increment-version-on-merge.yml

name: Increment Version on Merge
run-name: "${{ github.event.pull_request.merged && 'Increment version for' || 'Closing' }} PR #${{ github.event.pull_request.number }}"

permissions: write-all

on:
  # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
  # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
  #
  # GitHub's standard pull_request workflow trigger prevents write permissions and
  # secrets access when the PR is from a public fork.  PRs from branches and forks of
  # internal/private repos are not limited the same way for the pull_request trigger.
  #
  # The pull_request_target trigger (which this workflow is using) relaxes some of those
  # restrictions and allows PRs from public forks to have write permissions through the
  # GH_TOKEN which we need in order to push new tags to the repo through this workflow.
  #
  # For this workflow, the elevated permissions should not be a problem because:
  # • This workflow is only triggered when a PR is closed and the reusable workflow it
  #   calls only executes if it has been merged to the default branch.  This means the PR
  #   has been reviewed and approved by a CODEOWNER and merged by someone with Write
  #   access before this workflow with its elevated permissions gets executed.  Any code
  #   that doesn't meet our standards should be caught before it gets to this point.
  # • The "Require approval for all outside collaborators" setting is set at the org-level.
  #   Before a workflow can execute for a PR generated by an outside collaborator, a user
  #   with Write access must manually approve the request to execute the workflow run.
  #   Prior to doing so they should have had a chance to review any changes in the PR
  pull_request_target:
    types: [closed]
  # paths:
  #   Do not include specific paths here.  reusable-increment-version-on-merge.yml will decide
  #   if this action should be incremented and if new tags should be pushed to the repo based
  #   on the same criteria used in the build-and-review-pr.yml workflow.

jobs:
  increment-version:
    uses: im-open/.github/.github/workflows/reusable-increment-version-on-merge.yml@v1
    with:
      default-branch: main

      # The files that contain source code for the action.  Only files that affect the action's execution
      # should be included like action.yml or package.json.  Do not include files like README.md or .gitignore.
      # Files do not need to be explicitly provided here if they fall under one of the dirs in dirs-with-code.
      # The format of this input is a comma-separated string.
      # ** This value must match the same files-with-code argument specified in build-and-review-pr.yml.
      files-with-code: 'action.yml'

      # The directories that contain source code for the action.  Only dirs with files that affect the action's
      # execution should be included like src or dist.  Do not include dirs like .github or node_modules.
      # The format of this input is a comma-separated string.
      # ** This value must match the same dirs-with-code argument specified in build-and-review-pr.yml.
      dirs-with-code: ''