feat(bump)!: nur Tag, kein Versions-Commit (#4)

## Was

Das Plugin `bump` setzt nur noch den Tag auf den auslösenden Commit. Es gibt keinen Versions-Commit mehr, `package.json` bleibt unberührt. Der Build nimmt die Version aus dem Tag (`CI_COMMIT_TAG`, im Beispiel als Build-Arg `VERSION`).

Grund: Mit Versions-Commit war der Head eines PRs immer der Bump-Commit mit `[skip ci]`. Dafür startet Woodpecker keine Pipeline, der verlangte Status-Check fehlt, der PR ist nicht mergebar (oumta-app). Ohne Commit bleibt der Head der des Entwicklers. Nebeneffekt: keine `update version`-Commits mehr in der Historie.

- `release_branch`: nächste stabile Version ist der höchste vorhandene Patch der Linie plus eins (vorher Patch-Bump aus `package.json`).
- Ein Commit, der schon ein `v*`-Tag trägt, wird nicht erneut getaggt. Ein Neustart der Pipeline baut also nicht doppelt.
- Image auf `alpine:3.20` wie `deploy`, Node wird nicht mehr gebraucht.
- `author_name` und `author_email` entfallen.

Breaking: Apps, die die Version aus `package.json` anzeigen, müssen sie aus dem Build-Arg lesen (Anforderung in oumta-deploy folgt). Release als `bump-v2.0.0`.

## Getestet

Lokal gegen ein Bare-Repo: feature von develop und von release, erste und weitere Betas, erneuter Lauf auf demselben Commit, hotfix mit und ohne Patch, production, `release_branch` mit vorhandenen stabilen Tags, Linie nach stabilem Tag, weitergelaufener Branch, fehlendes Token. Keine Commits auf den Branches.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: #4

README.md

@@ -120,7 +120,9 @@ jobs:
 
 ## Woodpecker plugins
 
-Plugins are Docker images built from `woodpecker/<name>/` by `.woodpecker/plugins.yaml`. A tag `<name>-vX.Y.Z` publishes `git.uesome.de/actions/ci-cd/<name>:vX.Y.Z`; pipelines pin that version.
+Plugins are Docker images built from `woodpecker/<name>/` by `.woodpecker/plugins.yaml`. A tag `<name>-vX.Y.Z` publishes `git.uesome.de/actions/ci-cd/<name>:vX.Y.Z`; pipelines pin that version. The push uses `oumta-ci` with the Woodpecker secret `oumta_ci_token`, so `oumta-ci` needs package write access in the org `actions`.
+
+The secret `oumta_ci_token` holds the one token `oumta-ci` writes with. Limit it in Woodpecker to the images `woodpeckerci/plugin-docker-buildx:6`, `git.uesome.de/actions/ci-cd/bump` and `git.uesome.de/actions/ci-cd/deploy` and to the events `push`, `tag` and `manual` (zugaenge.md in oumta-deploy).
 
 ### deploy
 
@@ -152,6 +154,8 @@ steps:
       registry: git.uesome.de
       repo: git.uesome.de/tanztee/oumta-auth
       tags: ${CI_COMMIT_TAG}
+      build_args:
+        VERSION: ${CI_COMMIT_TAG##v}
       username: oumta-ci
       password:
         from_secret: oumta_ci_token
@@ -169,20 +173,23 @@ steps:
 
 ### bump
 
-Sets the version for the pushed branch in `package.json`, commits it as `update version: vX [skip ci]`, tags it and pushes branch and tag. The tag event then starts the build; `[skip ci]` only suppresses push and pull_request events.
+Derives the next version for the pushed branch and pushes it as a tag on the triggering commit. There is no version commit: the build takes the version from the tag (`CI_COMMIT_TAG`, e.g. as build arg `VERSION: ${CI_COMMIT_TAG##v}`), `package.json` stays untouched. The tag event then starts the build.
 
-- `main`: release from the commit message (`release/x.y[.z]`, `hotfix/x.y.z`), otherwise a patch bump
+- `release/X.Y[.Z]`, `hotfix/X.Y.Z`: next `vX.Y.Z-beta.N` of that line (D8). A hotfix needs a patch number.
-- `release/*`, `hotfix/*`: next `vX.Y.Z-beta.N`
+- `production/*`: no bump, the step fails. A release is a retag of a beta image (D9).
-- any other branch: `vX.Y.Z-dev.<UTC timestamp>`; the release line comes from `release_line`, the newest ancestor `release/*` branch, or `package.json`
+- the branch in `release_branch` (repos without majors, e.g. oumta-keyklo `main`): next stable `vX.Y.Z`, the highest existing patch of the line plus one
+- any other branch: `vX.Y.Z-dev.<UTC timestamp>`; the line comes from `release_line`, the branch name, the nearest `release/*` or `hotfix/*` branch (newest merge base), or `major.minor` from `package.json`
 
-Only the commit that triggered the pipeline is bumped; if the branch moved on, the step exits without a bump and the newer pipeline takes over.
+If the stable tag of a line exists (`v2.4.0` after the release), the next patch of that line is used (`v2.4.1-beta.0`, `v2.4.1-dev.…`).
+
+Only the commit that triggered the pipeline is tagged; if the branch moved on, the step exits without a tag and the newer pipeline takes over. A commit that already carries a `v*` tag is not tagged again, so a re-run does not build twice.
 
 Settings:
 
-- `git_token` (required): token with write access to the repo (`oumta_ci_token`)
+- `git_token` (required): token of `oumta-ci` (`oumta_ci_token`), write access to the repo
 - `git_user`: default `oumta-ci`
-- `release_line`: optional, `<major>.<minor>[.<patch>]`
+- `release_branch`: optional, branch that gets stable tags instead of dev tags
-- `author_name`, `author_email`: default `oumta-ci`, `oumta-ci@noreply.git.uesome.de`
+- `release_line`: optional, `<major>.<minor>[.<patch>]`, overrides every other rule
 - `remote`: default `CI_REPO_CLONE_URL`
 
 Example:
@@ -190,12 +197,12 @@ Example:
 ```yaml
 when:
   - event: push
-    branch: [develop, 'feature/**', 'release/**', 'hotfix/**']
+    branch: ['feature/**', 'release/**', 'hotfix/**']
   - event: manual
 
 steps:
   - name: bump
-    image: git.uesome.de/actions/ci-cd/bump:v1.0.0
+    image: git.uesome.de/actions/ci-cd/bump:v2.0.0
     settings:
       git_token:
         from_secret: oumta_ci_token

woodpecker/bump/Dockerfile

@@ -1,5 +1,5 @@
-# Woodpecker plugin: bumps the version in package.json, tags and pushes
+# Woodpecker plugin: derives the next version and pushes it as a tag
-FROM node:24-alpine
+FROM alpine:3.20
 RUN apk add --no-cache bash git ca-certificates
 COPY bump.sh /usr/local/bin/bump.sh
 ENTRYPOINT ["/usr/local/bin/bump.sh"]

woodpecker/bump/bump.sh

@@ -1,11 +1,12 @@
 #!/usr/bin/env bash
-# Woodpecker plugin "bump": sets the version for the pushed branch, commits it
+# Woodpecker plugin "bump": derives the next version for the pushed branch and
-# with [skip ci], tags it and pushes both. The tag event then starts the build;
+# pushes it as a tag on the triggering commit. No commit is made; the build
-# [skip ci] only suppresses push and pull_request events, not tag events.
+# takes the version from the tag (CI_COMMIT_TAG). The tag event then starts
+# the build.
 #
-#   main                  release from the commit message (release/x.y[.z],
+#   release/X.Y[.Z], hotfix/X.Y.Z   next vX.Y.Z-beta.N (D8)
-#                         hotfix/x.y.z), otherwise a patch bump
+#   production/*                    nothing: releases are retags (D9)
-#   release/*, hotfix/*   next vX.Y.Z-beta.N
+#   settings.release_branch         next free vX.Y.Z (repos without majors)
 #   any other branch                vX.Y.Z-dev.<UTC timestamp>
 set -euo pipefail
 
@@ -15,11 +16,13 @@ BRANCH=${CI_COMMIT_BRANCH:?CI_COMMIT_BRANCH is missing (push event only)}
 SHA=${CI_COMMIT_SHA:?CI_COMMIT_SHA is missing}
 REMOTE=${PLUGIN_REMOTE:-${CI_REPO_CLONE_URL:?CI_REPO_CLONE_URL is missing}}
 GIT_USER=${PLUGIN_GIT_USER:-oumta-ci}
+RELEASE_LINE=${PLUGIN_RELEASE_LINE:-}
+RELEASE_BRANCH=${PLUGIN_RELEASE_BRANCH:-}
 [[ -n ${PLUGIN_GIT_TOKEN:-} ]] || die "settings.git_token is missing"
-INPUT_RELEASE_LINE=${PLUGIN_RELEASE_LINE:-}
 
-export GIT_AUTHOR_NAME=${PLUGIN_AUTHOR_NAME:-oumta-ci} GIT_AUTHOR_EMAIL=${PLUGIN_AUTHOR_EMAIL:-oumta-ci@noreply.git.uesome.de}
+case $BRANCH in
-export GIT_COMMITTER_NAME=$GIT_AUTHOR_NAME GIT_COMMITTER_EMAIL=$GIT_AUTHOR_EMAIL
+  production/*) die "no bump on $BRANCH: a release is a retag of a beta image (D9)" ;;
+esac
 
 # Token only via credential helper, never in a URL or config, so no log shows it
 export GIT_USER PLUGIN_GIT_TOKEN
@@ -33,180 +36,123 @@ if [[ $(git rev-parse --is-shallow-repository) == true ]]; then
 fi
 git fetch --quiet --tags --force origin "+refs/heads/*:refs/remotes/origin/*"
 
-# Bump exactly the commit that triggered the pipeline. A newer push on the
+# Tag exactly the commit that triggered the pipeline. A newer push on the
 # branch starts its own pipeline, so this one steps aside.
-if [[ $(git rev-parse "origin/$BRANCH") != "$SHA" ]]; then
+head=$(git rev-parse -q --verify "origin/$BRANCH") || die "$BRANCH no longer exists on origin"
+if [[ $head != "$SHA" ]]; then
   echo "bump: $BRANCH moved past ${SHA:0:8}, the newer pipeline bumps"
   exit 0
 fi
-git checkout --quiet -B "$BRANCH" "$SHA"
+git checkout --quiet "$SHA"
 
-set_version() {
+# A re-run must not produce a second tag and a second build for the same commit.
-  npm version "$1" --no-git-tag-version --allow-same-version >/dev/null
+if existing=$(git tag --points-at HEAD 'v*' | head -n 1) && [[ -n $existing ]]; then
+  echo "bump: ${SHA:0:8} already carries $existing, nothing to do"
+  exit 0
+fi
+
+tag_exists() { git rev-parse -q --verify "refs/tags/v$1" >/dev/null; }
+
+# "2.4" or "v2.4.1" -> "2.4.0" / "2.4.1"; fails for anything else
+parse_line() {
+  [[ $1 =~ ^v?([0-9]+)\.([0-9]+)(\.([0-9]+))?$ ]] || return 1
+  echo "${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.${BASH_REMATCH[4]:-0}"
 }
 
-read_package_version() {
+# release/2.4 -> 2.4.0, hotfix/2.4.1 -> 2.4.1; a hotfix without a patch fails
-  node -p "require('./package.json').version"
+line_of_branch() {
+  local kind name
+  [[ $1 =~ ^(release|hotfix)/(.+)$ ]] || return 1
+  kind=${BASH_REMATCH[1]} name=${BASH_REMATCH[2]}
+  [[ $kind == hotfix && ! $name =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]] && return 1
+  parse_line "$name"
 }
 
-normalize_release_base() {
+# The release or hotfix branch whose merge base with HEAD is the newest, i.e.
-  local value="$1"
+# the line this commit was branched from most recently. On a tie (a hotfix
-  if [[ "${value}" =~ ^v?([0-9]+)\.([0-9]+)$ ]]; then
+# forked from the same commit as the release) the lower line wins.
-    echo "${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.0"
+line_of_nearest_branch() {
-    return 0
+  local ref line base
-  fi
+  while read -r ref; do
-  if [[ "${value}" =~ ^v?([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+    line=$(line_of_branch "${ref#origin/}") || continue
-    echo "${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.${BASH_REMATCH[3]}"
+    base=$(git merge-base "$ref" HEAD 2>/dev/null) || continue
-    return 0
+    echo "$(git show -s --format=%ct "$base") ${line//./ } $line"
-  fi
+  done < <(git for-each-ref --format='%(refname:short)' refs/remotes/origin/release/ refs/remotes/origin/hotfix/) |
-  return 1
+    sort -k1,1nr -k2,2n -k3,3n -k4,4n | head -n 1 | { read -r _ _ _ _ line && echo "$line"; }
 }
 
-extract_release_base() {
+# major.minor.0 from the version in package.json, if there is one
-  local ref_name="$1"
+line_of_package() {
-  local normalized
+  local version
-  if [[ "${ref_name}" =~ ^(release|hotfix)/(.+)$ ]]; then
+  [[ -f package.json ]] || return 1
-    if normalized="$(normalize_release_base "${BASH_REMATCH[2]}")"; then
+  version=$(sed -nE 's/^[[:space:]]*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/p' package.json | head -n 1)
-      echo "${normalized}"
+  version=$(parse_line "${version%%[-+]*}") || return 1
-      return 0
+  echo "${version%.*}.0"
-    fi
-  fi
-  return 1
 }
 
-# Only release branches: a fresh hotfix branch is an ancestor of everything.
+# The line for this branch: setting, branch name, nearest release/hotfix
-infer_release_base_from_ancestor_release_branch() {
+# branch, else major.minor of package.json.
-  local best_release_base=""
+resolve_line() {
-  local best_commit_time=0
+  if [[ -n $RELEASE_LINE ]]; then
-  local remote_ref
+    parse_line "$RELEASE_LINE" || die "invalid settings.release_line '$RELEASE_LINE', expected <major>.<minor>[.<patch>]"
-  local release_base
+    return
-  local commit_time
-
-  while IFS= read -r remote_ref; do
-    if ! release_base="$(extract_release_base "${remote_ref#origin/}")"; then
-      continue
   fi
-    if ! git merge-base --is-ancestor "$(git rev-parse "${remote_ref}")" HEAD; then
+  line_of_branch "$BRANCH" && return
-      continue
+  line_of_nearest_branch && return
-    fi
+  line_of_package && return
-    commit_time="$(git show -s --format=%ct "${remote_ref}")"
+  die "no release line for '$BRANCH': use settings.release_line or a semantic version in package.json"
-    if [[ "${commit_time}" -gt "${best_commit_time}" ]]; then
-      best_commit_time="${commit_time}"
-      best_release_base="${release_base}"
-    fi
-  done < <(git for-each-ref --format='%(refname:short)' refs/remotes/origin/release/)
-
-  [[ -n "${best_release_base}" ]] && echo "${best_release_base}"
 }
 
-resolve_release_base() {
+# The next stable version of a line: highest existing vX.Y.Z plus one patch.
-  local package_version
+next_stable() {
-  local normalized
+  local line=$1 highest
-
+  highest=$(git tag --list "v${line%.*}.*" | sed -nE 's/^v[0-9]+\.[0-9]+\.([0-9]+)$/\1/p' | sort -n | tail -n 1)
-  if [[ -n "${INPUT_RELEASE_LINE}" ]]; then
+  echo "${line%.*}.$(( ${highest:--1} + 1 ))"
-    normalized="$(normalize_release_base "${INPUT_RELEASE_LINE}")" ||
-      die "invalid settings.release_line '${INPUT_RELEASE_LINE}', expected <major>.<minor>[.<patch>]"
-    echo "${normalized}"
-    return 0
-  fi
-  if extract_release_base "${BRANCH}"; then
-    return 0
-  fi
-  if infer_release_base_from_ancestor_release_branch; then
-    return 0
-  fi
-  package_version="$(read_package_version)"
-  if [[ "${package_version}" =~ ^([0-9]+)\.([0-9]+)\.[0-9]+([-.].*)?$ ]]; then
-    echo "${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.0"
-    return 0
-  fi
-  die "no release base for '${BRANCH}': use release/<major>.<minor>[.<patch>], settings.release_line or a semantic version in package.json"
 }
 
-next_beta_version() {
+# A line whose stable tag exists was released; the next patch is the open one.
-  local release_base="$1"
+next_free_patch() {
-  local escaped_base
+  local line=$1 patch
-  local highest_beta
+  while tag_exists "$line"; do
-  escaped_base="$(printf '%s' "${release_base}" | sed 's/\./\\./g')"
+    patch=${line##*.}
-  highest_beta="$(
+    line=${line%.*}.$((patch + 1))
-    git tag --list "v${release_base}-beta.*" \
+  done
-      | sed -nE "s/^v${escaped_base}-beta\.([0-9]+)$/\\1/p" \
+  echo "$line"
-      | sort -n \
-      | tail -n 1
-  )"
-  if [[ -z "${highest_beta}" ]]; then
-    echo "${release_base}-beta.0"
-  else
-    echo "${release_base}-beta.$((highest_beta + 1))"
-  fi
 }
 
-next_dev_version() {
+next_beta() {
-  local release_base="$1"
+  local line=$1 highest
-  local timestamp
+  highest=$(git tag --list "v$line-beta.*" | sed -nE 's/^.*-beta\.([0-9]+)$/\1/p' | sort -n | tail -n 1)
-  while true; do
+  echo "$line-beta.$(( ${highest:--1} + 1 ))"
-    timestamp="$(date -u +%Y%m%d%H%M%S)"
+}
-    if ! git rev-parse -q --verify "refs/tags/v${release_base}-dev.${timestamp}" >/dev/null; then
+
-      echo "${release_base}-dev.${timestamp}"
+next_dev() {
-      return 0
+  local line=$1 stamp
-    fi
+  while :; do
+    stamp=$(date -u +%Y%m%d%H%M%S)
+    tag_exists "$line-dev.$stamp" || { echo "$line-dev.$stamp"; return; }
     sleep 1
   done
 }
 
-next_version() {
+case $BRANCH in
-  case "${BRANCH}" in
+  release/* | hotfix/*)
-    main) npm version patch --no-git-tag-version >/dev/null ;;
+    line=$(line_of_branch "$BRANCH") || die "unusable branch name '$BRANCH', expected release/X.Y[.Z] or hotfix/X.Y.Z"
-    release/* | hotfix/*) set_version "$(next_beta_version "${RELEASE_BASE}")" ;;
+    VERSION=$(next_beta "$(next_free_patch "$line")")
-    *) set_version "$(next_dev_version "${RELEASE_BASE}")" ;;
-  esac
-}
-
-case "${BRANCH}" in
-  main)
-    COMMIT_MSG="$(git log -1 --pretty=%B)"
-    TARGET_VERSION=""
-    if [[ "${COMMIT_MSG}" =~ release/v?([0-9]+\.[0-9]+\.[0-9]+) ]]; then
-      TARGET_VERSION="${BASH_REMATCH[1]}"
-    elif [[ "${COMMIT_MSG}" =~ release/([0-9]+)\.([0-9]+) ]]; then
-      TARGET_VERSION="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.0"
-    elif [[ "${COMMIT_MSG}" =~ hotfix/([0-9]+\.[0-9]+\.[0-9]+) ]]; then
-      TARGET_VERSION="${BASH_REMATCH[1]}"
-    fi
-    if [[ -n "${TARGET_VERSION}" ]]; then
-      set_version "${TARGET_VERSION}"
-    else
-      next_version
-    fi
     ;;
   *)
-    RELEASE_BASE="$(resolve_release_base)"
+    if [[ -n $RELEASE_BRANCH && $BRANCH == "$RELEASE_BRANCH" ]]; then
-    next_version
+      VERSION=$(next_stable "$(resolve_line)")
+    else
+      VERSION=$(next_dev "$(next_free_patch "$(resolve_line)")")
+    fi
     ;;
 esac
+TAG=v$VERSION
 
-VERSION="$(read_package_version)"
+git tag "$TAG"
-while git rev-parse -q --verify "refs/tags/v${VERSION}" >/dev/null; do
+if ! git push --quiet origin "refs/tags/$TAG"; then
-  echo "bump: tag v${VERSION} already exists, trying the next version"
+  echo "bump: push of $TAG rejected, the newer pipeline bumps"
-  next_version
-  VERSION="$(read_package_version)"
-done
-
-TAG="v${VERSION}"
-if git diff --quiet; then
-  echo "bump: no version file changes, tagging the current commit"
-else
-  git add package.json
-  [[ -f package-lock.json ]] && git add package-lock.json
-  git commit --quiet -m "update version: ${TAG} [skip ci]"
-fi
-git tag "${TAG}"
-
-# Branch first, then the tag, so the tag never points at an unpushed commit.
-# If the branch moved meanwhile, the push is rejected and nothing is tagged.
-if ! git push --quiet origin "HEAD:refs/heads/${BRANCH}"; then
-  echo "bump: push to ${BRANCH} rejected, the newer pipeline bumps"
   exit 0
 fi
-git push --quiet origin "refs/tags/${TAG}"
+echo "bump: $TAG on $BRANCH (${SHA:0:8})"
-echo "bump: ${TAG} on ${BRANCH}"