Pin Python to a patch version and auto-bump build version on container changes

2026-08-22 15:05:54 +02:00
parent 20ec627515
commit 59d73c88f6
2 changed files with 25 additions and 2 deletions
@@ -81,13 +81,36 @@ jobs:
            exit 0
          fi

-          IMAGE=git.djeex.fr/djeex/adguard-cidre
+          if echo "$CHANGED" | grep -qE '^VERSION$'; then
+            echo "VERSION was manually edited in this push, using it as-is."
+          else
+            echo "VERSION untouched but container files changed, auto-bumping the build number (Z)."
+            OLD_VERSION=$(tr -d '[:space:]' < VERSION)
+            IFS='.' read -r MAJOR MINOR PATCH <<< "$OLD_VERSION"
+            NEW_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
+            echo "$NEW_VERSION" > VERSION
+
+            git config user.name "adguard-cidre-ci"
+            git config user.email "[email protected]"
+            git add VERSION
+            git commit -m "Bump build version to $NEW_VERSION [skip ci]"
+
+            AUTH=$(printf 'Djeex:%s' "${{ secrets.CI_PUSH_TOKEN }}" | base64)
+            git -c http.extraHeader="Authorization: Basic $AUTH" push origin HEAD:main
+          fi
+
          VERSION=$(tr -d '[:space:]' < VERSION)
+          IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
+          MINOR_TAG="${MAJOR}.${MINOR}"
+
+          IMAGE=git.djeex.fr/djeex/adguard-cidre
          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.djeex.fr -u Djeex --password-stdin

          # Retag the already-built, already-scanned image — never rebuild for publish,
          # so what ships is byte-for-byte what Trivy just scanned.
          docker tag adguard-cidre:ci "$IMAGE:latest"
+          docker tag adguard-cidre:ci "$IMAGE:$MINOR_TAG"
          docker tag adguard-cidre:ci "$IMAGE:$VERSION"
          docker push "$IMAGE:latest"
+          docker push "$IMAGE:$MINOR_TAG"
          docker push "$IMAGE:$VERSION"