groupoid 0.1.0.dev5__tar.gz → 0.1.0.dev6__tar.gz

{groupoid-0.1.0.dev5 → groupoid-0.1.0.dev6}/.github/workflows/auto-tag-release.yml

@@ -23,17 +23,23 @@ name: Auto Tag Release
 # missing, so a pre-existing manual tag always takes precedence and this
 # workflow becomes a no-op for that version.
 
+# Tag only a main commit whose CI run succeeded. The tag-exists check below
+# keeps this idempotent for CI runs on commits that did not bump the version.
 on:
-  push:
-    branches: [main]
-    paths:
-      - pyproject.toml
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
 
 permissions:
   contents: read
 
 jobs:
   tag:
+    if: >-
+      ${{ github.event.workflow_run.conclusion == 'success' &&
+          github.event.workflow_run.event == 'push' &&
+          github.event.workflow_run.head_branch == 'main' &&
+          github.event.workflow_run.head_repository.full_name == github.repository }}
     runs-on: ubuntu-latest
     permissions:
       contents: write   # push the tag
@@ -41,14 +47,26 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
+          ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0   # need full tag history to check for an existing tag
 
       - name: Create the release tag if this version doesn't have one yet, and dispatch the release
         env:
           GH_TOKEN: ${{ github.token }}
+          CI_SHA: ${{ github.event.workflow_run.head_sha }}
         run: |
           set -euo pipefail
 
+          # Tag only the exact commit that passed CI, and only while it is
+          # still the head of main.
+          ci_sha="${CI_SHA}"
+          [ "$(git rev-parse HEAD)" = "${ci_sha}" ]
+          main_sha="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/main" --jq .object.sha)"
+          if [ "${main_sha}" != "${ci_sha}" ]; then
+            echo "main advanced past ${ci_sha}; the newer head's CI run decides."
+            exit 0
+          fi
+
           version=$(grep -m1 '^version = "' pyproject.toml | sed -E 's/version = "(.*)"/\1/')
           if [ -z "${version}" ]; then
             echo "::error::could not extract a version from pyproject.toml"
@@ -60,7 +78,7 @@ jobs:
           # anything else. A version that doesn't match this is presumably
           # intentional and unusual enough to want a human tagging it by
           # hand rather than this automation guessing.
-          if ! echo "${version}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(\.dev[0-9]+|a[0-9]+|b[0-9]+|rc[0-9]+)?$'; then
+          if ! echo "${version}" | grep -Eq '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(\.dev(0|[1-9][0-9]*)|a(0|[1-9][0-9]*)|b(0|[1-9][0-9]*)|rc(0|[1-9][0-9]*))?$'; then
             echo "::error::version '${version}' is not a recognized release format (expected X.Y.Z, optionally with .devN/aN/bN/rcN, no local metadata); refusing to tag automatically. Tag it manually if this is intentional."
             exit 1
           fi

{groupoid-0.1.0.dev5 → groupoid-0.1.0.dev6}/.github/workflows/docs-deploy.yml

@@ -42,4 +42,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5