ci-cd/woodpecker/bump/bump.sh

#!/usr/bin/env bash
# Woodpecker plugin "bump": sets the version for the pushed branch, commits it
# with [skip ci], tags it and pushes both. The tag event then starts the build;
# [skip ci] only suppresses push and pull_request events, not tag events.
#
#   main                  release from the commit message (release/x.y[.z],
#                         hotfix/x.y.z), otherwise a patch bump
#   release/*, hotfix/*   next vX.Y.Z-beta.N
#   any other branch      vX.Y.Z-dev.<UTC timestamp>
set -euo pipefail

die() { echo "bump: $*" >&2; exit 1; }

BRANCH=${CI_COMMIT_BRANCH:?CI_COMMIT_BRANCH is missing (push event only)}
SHA=${CI_COMMIT_SHA:?CI_COMMIT_SHA is missing}
REMOTE=${PLUGIN_REMOTE:-${CI_REPO_CLONE_URL:?CI_REPO_CLONE_URL is missing}}
GIT_USER=${PLUGIN_GIT_USER:-oumta-ci}
[[ -n ${PLUGIN_GIT_TOKEN:-} ]] || die "settings.git_token is missing"
INPUT_RELEASE_LINE=${PLUGIN_RELEASE_LINE:-}

export GIT_AUTHOR_NAME=${PLUGIN_AUTHOR_NAME:-oumta-ci} GIT_AUTHOR_EMAIL=${PLUGIN_AUTHOR_EMAIL:-oumta-ci@noreply.git.uesome.de}
export GIT_COMMITTER_NAME=$GIT_AUTHOR_NAME GIT_COMMITTER_EMAIL=$GIT_AUTHOR_EMAIL

# Token only via credential helper, never in a URL or config, so no log shows it
export GIT_USER PLUGIN_GIT_TOKEN
git config --global --add safe.directory "$PWD"
git config credential.helper '!f() { echo "username=$GIT_USER"; echo "password=$PLUGIN_GIT_TOKEN"; }; f'
git remote set-url origin "$REMOTE"

# The Woodpecker clone is shallow and has no tags; the version rules need both.
if [[ $(git rev-parse --is-shallow-repository) == true ]]; then
  git fetch --quiet --unshallow origin
fi
git fetch --quiet --tags --force origin "+refs/heads/*:refs/remotes/origin/*"

# Bump exactly the commit that triggered the pipeline. A newer push on the
# branch starts its own pipeline, so this one steps aside.
if [[ $(git rev-parse "origin/$BRANCH") != "$SHA" ]]; then
  echo "bump: $BRANCH moved past ${SHA:0:8}, the newer pipeline bumps"
  exit 0
fi
git checkout --quiet -B "$BRANCH" "$SHA"

set_version() {
  npm version "$1" --no-git-tag-version --allow-same-version >/dev/null
}

read_package_version() {
  node -p "require('./package.json').version"
}

normalize_release_base() {
  local value="$1"
  if [[ "${value}" =~ ^v?([0-9]+)\.([0-9]+)$ ]]; then
    echo "${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.0"
    return 0
  fi
  if [[ "${value}" =~ ^v?([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
    echo "${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.${BASH_REMATCH[3]}"
    return 0
  fi
  return 1
}

extract_release_base() {
  local ref_name="$1"
  local normalized
  if [[ "${ref_name}" =~ ^(release|hotfix)/(.+)$ ]]; then
    if normalized="$(normalize_release_base "${BASH_REMATCH[2]}")"; then
      echo "${normalized}"
      return 0
    fi
  fi
  return 1
}

# Only release branches: a fresh hotfix branch is an ancestor of everything.
infer_release_base_from_ancestor_release_branch() {
  local best_release_base=""
  local best_commit_time=0
  local remote_ref
  local release_base
  local commit_time

  while IFS= read -r remote_ref; do
    if ! release_base="$(extract_release_base "${remote_ref#origin/}")"; then
      continue
    fi
    if ! git merge-base --is-ancestor "$(git rev-parse "${remote_ref}")" HEAD; then
      continue
    fi
    commit_time="$(git show -s --format=%ct "${remote_ref}")"
    if [[ "${commit_time}" -gt "${best_commit_time}" ]]; then
      best_commit_time="${commit_time}"
      best_release_base="${release_base}"
    fi
  done < <(git for-each-ref --format='%(refname:short)' refs/remotes/origin/release/)

  [[ -n "${best_release_base}" ]] && echo "${best_release_base}"
}

resolve_release_base() {
  local package_version
  local normalized

  if [[ -n "${INPUT_RELEASE_LINE}" ]]; then
    normalized="$(normalize_release_base "${INPUT_RELEASE_LINE}")" ||
      die "invalid settings.release_line '${INPUT_RELEASE_LINE}', expected <major>.<minor>[.<patch>]"
    echo "${normalized}"
    return 0
  fi
  if extract_release_base "${BRANCH}"; then
    return 0
  fi
  if infer_release_base_from_ancestor_release_branch; then
    return 0
  fi
  package_version="$(read_package_version)"
  if [[ "${package_version}" =~ ^([0-9]+)\.([0-9]+)\.[0-9]+([-.].*)?$ ]]; then
    echo "${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.0"
    return 0
  fi
  die "no release base for '${BRANCH}': use release/<major>.<minor>[.<patch>], settings.release_line or a semantic version in package.json"
}

next_beta_version() {
  local release_base="$1"
  local escaped_base
  local highest_beta
  escaped_base="$(printf '%s' "${release_base}" | sed 's/\./\\./g')"
  highest_beta="$(
    git tag --list "v${release_base}-beta.*" \
      | sed -nE "s/^v${escaped_base}-beta\.([0-9]+)$/\\1/p" \
      | sort -n \
      | tail -n 1
  )"
  if [[ -z "${highest_beta}" ]]; then
    echo "${release_base}-beta.0"
  else
    echo "${release_base}-beta.$((highest_beta + 1))"
  fi
}

next_dev_version() {
  local release_base="$1"
  local timestamp
  while true; do
    timestamp="$(date -u +%Y%m%d%H%M%S)"
    if ! git rev-parse -q --verify "refs/tags/v${release_base}-dev.${timestamp}" >/dev/null; then
      echo "${release_base}-dev.${timestamp}"
      return 0
    fi
    sleep 1
  done
}

next_version() {
  case "${BRANCH}" in
    main) npm version patch --no-git-tag-version >/dev/null ;;
    release/* | hotfix/*) set_version "$(next_beta_version "${RELEASE_BASE}")" ;;
    *) set_version "$(next_dev_version "${RELEASE_BASE}")" ;;
  esac
}

case "${BRANCH}" in
  main)
    COMMIT_MSG="$(git log -1 --pretty=%B)"
    TARGET_VERSION=""
    if [[ "${COMMIT_MSG}" =~ release/v?([0-9]+\.[0-9]+\.[0-9]+) ]]; then
      TARGET_VERSION="${BASH_REMATCH[1]}"
    elif [[ "${COMMIT_MSG}" =~ release/([0-9]+)\.([0-9]+) ]]; then
      TARGET_VERSION="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.0"
    elif [[ "${COMMIT_MSG}" =~ hotfix/([0-9]+\.[0-9]+\.[0-9]+) ]]; then
      TARGET_VERSION="${BASH_REMATCH[1]}"
    fi
    if [[ -n "${TARGET_VERSION}" ]]; then
      set_version "${TARGET_VERSION}"
    else
      next_version
    fi
    ;;
  *)
    RELEASE_BASE="$(resolve_release_base)"
    next_version
    ;;
esac

VERSION="$(read_package_version)"
while git rev-parse -q --verify "refs/tags/v${VERSION}" >/dev/null; do
  echo "bump: tag v${VERSION} already exists, trying the next version"
  next_version
  VERSION="$(read_package_version)"
done

TAG="v${VERSION}"
if git diff --quiet; then
  echo "bump: no version file changes, tagging the current commit"
else
  git add package.json
  [[ -f package-lock.json ]] && git add package-lock.json
  git commit --quiet -m "update version: ${TAG} [skip ci]"
fi
git tag "${TAG}"

# Branch first, then the tag, so the tag never points at an unpushed commit.
# If the branch moved meanwhile, the push is rejected and nothing is tagged.
if ! git push --quiet origin "HEAD:refs/heads/${BRANCH}"; then
  echo "bump: push to ${BRANCH} rejected, the newer pipeline bumps"
  exit 0
fi
git push --quiet origin "refs/tags/${TAG}"
echo "bump: ${TAG} on ${BRANCH}"