From 01d1b2aded071df4a8c85ec2c8ebdb87f762b112 Mon Sep 17 00:00:00 2001 From: Peyton Lee Date: Wed, 16 Sep 2026 13:48:28 -0700 Subject: [PATCH 01/10] feat: Added action for bumping release version --- .bumpversion.toml | 6 +- .github/workflows/release-new-version.yml | 78 +++++++++++++++++++++++ 2 files changed, 81 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/release-new-version.yml diff --git a/.bumpversion.toml b/.bumpversion.toml index 070dbab..bbb618d 100644 --- a/.bumpversion.toml +++ b/.bumpversion.toml @@ -5,9 +5,6 @@ tag = true tag_name = "v{new_version}" current_version = "1.7.1" -[[tool.bumpversion.files]] -glob = "documentation/**/*.md" - [[tool.bumpversion.files]] glob = "*.md" @@ -19,3 +16,6 @@ filename = "pyproject.toml" [[tool.bumpversion.files]] filename = "documentation/getting_started_guide/requirements.txt" + +[[tool.bumpversion.files]] +glob = "documentation/DATA_FORMAT.md" diff --git a/.github/workflows/release-new-version.yml b/.github/workflows/release-new-version.yml new file mode 100644 index 0000000..96294c4 --- /dev/null +++ b/.github/workflows/release-new-version.yml @@ -0,0 +1,78 @@ +name: Release new version + +run-name: Release new version with ${{ inputs.increment }} bump by @${{ github.actor }} + +on: + workflow_dispatch: + inputs: + increment: + description: "Semantic version increment to bump" + default: "patch" + options: + - major + - minor + - patch + required: true + type: choice + +permissions: {} + +jobs: + bump-version: + runs-on: ubuntu-latest + if: ${{ github.ref_name == github.event.repository.default_branch }} + needs: [get-next-version] + + outputs: + version-tag: ${{ steps.get-tag.outputs.VERSION_TAG }} + + permissions: + contents: write # required to push new tag to repo + + steps: + - name: Checkout the repo + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + fetch-depth: 0 # fetch full commit and tag history + filter: blob:none # exclude file contents for faster checkout + persist-credentials: false + + - name: Setup Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: "3.13" + + - name: Install dependencies + run: pip install -e '.[dev]' + + - name: Bump version + run: bump-my-version bump -v ${ BUMP_TYPE } + env: + BUMP_TYPE: ${{ inputs.increment }} + + - name: Push changes and new tag + run: | + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" + git push origin --tags + + - name: Get the new tag + id: get-tag + run: echo "VERSION_TAG=$(git describe --tags --abbrev=0)" >> $GITHUB_ENV + outputs: + VERSION_TAG: ${{ env.VERSION_TAG }} + + create-draft-release: + if: ${{ github.ref_name == github.event.repository.default_branch }} + runs-on: ubuntu-latest + needs: [bump-version] + + permissions: + contents: write # required to push new tag to repo + + steps: + - name: Draft release + run: gh release create v${VERSION_TAG} --draft + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + VERSION_TAG: ${{ needs.bump-version.outputs.version-tag }} From a0e259ce39a54b64863a0caadae1c3d10ab01844 Mon Sep 17 00:00:00 2001 From: Peyton Lee Date: Wed, 16 Sep 2026 13:56:16 -0700 Subject: [PATCH 02/10] fix: Remove unused action step dependency --- .github/workflows/release-new-version.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/release-new-version.yml b/.github/workflows/release-new-version.yml index 96294c4..92af017 100644 --- a/.github/workflows/release-new-version.yml +++ b/.github/workflows/release-new-version.yml @@ -21,7 +21,6 @@ jobs: bump-version: runs-on: ubuntu-latest if: ${{ github.ref_name == github.event.repository.default_branch }} - needs: [get-next-version] outputs: version-tag: ${{ steps.get-tag.outputs.VERSION_TAG }} From dcf6e7bf93e49de87fea945906dc549b224a6b6d Mon Sep 17 00:00:00 2001 From: Peyton Lee Date: Wed, 16 Sep 2026 15:52:34 -0700 Subject: [PATCH 03/10] refactor: Syntax updates, ensure push to main --- .github/workflows/release-new-version.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-new-version.yml b/.github/workflows/release-new-version.yml index 92af017..acebcfc 100644 --- a/.github/workflows/release-new-version.yml +++ b/.github/workflows/release-new-version.yml @@ -19,9 +19,8 @@ permissions: {} jobs: bump-version: - runs-on: ubuntu-latest if: ${{ github.ref_name == github.event.repository.default_branch }} - + runs-on: ubuntu-latest outputs: version-tag: ${{ steps.get-tag.outputs.VERSION_TAG }} @@ -53,11 +52,14 @@ jobs: run: | git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" + git push origin main ${DEFAULT_BRANCH} git push origin --tags + env: + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} - name: Get the new tag id: get-tag - run: echo "VERSION_TAG=$(git describe --tags --abbrev=0)" >> $GITHUB_ENV + run: echo "VERSION_TAG=$(git describe --tags --abbrev=0)" >> "$GITHUB_OUTPUT" outputs: VERSION_TAG: ${{ env.VERSION_TAG }} @@ -67,7 +69,7 @@ jobs: needs: [bump-version] permissions: - contents: write # required to push new tag to repo + contents: write steps: - name: Draft release From c9405e187664698096ccfec06ba0d549ba1da5ff Mon Sep 17 00:00:00 2001 From: Peyton Lee Date: Wed, 16 Sep 2026 15:55:38 -0700 Subject: [PATCH 04/10] fix: Move configuration step, fix output syntax --- .github/workflows/release-new-version.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-new-version.yml b/.github/workflows/release-new-version.yml index acebcfc..aa48159 100644 --- a/.github/workflows/release-new-version.yml +++ b/.github/workflows/release-new-version.yml @@ -43,6 +43,12 @@ jobs: - name: Install dependencies run: pip install -e '.[dev]' + # Configure git before bumping version, since it makes a commit + - name: Configure git + run: | + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" + - name: Bump version run: bump-my-version bump -v ${ BUMP_TYPE } env: @@ -50,8 +56,6 @@ jobs: - name: Push changes and new tag run: | - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" git push origin main ${DEFAULT_BRANCH} git push origin --tags env: @@ -60,8 +64,6 @@ jobs: - name: Get the new tag id: get-tag run: echo "VERSION_TAG=$(git describe --tags --abbrev=0)" >> "$GITHUB_OUTPUT" - outputs: - VERSION_TAG: ${{ env.VERSION_TAG }} create-draft-release: if: ${{ github.ref_name == github.event.repository.default_branch }} From 280c92d34490a92ffa9884387a598620dfddd4de Mon Sep 17 00:00:00 2001 From: Peyton Lee Date: Wed, 16 Sep 2026 15:57:01 -0700 Subject: [PATCH 05/10] fix: Duplicated `v` on release tag --- .github/workflows/release-new-version.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-new-version.yml b/.github/workflows/release-new-version.yml index aa48159..a2be2b6 100644 --- a/.github/workflows/release-new-version.yml +++ b/.github/workflows/release-new-version.yml @@ -75,7 +75,7 @@ jobs: steps: - name: Draft release - run: gh release create v${VERSION_TAG} --draft + run: gh release create ${VERSION_TAG} --draft env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} VERSION_TAG: ${{ needs.bump-version.outputs.version-tag }} From cf745d3be9661360f075682baaa3bfa1affbe045 Mon Sep 17 00:00:00 2001 From: Peyton Lee Date: Wed, 16 Sep 2026 16:02:36 -0700 Subject: [PATCH 06/10] fix: Token permissions, bash spacing, etc. --- .github/workflows/release-new-version.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-new-version.yml b/.github/workflows/release-new-version.yml index a2be2b6..9e30b2d 100644 --- a/.github/workflows/release-new-version.yml +++ b/.github/workflows/release-new-version.yml @@ -32,7 +32,6 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 # fetch full commit and tag history - filter: blob:none # exclude file contents for faster checkout persist-credentials: false - name: Setup Python @@ -50,14 +49,15 @@ jobs: git config user.email "github-actions[bot]@users.noreply.github.com" - name: Bump version - run: bump-my-version bump -v ${ BUMP_TYPE } + run: bump-my-version bump -v ${BUMP_TYPE} env: BUMP_TYPE: ${{ inputs.increment }} - name: Push changes and new tag run: | - git push origin main ${DEFAULT_BRANCH} + git push origin ${DEFAULT_BRANCH} git push origin --tags + token: ${{ secrets.GITHUB_TOKEN }} env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} From c18fd9d947394cf2aee002c5988e8e45aed4d0d5 Mon Sep 17 00:00:00 2001 From: Peyton Lee Date: Wed, 16 Sep 2026 16:14:28 -0700 Subject: [PATCH 07/10] fix: Fix token permissions for checkout + push steps --- .github/workflows/release-new-version.yml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-new-version.yml b/.github/workflows/release-new-version.yml index 9e30b2d..97f2d21 100644 --- a/.github/workflows/release-new-version.yml +++ b/.github/workflows/release-new-version.yml @@ -28,10 +28,21 @@ jobs: contents: write # required to push new tag to repo steps: + # Create a token so it can be used during checkout + push steps; it must + # be explicitly passed to steps that need it. + - name: Generate GitHub App token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.APP_CLIENT_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} + permission-contents: write + - name: Checkout the repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 # fetch full commit and tag history + token: ${{ steps.app-token.outputs.token }} persist-credentials: false - name: Setup Python @@ -57,7 +68,8 @@ jobs: run: | git push origin ${DEFAULT_BRANCH} git push origin --tags - token: ${{ secrets.GITHUB_TOKEN }} + with: + token: ${{ steps.app-token.outputs.token }} env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} From 82e9baf4995d239cb9873fda52836eb1b0f248b3 Mon Sep 17 00:00:00 2001 From: Peyton Lee Date: Wed, 16 Sep 2026 16:35:04 -0700 Subject: [PATCH 08/10] refactor: Configure GitHub access token --- .github/workflows/release-new-version.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-new-version.yml b/.github/workflows/release-new-version.yml index 97f2d21..7c24ef2 100644 --- a/.github/workflows/release-new-version.yml +++ b/.github/workflows/release-new-version.yml @@ -64,13 +64,18 @@ jobs: env: BUMP_TYPE: ${{ inputs.increment }} + # The checkout action normally sets the git access token (via + # persist-credentials), but this can be unsafe! We explicitly set the + # token in the authorization header here, so that other steps don't have + # unintended access to the token. - name: Push changes and new tag run: | + git config http.extraheader "Authorization: Basic $(echo -n x-access-token:${GH_TOKEN} | base64)" git push origin ${DEFAULT_BRANCH} git push origin --tags - with: - token: ${{ steps.app-token.outputs.token }} + git config --unset-all http.extraheader env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} - name: Get the new tag From e8d9fd9283526ad1eb2862a02b2d6cea707e9f1a Mon Sep 17 00:00:00 2001 From: Peyton Lee Date: Wed, 16 Sep 2026 16:44:01 -0700 Subject: [PATCH 09/10] refactor: Push only specific tag --- .github/workflows/release-new-version.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release-new-version.yml b/.github/workflows/release-new-version.yml index 7c24ef2..6ac8ca3 100644 --- a/.github/workflows/release-new-version.yml +++ b/.github/workflows/release-new-version.yml @@ -64,6 +64,10 @@ jobs: env: BUMP_TYPE: ${{ inputs.increment }} + - name: Get the new tag + id: get-tag + run: echo "VERSION_TAG=$(git describe --tags --abbrev=0)" >> "$GITHUB_OUTPUT" + # The checkout action normally sets the git access token (via # persist-credentials), but this can be unsafe! We explicitly set the # token in the authorization header here, so that other steps don't have @@ -72,15 +76,12 @@ jobs: run: | git config http.extraheader "Authorization: Basic $(echo -n x-access-token:${GH_TOKEN} | base64)" git push origin ${DEFAULT_BRANCH} - git push origin --tags + git push origin --tag ${VERSION_TAG} git config --unset-all http.extraheader env: GH_TOKEN: ${{ steps.app-token.outputs.token }} DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} - - - name: Get the new tag - id: get-tag - run: echo "VERSION_TAG=$(git describe --tags --abbrev=0)" >> "$GITHUB_OUTPUT" + VERSION_TAG: ${{ steps.get-tag.outputs.VERSION_TAG }} create-draft-release: if: ${{ github.ref_name == github.event.repository.default_branch }} From ca615bee27e3336e50735be8d508f8b956b76a1f Mon Sep 17 00:00:00 2001 From: Peyton Lee Date: Wed, 16 Sep 2026 16:48:48 -0700 Subject: [PATCH 10/10] fix: Syntax --- .github/workflows/release-new-version.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-new-version.yml b/.github/workflows/release-new-version.yml index 6ac8ca3..4502361 100644 --- a/.github/workflows/release-new-version.yml +++ b/.github/workflows/release-new-version.yml @@ -74,9 +74,9 @@ jobs: # unintended access to the token. - name: Push changes and new tag run: | - git config http.extraheader "Authorization: Basic $(echo -n x-access-token:${GH_TOKEN} | base64)" + git config http.extraheader "Authorization: Basic $(echo -n x-access-token:${GH_TOKEN} | base64 -w 0)" git push origin ${DEFAULT_BRANCH} - git push origin --tag ${VERSION_TAG} + git push origin ${VERSION_TAG} git config --unset-all http.extraheader env: GH_TOKEN: ${{ steps.app-token.outputs.token }}