fix(bump): Schutz vor Doppel-Tags nur für Tags derselben Art (#5)

Der Schutz „Commit trägt schon ein v-Tag, nichts tun“ zählt jetzt nur Tags derselben Art (dev, beta, stabil). Vorher hätte ein dev-Tag nach einem Fast-Forward-Merge in `release/*` das Beta-Tag und damit Build und Deploy nach beta verhindert.

Getestet im lokalen Harness: Feature vom Release-Head taggen, Fast-Forward nach `release/2.4`, Lauf auf release ergibt `v2.4.1-beta.2` auf demselben Commit; erneuter Lauf tut nichts. Release als `bump-v2.0.1`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #5

.github/actions/build-and-push-dotnet/action.yaml

@@ -0,0 +1,114 @@
+name: Build and Push Docker Image (dotnet)
+description: Build a Docker image and push to a registry (dotnet)
+inputs:
+  registry:
+    description: Container registry hostname
+    required: true
+  image_name:
+    description: Full image name including registry
+    required: false
+    default: ""
+  tag:
+    description: Override image tag (defaults to standard tags)
+    required: false
+    default: ""
+  checkout_ref:
+    description: Git ref to checkout before build (e.g. refs/tags/v1.2.3)
+    required: false
+    default: ""
+  dockerfile:
+    description: Path to Dockerfile
+    required: false
+    default: Dockerfile
+  context:
+    description: Build context
+    required: false
+    default: .
+  push:
+    description: Push image after build
+    required: false
+    default: "true"
+  registry_username:
+    description: Registry username
+    required: true
+  registry_password:
+    description: Registry password or token
+    required: true
+  build_args:
+    description: Optional build args (newline-separated KEY=VALUE)
+    required: false
+    default: ""
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+        fetch-tags: true
+        ref: ${{ inputs.checkout_ref != '' && inputs.checkout_ref || '' }}
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Resolve image name
+      shell: bash
+      env:
+        REGISTRY: ${{ inputs.registry }}
+        IMAGE_NAME: ${{ inputs.image_name }}
+        REPO: ${{ gitea.repository != '' && gitea.repository || github.repository }}
+      run: |
+        if [ -z "${IMAGE_NAME}" ]; then
+          IMAGE_NAME="${REGISTRY}/${REPO}"
+        fi
+        echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"
+
+    - name: Log in to container registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ inputs.registry }}
+        username: ${{ inputs.registry_username }}
+        password: ${{ inputs.registry_password }}
+
+    - name: Validate registry configuration
+      shell: bash
+      env:
+        REGISTRY: ${{ inputs.registry }}
+      run: |
+        if [ -z "${REGISTRY}" ]; then
+          echo "::error::REGISTRY input is missing or empty"
+          exit 1
+        fi
+        if [ -z "${IMAGE_NAME}" ] || [[ "${IMAGE_NAME}" == */ ]]; then
+          echo "::error::IMAGE_NAME is empty or malformed (resolved to '${IMAGE_NAME}')"
+          exit 1
+        fi
+
+    - name: Derive image metadata
+      id: vars
+      shell: bash
+      env:
+        IMAGE_NAME: ${{ env.IMAGE_NAME }}
+        TAG_INPUT: ${{ inputs.tag }}
+      run: |
+        bash "${GITHUB_ACTION_PATH}/../shared/derive-image-metadata.sh"
+
+    - name: Show build summary
+      shell: bash
+      env:
+        IMAGE_NAME: ${{ env.IMAGE_NAME }}
+      run: |
+        echo "Commit: ${GITHUB_SHA:-${GITEA_SHA}}"
+        echo "Image:  ${IMAGE_NAME}"
+        echo "Tags:"
+        printf '%s\n' "${{ steps.vars.outputs.tags }}"
+        echo "Deploy target: ${{ steps.vars.outputs.target }}"
+
+    - name: Build and push image
+      uses: docker/build-push-action@v5
+      with:
+        context: ${{ inputs.context }}
+        file: ${{ inputs.dockerfile }}
+        push: ${{ inputs.push }}
+        tags: ${{ steps.vars.outputs.tags }}
+        build-args: ${{ inputs.build_args }}

.github/actions/build-and-push/action.yaml

@@ -12,6 +12,10 @@ inputs:
     description: Override image tag (defaults to standard tags)
     required: false
     default: ""
+  checkout_ref:
+    description: Git ref to checkout before build (e.g. refs/tags/v1.2.3)
+    required: false
+    default: ""
   dockerfile:
     description: Path to Dockerfile
     required: false
@@ -24,6 +28,10 @@ inputs:
     description: Push image after build
     required: false
     default: "true"
+  additional_build_args:
+    description: Additional Docker build args as newline-separated KEY=VALUE pairs
+    required: false
+    default: ""
   registry_username:
     description: Registry username
     required: true
@@ -38,6 +46,7 @@ runs:
       with:
         fetch-depth: 0
         fetch-tags: true
+        ref: ${{ inputs.checkout_ref != '' && inputs.checkout_ref || '' }}
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
@@ -75,70 +84,14 @@ runs:
           exit 1
         fi
 
-    - name: Derive image tags
+    - name: Derive image metadata
       id: vars
       shell: bash
       env:
         IMAGE_NAME: ${{ env.IMAGE_NAME }}
         TAG_INPUT: ${{ inputs.tag }}
       run: |
-        IMAGE="${IMAGE_NAME}"
-        TAGS=()
-
-        if [ -n "${TAG_INPUT}" ]; then
-          TAGS+=("${IMAGE}:${TAG_INPUT}")
-        else
-          TAG_NAME=""
-          REF="${GITHUB_REF:-${GITEA_REF}}"
-          SHA="${GITHUB_SHA:-${GITEA_SHA}}"
-          BRANCH=""
-          SHORT_SHA="$(git rev-parse --short=7 "${SHA}")"
-
-          # Extract tag name when we are on a tag ref (e.g. v1.4)
-          if [[ "${REF}" =~ refs/tags/(.+) ]]; then
-            TAG_NAME="${BASH_REMATCH[1]}"
-          fi
-
-          if [[ "${REF}" =~ refs/heads/(.+) ]]; then
-            BRANCH="${BASH_REMATCH[1]}"
-          else
-            # Tag build: detect which branch contains the tagged commit
-            git fetch --no-tags --depth=1 origin main release develop || true
-            if git branch -r --contains "${SHA}" | grep -q "origin/main"; then
-              BRANCH="main"
-            elif git branch -r --contains "${SHA}" | grep -q "origin/release"; then
-              BRANCH="release"
-            elif git branch -r --contains "${SHA}" | grep -q "origin/develop"; then
-              BRANCH="develop"
-            fi
-          fi
-
-          TAGS+=("${IMAGE}:${SHORT_SHA}")
-          [[ -n "${TAG_NAME}" ]] && TAGS+=("${IMAGE}:${TAG_NAME}")
-
-          case "${BRANCH}" in
-            main)
-              TAGS+=("${IMAGE}:latest")
-              ;;
-            release*)
-              TAGS+=("${IMAGE}:latest-rc")
-              ;;
-            develop)
-              TAGS+=("${IMAGE}:latest-dev")
-              ;;
-            *)
-              TAGS+=("${IMAGE}:latest-snapshot")
-              ;;
-          esac
-        fi
-
-        echo "Computed tags:"
-        printf '%s\n' "${TAGS[@]}"
-        {
-          echo "tags<<EOF"
-          printf '%s\n' "${TAGS[@]}"
-          echo "EOF"
-        } >> "$GITHUB_OUTPUT"
+        bash "${GITHUB_ACTION_PATH}/../shared/derive-image-metadata.sh"
 
     - name: Show build summary
       shell: bash
@@ -149,25 +102,7 @@ runs:
         echo "Image:  ${IMAGE_NAME}"
         echo "Tags:"
         printf '%s\n' "${{ steps.vars.outputs.tags }}"
-
-    - name: Determine deploy target
-      id: deploy
-      shell: bash
-      run: |
-        REF="${GITHUB_REF:-${GITEA_REF}}"
-        SHA="${GITHUB_SHA:-${GITEA_SHA}}"
-        TARGET="dev"
-        if [[ "${REF}" == "refs/heads/main" ]]; then
-          TARGET="prod"
-        elif [[ "${REF}" =~ refs/tags/ ]]; then
-          # Tag builds deploy to prod only if the tagged commit is in main
-          git fetch --no-tags --depth=1 origin main || true
-          if git branch -r --contains "${SHA}" | grep -q "origin/main"; then
-            TARGET="prod"
-          fi
-        fi
-        echo "Deploy target: ${TARGET}"
-        echo "target=${TARGET}" >> "$GITHUB_OUTPUT"
+        echo "Deploy target: ${{ steps.vars.outputs.target }}"
 
     - name: Build and push image
       uses: docker/build-push-action@v5
@@ -177,6 +112,9 @@ runs:
         push: ${{ inputs.push }}
         tags: ${{ steps.vars.outputs.tags }}
         build-args: |
-          VITE_KEYCLOAK_URL=${{ vars.VITE_KEYCLOAK_URL }}
-          VITE_KEYCLOAK_REALM=${{ vars.VITE_KEYCLOAK_REALM }}
-          VITE_KEYCLOAK_CLIENT_ID=${{ vars.VITE_KEYCLOAK_CLIENT_ID }}
+          VITE_KEYCLOAK_URL=${{ env.VITE_KEYCLOAK_URL != '' && env.VITE_KEYCLOAK_URL || vars.VITE_KEYCLOAK_URL }}
+          VITE_KEYCLOAK_REALM=${{ env.VITE_KEYCLOAK_REALM != '' && env.VITE_KEYCLOAK_REALM || vars.VITE_KEYCLOAK_REALM }}
+          VITE_KEYCLOAK_CLIENT_ID=${{ env.VITE_KEYCLOAK_CLIENT_ID != '' && env.VITE_KEYCLOAK_CLIENT_ID || vars.VITE_KEYCLOAK_CLIENT_ID }}
+          VITE_BASE_PATH=${{ env.VITE_BASE_PATH != '' && env.VITE_BASE_PATH || vars.VITE_BASE_PATH }}
+          VITE_ADMIN_API_BASE=${{ env.VITE_ADMIN_API_BASE != '' && env.VITE_ADMIN_API_BASE || vars.VITE_ADMIN_API_BASE }}
+          ${{ inputs.additional_build_args }}

.github/actions/bump-version/action.yaml

@@ -5,6 +5,10 @@ inputs:
     description: Node.js version to use
     required: false
     default: "24"
+  release_line:
+    description: Release line for dev builds (e.g. 2.4 or 2.4.1) when it cannot be derived from the branch or PR target
+    required: false
+    default: ""
   gitea_token:
     description: Token for checkout/push (optional)
     required: false
@@ -34,55 +38,210 @@ runs:
       with:
         node-version: ${{ inputs.node_version }}
 
-    - name: Bump patch version and tag
+    - name: Bump version and tag
       id: bump
       shell: bash
+      env:
+        INPUT_RELEASE_LINE: ${{ inputs.release_line }}
       run: |
-        REF="${GITHUB_REF:-${GITEA_REF}}"
+        set -euo pipefail
+
+        REF="${GITHUB_HEAD_REF:-${GITEA_HEAD_REF:-${GITHUB_REF:-${GITEA_REF:-}}}}"
+        BASE_REF="${GITHUB_BASE_REF:-${GITEA_BASE_REF:-}}"
         BRANCH="${REF#refs/heads/}"
+        BASE_BRANCH="${BASE_REF#refs/heads/}"
+
+        if [[ -z "${BRANCH}" ]]; then
+          echo "Unable to determine branch from workflow context." >&2
+          exit 1
+        fi
+
         git fetch origin "${BRANCH}" --tags
         git checkout "${BRANCH}"
         git pull --ff-only origin "${BRANCH}"
-        BRANCH_SAFE="$(echo "${BRANCH}" | tr '/[:space:].' '-' | tr -cd '[:alnum:]_-')"
-        BRANCH_SAFE="$(echo "${BRANCH_SAFE}" | sed 's/^-*//;s/-*$//')"
-        BRANCH_SAFE="${BRANCH_SAFE:-unknown}"
+
+        set_version() {
+          npm version "$1" --no-git-tag-version --allow-same-version >/dev/null
+        }
+
+        read_package_version() {
+          node -p "require('./package.json').version"
+        }
+
+        normalize_release_base() {
+          local value="$1"
+          if [[ "${value}" =~ ^v?([0-9]+)\.([0-9]+)$ ]]; then
+            echo "${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.0"
+            return 0
+          fi
+          if [[ "${value}" =~ ^v?([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+            echo "${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.${BASH_REMATCH[3]}"
+            return 0
+          fi
+          return 1
+        }
+
+        extract_release_base() {
+          local ref_name="$1"
+          local normalized
+          if [[ "${ref_name}" =~ ^release/(.+)$ ]]; then
+            if normalized="$(normalize_release_base "${BASH_REMATCH[1]}")"; then
+              echo "${normalized}"
+              return 0
+            fi
+          fi
+          return 1
+        }
+
+        infer_release_base_from_ancestor_release_branch() {
+          local best_release_base=""
+          local best_commit_time=0
+          local remote_ref
+          local release_branch
+          local release_base
+          local commit_time
+
+          # Best effort: not every repository has release branches.
+          git fetch --no-tags origin "+refs/heads/release/*:refs/remotes/origin/release/*" >/dev/null 2>&1 || true
+
+          while IFS= read -r remote_ref; do
+            release_branch="${remote_ref#origin/}"
+            if ! release_base="$(extract_release_base "${release_branch}")"; then
+              continue
+            fi
+
+            if ! git merge-base --is-ancestor "$(git rev-parse "${remote_ref}")" HEAD; then
+              continue
+            fi
+
+            commit_time="$(git show -s --format=%ct "${remote_ref}")"
+            if [[ "${commit_time}" -gt "${best_commit_time}" ]]; then
+              best_commit_time="${commit_time}"
+              best_release_base="${release_base}"
+            fi
+          done < <(git for-each-ref --format='%(refname:short)' refs/remotes/origin/release/*)
+
+          if [[ -n "${best_release_base}" ]]; then
+            echo "${best_release_base}"
+            return 0
+          fi
+
+          return 1
+        }
+
+        resolve_release_base() {
+          local package_version
+          local normalized
+          local inferred_release_base
+
+          if [[ -n "${INPUT_RELEASE_LINE}" ]]; then
+            if ! normalized="$(normalize_release_base "${INPUT_RELEASE_LINE}")"; then
+              echo "Invalid release_line input '${INPUT_RELEASE_LINE}'. Expected format: <major>.<minor> or <major>.<minor>.<patch>" >&2
+              exit 1
+            fi
+            echo "${normalized}"
+            return 0
+          fi
+
+          if extract_release_base "${BRANCH}" >/dev/null; then
+            extract_release_base "${BRANCH}"
+            return 0
+          fi
+
+          if [[ -n "${BASE_BRANCH}" ]] && extract_release_base "${BASE_BRANCH}" >/dev/null; then
+            extract_release_base "${BASE_BRANCH}"
+            return 0
+          fi
+
+          if inferred_release_base="$(infer_release_base_from_ancestor_release_branch)"; then
+            echo "${inferred_release_base}"
+            return 0
+          fi
+
+          package_version="$(read_package_version)"
+          if [[ "${package_version}" =~ ^([0-9]+)\.([0-9]+)\.[0-9]+([-.].*)?$ ]]; then
+            echo "${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.0"
+            return 0
+          fi
+
+          echo "Unable to determine release base for branch '${BRANCH}'. Use release/<major>.<minor>[.<patch>], provide inputs.release_line, or ensure package.json contains a semantic version." >&2
+          exit 1
+        }
+
+        next_beta_version() {
+          local release_base="$1"
+          local escaped_base
+          local highest_beta
+          escaped_base="$(printf '%s' "${release_base}" | sed 's/\./\\./g')"
+          highest_beta="$(
+            git tag --list "v${release_base}-beta.*" \
+              | sed -nE "s/^v${escaped_base}-beta\.([0-9]+)$/\\1/p" \
+              | sort -n \
+              | tail -n 1
+          )"
+          if [[ -z "${highest_beta}" ]]; then
+            echo "${release_base}-beta.0"
+          else
+            echo "${release_base}-beta.$((highest_beta + 1))"
+          fi
+        }
+
+        next_dev_version() {
+          local release_base="$1"
+          local timestamp
+          while true; do
+            timestamp="$(date -u +%Y%m%d%H%M%S)"
+            if ! git rev-parse -q --verify "refs/tags/v${release_base}-dev.${timestamp}" >/dev/null; then
+              echo "${release_base}-dev.${timestamp}"
+              return 0
+            fi
+            sleep 1
+          done
+        }
+
         case "${BRANCH}" in
           main)
             COMMIT_MSG="$(git log -1 --pretty=%B)"
             TARGET_VERSION=""
-            if [[ "${COMMIT_MSG}" =~ release/([0-9]+)\.([0-9]+) ]]; then
+            if [[ "${COMMIT_MSG}" =~ release/v?([0-9]+\.[0-9]+\.[0-9]+) ]]; then
+              TARGET_VERSION="${BASH_REMATCH[1]}"
+            elif [[ "${COMMIT_MSG}" =~ release/([0-9]+)\.([0-9]+) ]]; then
               TARGET_VERSION="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.0"
             elif [[ "${COMMIT_MSG}" =~ hotfix/([0-9]+\.[0-9]+\.[0-9]+) ]]; then
               TARGET_VERSION="${BASH_REMATCH[1]}"
             fi
 
             if [[ -n "${TARGET_VERSION}" ]]; then
-              npm version "${TARGET_VERSION}" --no-git-tag-version --allow-same-version
-              BUMP_CMD="npm version patch --no-git-tag-version"
+              set_version "${TARGET_VERSION}"
             else
-              npm version patch --no-git-tag-version
-              BUMP_CMD="npm version patch --no-git-tag-version"
+              npm version patch --no-git-tag-version >/dev/null
             fi
             ;;
-          develop)
-            npm version prerelease --preid=dev --no-git-tag-version
-            BUMP_CMD="npm version prerelease --preid=dev --no-git-tag-version"
-            ;;
-          release*)
-            npm version prerelease --preid=rc-${BRANCH_SAFE} --no-git-tag-version
-            BUMP_CMD="npm version prerelease --preid=rc-${BRANCH_SAFE} --no-git-tag-version"
+          release/*)
+            RELEASE_BASE="$(resolve_release_base)"
+            set_version "$(next_beta_version "${RELEASE_BASE}")"
             ;;
           *)
-            npm version prerelease --preid=nightly-${BRANCH_SAFE} --no-git-tag-version
-            BUMP_CMD="npm version prerelease --preid=nightly-${BRANCH_SAFE} --no-git-tag-version"
+            RELEASE_BASE="$(resolve_release_base)"
+            set_version "$(next_dev_version "${RELEASE_BASE}")"
             ;;
         esac
 
         VERSION="$(node -p "require('./package.json').version")"
         while git rev-parse -q --verify "refs/tags/v${VERSION}" >/dev/null; do
           echo "Tag v${VERSION} already exists; trying next version."
-          ${BUMP_CMD}
-          VERSION="$(node -p "require('./package.json').version")"
+          case "${BRANCH}" in
+            main)
+              npm version patch --no-git-tag-version >/dev/null
+              ;;
+            release/*)
+              set_version "$(next_beta_version "${RELEASE_BASE}")"
+              ;;
+            *)
+              set_version "$(next_dev_version "${RELEASE_BASE}")"
+              ;;
+          esac
+          VERSION="$(read_package_version)"
         done
 
         if git diff --quiet; then

.github/actions/shared/derive-image-metadata.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE_NAME="${IMAGE_NAME:-}"
+TAG_INPUT="${TAG_INPUT:-}"
+REF="${GITHUB_REF:-${GITEA_REF:-}}"
+SHA="${GITHUB_SHA:-${GITEA_SHA:-}}"
+
+if [ -z "${IMAGE_NAME}" ]; then
+  echo "::error::IMAGE_NAME is missing"
+  exit 1
+fi
+
+if [ -z "${SHA}" ]; then
+  SHA="$(git rev-parse HEAD)"
+fi
+
+SHORT_SHA="$(git rev-parse --short=7 "${SHA}")"
+BRANCH=""
+TAG_NAME=""
+TAGS=()
+
+if [[ "${REF}" =~ refs/tags/(.+) ]]; then
+  TAG_NAME="${BASH_REMATCH[1]}"
+fi
+
+if [[ "${REF}" =~ refs/heads/(.+) ]]; then
+  BRANCH="${BASH_REMATCH[1]}"
+elif [[ "${REF}" =~ refs/tags/ ]]; then
+  # Tag build: detect which branch contains the tagged commit.
+  git fetch --no-tags origin '+refs/heads/*:refs/remotes/origin/*' || true
+  if git branch -r --contains "${SHA}" | grep -q "origin/main"; then
+    BRANCH="main"
+  elif git branch -r --contains "${SHA}" | grep -q "origin/release/"; then
+    BRANCH="release"
+  elif git branch -r --contains "${SHA}" | grep -q "origin/develop"; then
+    BRANCH="develop"
+  fi
+fi
+
+if [ -n "${TAG_INPUT}" ]; then
+  TAGS+=("${IMAGE_NAME}:${TAG_INPUT}")
+else
+  TAGS+=("${IMAGE_NAME}:${SHORT_SHA}")
+  [ -n "${TAG_NAME}" ] && TAGS+=("${IMAGE_NAME}:${TAG_NAME}")
+
+  case "${BRANCH}" in
+    main)
+      TAGS+=("${IMAGE_NAME}:latest")
+      ;;
+    release*)
+      TAGS+=("${IMAGE_NAME}:latest-rc")
+      ;;
+    develop)
+      TAGS+=("${IMAGE_NAME}:latest-dev")
+      ;;
+    *)
+      TAGS+=("${IMAGE_NAME}:latest-snapshot")
+      ;;
+  esac
+fi
+
+TARGET="dev"
+if [[ "${REF}" == "refs/heads/main" ]]; then
+  TARGET="prod"
+elif [[ "${REF}" =~ refs/tags/ ]] && [[ "${BRANCH}" == "main" ]]; then
+  TARGET="prod"
+fi
+
+echo "Computed tags:"
+printf '%s\n' "${TAGS[@]}"
+echo "Deploy target: ${TARGET}"
+
+{
+  echo "tags<<EOF"
+  printf '%s\n' "${TAGS[@]}"
+  echo "EOF"
+  echo "target=${TARGET}"
+} >> "$GITHUB_OUTPUT"

.woodpecker/plugins.yaml

@@ -0,0 +1,60 @@
+# Builds the plugins in woodpecker/<name>/. A tag <name>-vX.Y.Z pushes
+# git.uesome.de/actions/ci-cd/<name>:vX.Y.Z; pushes and PRs only test the build.
+when:
+  - event: [push, pull_request]
+    path: 'woodpecker/**'
+  - event: tag
+    ref: [refs/tags/deploy-v*, refs/tags/bump-v*]
+
+steps:
+  - name: deploy-plugin-check
+    image: woodpeckerci/plugin-docker-buildx:6
+    settings:
+      repo: git.uesome.de/actions/ci-cd/deploy
+      context: woodpecker/deploy
+      dockerfile: woodpecker/deploy/Dockerfile
+      dry_run: true
+    when:
+      event: [push, pull_request]
+      path: 'woodpecker/deploy/**'
+
+  - name: deploy-plugin
+    image: woodpeckerci/plugin-docker-buildx:6
+    settings:
+      registry: git.uesome.de
+      repo: git.uesome.de/actions/ci-cd/deploy
+      context: woodpecker/deploy
+      dockerfile: woodpecker/deploy/Dockerfile
+      tags: ${CI_COMMIT_TAG##deploy-}
+      username: oumta-ci
+      password:
+        from_secret: oumta_ci_token
+    when:
+      event: tag
+      ref: refs/tags/deploy-v*
+
+  - name: bump-plugin-check
+    image: woodpeckerci/plugin-docker-buildx:6
+    settings:
+      repo: git.uesome.de/actions/ci-cd/bump
+      context: woodpecker/bump
+      dockerfile: woodpecker/bump/Dockerfile
+      dry_run: true
+    when:
+      event: [push, pull_request]
+      path: 'woodpecker/bump/**'
+
+  - name: bump-plugin
+    image: woodpeckerci/plugin-docker-buildx:6
+    settings:
+      registry: git.uesome.de
+      repo: git.uesome.de/actions/ci-cd/bump
+      context: woodpecker/bump
+      dockerfile: woodpecker/bump/Dockerfile
+      tags: ${CI_COMMIT_TAG##bump-}
+      username: oumta-ci
+      password:
+        from_secret: oumta_ci_token
+    when:
+      event: tag
+      ref: refs/tags/bump-v*

README.md

@@ -4,6 +4,47 @@ This repo provides reusable Gitea Actions as composite actions that can be refer
 
 ### Bump Version
 
+Creates or updates the version in `package.json`, commits it, creates a matching Git tag, and pushes both.
+
+Inputs:
+
+- `node_version`: Node.js version to use. Default: `24`
+- `release_line`: optional release line for dev builds. Format: `<major>.<minor>` or `<major>.<minor>.<patch>`. Overrides branch, PR target, inferred ancestor release branch, and `package.json`.
+- `gitea_token`: optional token used for checkout and push
+
+Branch and tag rules:
+
+- `main`: creates release tags from the latest commit message (`release/x.y.z`, `release/x.y`, `hotfix/x.y.z`) or falls back to a patch bump.
+- `release/<major>.<minor>` or `release/<major>.<minor>.<patch>`: creates the next beta tag for that release base, e.g. `v2.4.0-beta.3` or `v2.4.1-beta.3`.
+- all other branches: create a dev tag for the resolved release base using a UTC timestamp, e.g. `v2.4.0-dev.20260314153045`.
+
+Dev release line resolution order:
+
+- `inputs.release_line`
+- current branch if it matches `release/<major>.<minor>` or `release/<major>.<minor>.<patch>`
+- PR target branch if it matches `release/<major>.<minor>` or `release/<major>.<minor>.<patch>`
+- newest ancestor branch from `origin/release/*` (for feature branches created from release branches outside PR context)
+- `major.minor` from `package.json`
+
+If no release line can be resolved for a dev build, the action fails intentionally.
+
+Examples:
+
+Commit message examples on `main`:
+
+- `release/2.4.0` -> `v2.4.0`
+- `release/2.4` -> `v2.4.0`
+- `hotfix/2.4.1` -> `v2.4.1`
+
+Branch examples:
+
+- `release/2.4` -> next `v2.4.0-beta.N`
+- `release/v2.4.1` -> next `v2.4.1-beta.N`
+- feature branch in a PR to `release/2.4` -> `v2.4.0-dev.<UTC_TIMESTAMP>`
+- feature branch created from `release/v2.4.1` (without PR base) -> `v2.4.1-dev.<UTC_TIMESTAMP>` when the release branch tip is an ancestor
+- feature branch outside a PR with `package.json` version `2.4.0` -> `v2.4.0-dev.<UTC_TIMESTAMP>`
+- feature branch outside a PR with `release_line: 2.4` -> `v2.4.0-dev.<UTC_TIMESTAMP>`
+
 Example:
 
 ```yaml
@@ -18,6 +59,21 @@ jobs:
           gitea_token: ${{ secrets.GITEA_TOKEN }}
 ```
 
+Feature branch outside a PR:
+
+```yaml
+jobs:
+  bump-version:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: tanztee/ci-cd/.github/actions/bump-version@main
+        with:
+          gitea_token: ${{ secrets.GITEA_TOKEN }}
+          release_line: 2.4
+```
+
 ### Build and Push Docker Image
 
 Example:
@@ -61,3 +117,93 @@ jobs:
           kubeconfig: ${{ secrets.KUBECONFIG }}
           registry: ${{ secrets.REGISTRY }}
 ```
+
+## Woodpecker plugins
+
+Plugins are Docker images built from `woodpecker/<name>/` by `.woodpecker/plugins.yaml`. A tag `<name>-vX.Y.Z` publishes `git.uesome.de/actions/ci-cd/<name>:vX.Y.Z`; pipelines pin that version. The push uses `oumta-ci` with the Woodpecker secret `oumta_ci_token`, so `oumta-ci` needs package write access in the org `actions`.
+
+The secret `oumta_ci_token` holds the one token `oumta-ci` writes with. Limit it in Woodpecker to the images `woodpeckerci/plugin-docker-buildx:6`, `git.uesome.de/actions/ci-cd/bump` and `git.uesome.de/actions/ci-cd/deploy` and to the events `push`, `tag` and `manual` (zugaenge.md in oumta-deploy).
+
+### deploy
+
+Writes a pushed dev or beta image with its digest to `tanztee/oumta-deploy` (D16 there). `ci/deploy-image.sh` in oumta-deploy decides the environment from the tag: `-dev.` goes to dev, `-beta.` to beta, anything else is skipped (prod only via PR).
+
+Settings:
+
+- `var` (required): variable in `envs/<env>/images.env`, e.g. `AUTH_IMAGE`. `{major}` is replaced by the major of the tag (`APP_V{major}_IMAGE` -> `APP_V2_IMAGE`).
+- `deploy_token` (required): token of `oumta-ci` (`oumta_ci_token`), write access to oumta-deploy
+- `registry_username`, `registry_password`: read access to the registry for the digest (`oumta-ci` with the same token)
+- `envs`: fixed environments instead of the tag rule, e.g. `dev beta` (oumta-keyklo)
+- `tag`: default `CI_COMMIT_TAG`
+- `registry`: default `git.uesome.de`
+- `image`: default `<registry>/<CI_REPO>`
+- `deploy_user`: default `oumta-ci`
+- `deploy_repo`: default `https://git.uesome.de/tanztee/oumta-deploy.git`
+
+Example:
+
+```yaml
+when:
+  event: tag
+  ref: refs/tags/v*
+
+steps:
+  - name: build
+    image: woodpeckerci/plugin-docker-buildx:6
+    settings:
+      registry: git.uesome.de
+      repo: git.uesome.de/tanztee/oumta-auth
+      tags: ${CI_COMMIT_TAG}
+      build_args:
+        VERSION: ${CI_COMMIT_TAG##v}
+      username: oumta-ci
+      password:
+        from_secret: oumta_ci_token
+
+  - name: deploy
+    image: git.uesome.de/actions/ci-cd/deploy:v1.0.0
+    settings:
+      var: AUTH_IMAGE
+      registry_username: oumta-ci
+      registry_password:
+        from_secret: oumta_ci_token
+      deploy_token:
+        from_secret: oumta_ci_token
+```
+
+### bump
+
+Derives the next version for the pushed branch and pushes it as a tag on the triggering commit. There is no version commit: the build takes the version from the tag (`CI_COMMIT_TAG`, e.g. as build arg `VERSION: ${CI_COMMIT_TAG##v}`), `package.json` stays untouched. The tag event then starts the build.
+
+- `release/X.Y[.Z]`, `hotfix/X.Y.Z`: next `vX.Y.Z-beta.N` of that line (D8). A hotfix needs a patch number.
+- `production/*`: no bump, the step fails. A release is a retag of a beta image (D9).
+- the branch in `release_branch` (repos without majors, e.g. oumta-keyklo `main`): next stable `vX.Y.Z`, the highest existing patch of the line plus one
+- any other branch: `vX.Y.Z-dev.<UTC timestamp>`; the line comes from `release_line`, the branch name, the nearest `release/*` or `hotfix/*` branch (newest merge base), or `major.minor` from `package.json`
+
+If the stable tag of a line exists (`v2.4.0` after the release), the next patch of that line is used (`v2.4.1-beta.0`, `v2.4.1-dev.…`).
+
+Only the commit that triggered the pipeline is tagged; if the branch moved on, the step exits without a tag and the newer pipeline takes over. A commit that already carries a tag of the same kind (dev, beta or stable) is not tagged again, so a re-run does not build twice; a dev tag does not block the beta tag after a fast-forward merge.
+
+Settings:
+
+- `git_token` (required): token of `oumta-ci` (`oumta_ci_token`), write access to the repo
+- `git_user`: default `oumta-ci`
+- `release_branch`: optional, branch that gets stable tags instead of dev tags
+- `release_line`: optional, `<major>.<minor>[.<patch>]`, overrides every other rule
+- `remote`: default `CI_REPO_CLONE_URL`
+
+Example:
+
+```yaml
+when:
+  - event: push
+    branch: ['feature/**', 'release/**', 'hotfix/**']
+  - event: manual
+
+steps:
+  - name: bump
+    image: git.uesome.de/actions/ci-cd/bump:v2.0.0
+    settings:
+      git_token:
+        from_secret: oumta_ci_token
+```

woodpecker/bump/Dockerfile

@@ -0,0 +1,5 @@
+# Woodpecker plugin: derives the next version and pushes it as a tag
+FROM alpine:3.20
+RUN apk add --no-cache bash git ca-certificates
+COPY bump.sh /usr/local/bin/bump.sh
+ENTRYPOINT ["/usr/local/bin/bump.sh"]

woodpecker/bump/bump.sh

@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+# Woodpecker plugin "bump": derives the next version for the pushed branch and
+# pushes it as a tag on the triggering commit. No commit is made; the build
+# takes the version from the tag (CI_COMMIT_TAG). The tag event then starts
+# the build.
+#
+#   release/X.Y[.Z], hotfix/X.Y.Z   next vX.Y.Z-beta.N (D8)
+#   production/*                    nothing: releases are retags (D9)
+#   settings.release_branch         next free vX.Y.Z (repos without majors)
+#   any other branch                vX.Y.Z-dev.<UTC timestamp>
+set -euo pipefail
+
+die() { echo "bump: $*" >&2; exit 1; }
+
+BRANCH=${CI_COMMIT_BRANCH:?CI_COMMIT_BRANCH is missing (push event only)}
+SHA=${CI_COMMIT_SHA:?CI_COMMIT_SHA is missing}
+REMOTE=${PLUGIN_REMOTE:-${CI_REPO_CLONE_URL:?CI_REPO_CLONE_URL is missing}}
+GIT_USER=${PLUGIN_GIT_USER:-oumta-ci}
+RELEASE_LINE=${PLUGIN_RELEASE_LINE:-}
+RELEASE_BRANCH=${PLUGIN_RELEASE_BRANCH:-}
+[[ -n ${PLUGIN_GIT_TOKEN:-} ]] || die "settings.git_token is missing"
+
+case $BRANCH in
+  production/*) die "no bump on $BRANCH: a release is a retag of a beta image (D9)" ;;
+esac
+
+# Token only via credential helper, never in a URL or config, so no log shows it
+export GIT_USER PLUGIN_GIT_TOKEN
+git config --global --add safe.directory "$PWD"
+git config credential.helper '!f() { echo "username=$GIT_USER"; echo "password=$PLUGIN_GIT_TOKEN"; }; f'
+git remote set-url origin "$REMOTE"
+
+# The Woodpecker clone is shallow and has no tags; the version rules need both.
+if [[ $(git rev-parse --is-shallow-repository) == true ]]; then
+  git fetch --quiet --unshallow origin
+fi
+git fetch --quiet --tags --force origin "+refs/heads/*:refs/remotes/origin/*"
+
+# Tag exactly the commit that triggered the pipeline. A newer push on the
+# branch starts its own pipeline, so this one steps aside.
+head=$(git rev-parse -q --verify "origin/$BRANCH") || die "$BRANCH no longer exists on origin"
+if [[ $head != "$SHA" ]]; then
+  echo "bump: $BRANCH moved past ${SHA:0:8}, the newer pipeline bumps"
+  exit 0
+fi
+git checkout --quiet "$SHA"
+
+tag_exists() { git rev-parse -q --verify "refs/tags/v$1" >/dev/null; }
+
+# "2.4" or "v2.4.1" -> "2.4.0" / "2.4.1"; fails for anything else
+parse_line() {
+  [[ $1 =~ ^v?([0-9]+)\.([0-9]+)(\.([0-9]+))?$ ]] || return 1
+  echo "${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.${BASH_REMATCH[4]:-0}"
+}
+
+# release/2.4 -> 2.4.0, hotfix/2.4.1 -> 2.4.1; a hotfix without a patch fails
+line_of_branch() {
+  local kind name
+  [[ $1 =~ ^(release|hotfix)/(.+)$ ]] || return 1
+  kind=${BASH_REMATCH[1]} name=${BASH_REMATCH[2]}
+  [[ $kind == hotfix && ! $name =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]] && return 1
+  parse_line "$name"
+}
+
+# The release or hotfix branch whose merge base with HEAD is the newest, i.e.
+# the line this commit was branched from most recently. On a tie (a hotfix
+# forked from the same commit as the release) the lower line wins.
+line_of_nearest_branch() {
+  local ref line base
+  while read -r ref; do
+    line=$(line_of_branch "${ref#origin/}") || continue
+    base=$(git merge-base "$ref" HEAD 2>/dev/null) || continue
+    echo "$(git show -s --format=%ct "$base") ${line//./ } $line"
+  done < <(git for-each-ref --format='%(refname:short)' refs/remotes/origin/release/ refs/remotes/origin/hotfix/) |
+    sort -k1,1nr -k2,2n -k3,3n -k4,4n | head -n 1 | { read -r _ _ _ _ line && echo "$line"; }
+}
+
+# major.minor.0 from the version in package.json, if there is one
+line_of_package() {
+  local version
+  [[ -f package.json ]] || return 1
+  version=$(sed -nE 's/^[[:space:]]*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/p' package.json | head -n 1)
+  version=$(parse_line "${version%%[-+]*}") || return 1
+  echo "${version%.*}.0"
+}
+
+# The line for this branch: setting, branch name, nearest release/hotfix
+# branch, else major.minor of package.json.
+resolve_line() {
+  if [[ -n $RELEASE_LINE ]]; then
+    parse_line "$RELEASE_LINE" || die "invalid settings.release_line '$RELEASE_LINE', expected <major>.<minor>[.<patch>]"
+    return
+  fi
+  line_of_branch "$BRANCH" && return
+  line_of_nearest_branch && return
+  line_of_package && return
+  die "no release line for '$BRANCH': use settings.release_line or a semantic version in package.json"
+}
+
+# The next stable version of a line: highest existing vX.Y.Z plus one patch.
+next_stable() {
+  local line=$1 highest
+  highest=$(git tag --list "v${line%.*}.*" | sed -nE 's/^v[0-9]+\.[0-9]+\.([0-9]+)$/\1/p' | sort -n | tail -n 1)
+  echo "${line%.*}.$(( ${highest:--1} + 1 ))"
+}
+
+# A line whose stable tag exists was released; the next patch is the open one.
+next_free_patch() {
+  local line=$1 patch
+  while tag_exists "$line"; do
+    patch=${line##*.}
+    line=${line%.*}.$((patch + 1))
+  done
+  echo "$line"
+}
+
+next_beta() {
+  local line=$1 highest
+  highest=$(git tag --list "v$line-beta.*" | sed -nE 's/^.*-beta\.([0-9]+)$/\1/p' | sort -n | tail -n 1)
+  echo "$line-beta.$(( ${highest:--1} + 1 ))"
+}
+
+next_dev() {
+  local line=$1 stamp
+  while :; do
+    stamp=$(date -u +%Y%m%d%H%M%S)
+    tag_exists "$line-dev.$stamp" || { echo "$line-dev.$stamp"; return; }
+    sleep 1
+  done
+}
+
+case $BRANCH in
+  release/* | hotfix/*)
+    line=$(line_of_branch "$BRANCH") || die "unusable branch name '$BRANCH', expected release/X.Y[.Z] or hotfix/X.Y.Z"
+    VERSION=$(next_beta "$(next_free_patch "$line")")
+    ;;
+  *)
+    if [[ -n $RELEASE_BRANCH && $BRANCH == "$RELEASE_BRANCH" ]]; then
+      VERSION=$(next_stable "$(resolve_line)")
+    else
+      VERSION=$(next_dev "$(next_free_patch "$(resolve_line)")")
+    fi
+    ;;
+esac
+TAG=v$VERSION
+
+# A re-run must not produce a second tag and a second build for the same commit.
+# Only tags of the same kind count: a dev tag on a commit that is then merged
+# fast-forward into a release branch must not block its beta tag.
+case $TAG in
+  *-dev.*) same_kind='^v[0-9]+\.[0-9]+\.[0-9]+-dev\.' ;;
+  *-beta.*) same_kind='^v[0-9]+\.[0-9]+\.[0-9]+-beta\.' ;;
+  *) same_kind='^v[0-9]+\.[0-9]+\.[0-9]+$' ;;
+esac
+existing=$(git tag --points-at HEAD 'v*' | grep -E "$same_kind" | head -n 1 || true)
+if [[ -n $existing ]]; then
+  echo "bump: ${SHA:0:8} already carries $existing, nothing to do"
+  exit 0
+fi
+
+git tag "$TAG"
+if ! git push --quiet origin "refs/tags/$TAG"; then
+  echo "bump: push of $TAG rejected, the newer pipeline bumps"
+  exit 0
+fi
+echo "bump: $TAG on $BRANCH (${SHA:0:8})"

woodpecker/deploy/Dockerfile

@@ -0,0 +1,5 @@
+# Woodpecker plugin: writes dev and beta image tags with digest to oumta-deploy
+FROM alpine:3.20
+RUN apk add --no-cache bash git ca-certificates crane
+COPY deploy.sh /usr/local/bin/deploy.sh
+ENTRYPOINT ["/usr/local/bin/deploy.sh"]

woodpecker/deploy/deploy.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Woodpecker plugin "deploy": writes the pushed image with its digest to
+# oumta-deploy. ci/deploy-image.sh there decides the environment from the tag
+# (-dev. -> dev, -beta. -> beta, anything else -> nothing).
+set -euo pipefail
+
+die() { echo "deploy: $*" >&2; exit 1; }
+
+VAR=${PLUGIN_VAR:?settings.var is missing}
+REGISTRY=${PLUGIN_REGISTRY:-git.uesome.de}
+IMAGE=${PLUGIN_IMAGE:-$REGISTRY/${CI_REPO:?CI_REPO is missing}}
+TAG=${PLUGIN_TAG:-${CI_COMMIT_TAG:-}}
+DEPLOY_USER=${PLUGIN_DEPLOY_USER:-oumta-ci}
+DEPLOY_REPO=${PLUGIN_DEPLOY_REPO:-https://git.uesome.de/tanztee/oumta-deploy.git}
+[[ -n $TAG ]] || die "no tag (settings.tag or tag event)"
+[[ -n ${PLUGIN_DEPLOY_TOKEN:-} ]] || die "settings.deploy_token is missing"
+
+major=${TAG#v}; major=${major%%.*}
+VAR=${VAR//\{major\}/$major}
+
+if [[ -n ${PLUGIN_REGISTRY_USERNAME:-} ]]; then
+  crane auth login "$REGISTRY" -u "$PLUGIN_REGISTRY_USERNAME" --password-stdin \
+    <<<"${PLUGIN_REGISTRY_PASSWORD:?settings.registry_password is missing}" >/dev/null
+fi
+
+# Token only via credential helper, never in a URL or config, so no log shows it
+helper='!f() { echo "username=$DEPLOY_USER"; echo "password=$PLUGIN_DEPLOY_TOKEN"; }; f'
+export DEPLOY_USER PLUGIN_DEPLOY_TOKEN
+work=$(mktemp -d)
+git -c credential.helper="$helper" clone --quiet "$DEPLOY_REPO" "$work/oumta-deploy"
+git -C "$work/oumta-deploy" config credential.helper "$helper"
+
+export DEPLOY_ENVS=${PLUGIN_ENVS:-}
+export SOURCE_REPO=${CI_REPO:-} SOURCE_COMMIT=${CI_COMMIT_SHA:-}
+"$work/oumta-deploy/ci/deploy-image.sh" "$VAR" "${IMAGE,,}:$TAG"