name: Sync lockfile
-        if: steps.bump.outputs.bumped == 'true'
-        run: |
-          uv lock
-          git add uv.lock
-          if ! git diff --staged --quiet; then
-            # cz bump already tagged the pre-lock commit; amending moves HEAD
-            # to a new SHA, so the tag must be recreated to point at it.
-            # Must stay annotated (-a) — `git push --follow-tags` only
-            # pushes annotated tags, so a lightweight retag here would
-            # silently never reach the remote.
-            tag="$(git describe --tags --exact-match HEAD)"
-            git commit --amend --no-edit
-            git tag -f -a "$tag" -m "$tag" HEAD
-          fi
-
-      - name: Push commit and tag
-        if: steps.bump.outputs.bumped == 'true'
-        run: |
-          git push --follow-tags
-          tag="$(git describe --tags --exact-match HEAD)"
-          if ! git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null; then
-            echo "::error::${tag} was not found on origin after push --follow-tags (publish.yml will not trigger)."
-            exit 1
-          fi

devstuff-2.3.0/.github/workflows/publish.yml

@@ -1,44 +0,0 @@
-name: Publish to PyPI
-
-on:
-  push:
-    tags:
-      - "v*"
-
-jobs:
-  build:
-    name: Build distribution
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v5
-
-      - name: Build wheel and source distribution
-        run: uv build
-
-      - name: Upload dist artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist
-          path: dist/
-
-  publish:
-    name: Publish to PyPI
-    needs: build
-    runs-on: ubuntu-latest
-    environment:
-      name: pypi
-      url: https://pypi.org/p/devstuff
-    permissions:
-      id-token: write  # required for OIDC trusted publishing
-    steps:
-      - name: Download dist artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: dist
-          path: dist/
-
-      - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1