Release: develop -> main

.coverage-floor-functions

@@ -0,0 +1 @@
+50

.coverage-floor-lines

@@ -0,0 +1 @@
+100

.github/workflows/auto-release-pr.yaml

@@ -17,6 +17,7 @@ jobs:
   create-release-pr:
     name: Create Release PR
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -29,6 +30,7 @@ jobs:
       - name: Check for existing PR
         id: check-pr
         run: |
+          set -euo pipefail
           PR_COUNT=$(gh pr list --base main --head develop --state open --json number --jq 'length')
           echo "pr_exists=$([[ $PR_COUNT -gt 0 ]] && echo 'true' || echo 'false')" >> $GITHUB_OUTPUT
           echo "::notice::Open PRs from develop to main: $PR_COUNT"
@@ -39,6 +41,7 @@ jobs:
         id: check-diff
         if: steps.check-pr.outputs.pr_exists == 'false'
         run: |
+          set -euo pipefail
           DIFF_COUNT=$(git rev-list --count origin/main..origin/develop)
           echo "has_changes=$([[ $DIFF_COUNT -gt 0 ]] && echo 'true' || echo 'false')" >> $GITHUB_OUTPUT
           echo "commit_count=$DIFF_COUNT" >> $GITHUB_OUTPUT
@@ -50,6 +53,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           COMMIT_COUNT: ${{ steps.check-diff.outputs.commit_count }}
         run: |
+          set -euo pipefail
           printf '%s\n' \
             "## Automatic Release PR" \
             "" \

.github/workflows/auto-staging-pr.yaml

@@ -0,0 +1,74 @@
+name: Auto Staging PR
+
+on:
+  push:
+    branches: [staging]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: auto-staging-pr
+  cancel-in-progress: false
+
+jobs:
+  create-staging-pr:
+    name: Create Staging PR
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Fetch develop branch
+        run: git fetch origin develop
+
+      - name: Check for existing PR
+        id: check-pr
+        run: |
+          set -euo pipefail
+          PR_COUNT=$(gh pr list --base develop --head staging --state open --json number --jq 'length')
+          echo "pr_exists=$([[ $PR_COUNT -gt 0 ]] && echo 'true' || echo 'false')" >> $GITHUB_OUTPUT
+          echo "::notice::Open PRs from staging to develop: $PR_COUNT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check for differences
+        id: check-diff
+        if: steps.check-pr.outputs.pr_exists == 'false'
+        run: |
+          set -euo pipefail
+          DIFF_COUNT=$(git rev-list --count origin/develop..origin/staging)
+          echo "has_changes=$([[ $DIFF_COUNT -gt 0 ]] && echo 'true' || echo 'false')" >> $GITHUB_OUTPUT
+          echo "commit_count=$DIFF_COUNT" >> $GITHUB_OUTPUT
+          echo "::notice::Commits ahead of develop: $DIFF_COUNT"
+
+      - name: Create Staging PR
+        if: steps.check-pr.outputs.pr_exists == 'false' && steps.check-diff.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          COMMIT_COUNT: ${{ steps.check-diff.outputs.commit_count }}
+        run: |
+          set -euo pipefail
+          printf '%s\n' \
+            "## Automatic Staging PR" \
+            "" \
+            "This PR was automatically created after changes were pushed to staging." \
+            "" \
+            "**Commits:** ${COMMIT_COUNT} new commit(s)" \
+            "" \
+            "### Checklist" \
+            "- [ ] Review all changes" \
+            "- [ ] Verify CI passes" \
+            "- [ ] Approve and merge to promote into develop" \
+            > /tmp/pr-body.md
+
+          gh pr create \
+            --base develop \
+            --head staging \
+            --title "Promote: staging -> develop" \
+            --body-file /tmp/pr-body.md

.github/workflows/auto-tag.yaml

@@ -2,7 +2,7 @@ name: Auto Tag on Merge
 
 on:
   push:
-    branches: [main, develop]
+    branches: [develop]
 
 permissions:
   contents: write
@@ -15,6 +15,7 @@ jobs:
   create-tag:
     name: Create Release Tag
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -28,13 +29,22 @@ jobs:
           ssh-private-key: ${{ secrets.TAG_DEPLOY_KEY }}
 
       - name: Configure Git for SSH
-        run: git remote set-url origin git@github.com:DFXswiss/realunit-app.git
+        # `${{ github.repository }}` resolves to `<owner>/<repo>` for the
+        # currently running workflow — keeps the remote correct if the repo
+        # is renamed or transferred between orgs, without a follow-up edit.
+        run: git remote set-url origin git@github.com:${{ github.repository }}.git
 
       - name: Get latest tag
         id: get-tag
         run: |
-          # Get only clean semver tags (vX.Y.Z), exclude pre-release tags
-          LATEST_TAG=$(git tag -l --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n 1)
+          set -euo pipefail
+          # Only consider clean semver tags (vX.Y.Z). Legacy beta tags
+          # (vX.Y.Z-beta.N) are ignored — they were superseded by the
+          # plain-SemVer schema. The trailing `|| true` keeps the
+          # pipeline tolerant of an empty grep under `pipefail`: a
+          # fresh repo with zero matching tags is a legitimate state
+          # that the next `[ -z ... ]` branch handles explicitly.
+          LATEST_TAG=$(git tag -l --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n 1 || true)
 
           if [ -z "$LATEST_TAG" ]; then
             echo "No existing tags found, starting with v0.0.0"
@@ -47,41 +57,42 @@ jobs:
       - name: Calculate next version
         id: next-version
         run: |
+          set -euo pipefail
           LATEST_TAG="${{ steps.get-tag.outputs.latest_tag }}"
-          BRANCH="${{ github.ref_name }}"
 
           # Remove 'v' prefix and split into parts
           VERSION="${LATEST_TAG#v}"
           MAJOR=$(echo "$VERSION" | cut -d. -f1)
           MINOR=$(echo "$VERSION" | cut -d. -f2)
           PATCH=$(echo "$VERSION" | cut -d. -f3)
 
-          # Next release version
+          # Default: patch-bump on top of latest tag.
           NEW_PATCH=$((PATCH + 1))
           NEXT_VERSION="v${MAJOR}.${MINOR}.${NEW_PATCH}"
 
-          if [ "$BRANCH" = "main" ]; then
-            NEW_TAG="$NEXT_VERSION"
-          else
-            # For develop: find latest beta tag for the next version
-            LATEST_BETA=$(git tag -l --sort=-v:refname "${NEXT_VERSION}-beta.*" | head -n 1)
-
-            if [ -z "$LATEST_BETA" ]; then
-              NEW_TAG="${NEXT_VERSION}-beta.1"
-            else
-              # Extract beta number and increment
-              BETA_NUM=$(echo "$LATEST_BETA" | sed "s/${NEXT_VERSION}-beta\.//")
-              NEW_BETA=$((BETA_NUM + 1))
-              NEW_TAG="${NEXT_VERSION}-beta.${NEW_BETA}"
-            fi
+          # Floor for major/minor jumps: when pubspec.yaml is ahead of the
+          # patch-bumped tag, use pubspec instead. Patch increments still come
+          # from the tag history; pubspec is only consulted to trigger jumps.
+          # `|| true` keeps the pipeline tolerant of an empty grep under
+          # `pipefail`: a pubspec without a `version:` line is a legitimate
+          # state that the next `[ -n ... ]` branch handles explicitly.
+          PUBSPEC_VERSION=$(grep -E '^version:[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+' pubspec.yaml \
+            | awk '{print $2}' | cut -d+ -f1 || true)
+          if [ -n "$PUBSPEC_VERSION" ]; then
+            HIGHEST=$(printf '%s\n%s\n' "${NEXT_VERSION#v}" "$PUBSPEC_VERSION" | sort -V | tail -n 1)
+            NEXT_VERSION="v${HIGHEST}"
+            echo "::notice::pubspec marketing version: $PUBSPEC_VERSION; resolved next: $NEXT_VERSION"
           fi
 
+          NEW_TAG="$NEXT_VERSION"
+
           echo "new_tag=$NEW_TAG" >> $GITHUB_OUTPUT
           echo "::notice::New tag: $NEW_TAG"
 
       - name: Check if tag exists
         id: check-tag
         run: |
+          set -euo pipefail
           NEW_TAG="${{ steps.next-version.outputs.new_tag }}"
           if git rev-parse "$NEW_TAG" >/dev/null 2>&1; then
             echo "::error::Tag $NEW_TAG already exists!"
@@ -93,6 +104,7 @@ jobs:
       - name: Create and push tag
         if: steps.check-tag.outputs.exists == 'false'
         run: |
+          set -euo pipefail
           NEW_TAG="${{ steps.next-version.outputs.new_tag }}"
 
           git config user.name "github-actions[bot]"