createNewVersion.yml

name: Create new version

on:
  workflow_dispatch:
    inputs:
      SEMVER_LEVEL:
        description: One of {BUILD, PATCH, MINOR, MAJOR}
        required: true
        default: BUILD
        type: string

  workflow_call:
    inputs:
      SEMVER_LEVEL:
        description: One of {BUILD, PATCH, MINOR, MAJOR}
        required: false
        default: BUILD
        type: string

    outputs:
      NEW_VERSION:
        description: The new version string
        value: ${{ jobs.createNewVersion.outputs.NEW_VERSION }}

    secrets:
      LARGE_SECRET_PASSPHRASE:
        description: Passphrase used to decrypt GPG key
        required: true
      SLACK_WEBHOOK:
        description: Webhook used to comment in slack
        required: true

jobs:
  validateActor:
    runs-on: ubuntu-latest
    outputs:
      HAS_WRITE_ACCESS: ${{ contains(fromJSON('["write", "admin"]'), steps.getUserPermissions.outputs.PERMISSION) }}
    steps:
      - name: Generate a token
        id: generate_token
        uses: tibdex/github-app-token@c2055a00597a80f713b78b1650e8d3418f4d9a65
        with:
          app_id: ${{ secrets.OS_BOTIFY_APP_ID }}
          private_key: ${{ secrets.OS_BOTIFY_PRIVATE_KEY }}
          installation_id: ${{ secrets.OS_BOTIFY_INSTALLATION_ID }}
      - name: Get user permissions
        id: getUserPermissions
        run: echo "PERMISSION=$(gh api /repos/${{ github.repository }}/collaborators/${{ github.actor }}/permission | jq -r '.permission')" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}

  createNewVersion:
    runs-on: macos-latest
    needs: validateActor
    if: ${{ fromJSON(needs.validateActor.outputs.HAS_WRITE_ACCESS) }}

    outputs:
      NEW_VERSION: ${{ steps.bumpVersion.outputs.NEW_VERSION }}

    steps:
      - uses: softprops/turnstyle@ca99add00ff0c9cbc697d22631d2992f377e5bd5
        with:
          poll-interval-seconds: 10
        env:
          GITHUB_TOKEN: ${{ needs.validatorActor.steps.generate_token.outputs.token }}

      - uses: actions/checkout@v3
        with:
          ref: main
          token: ${{ steps.generate_token.outputs.token }}

      - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main
        with:
          GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}

      - name: Generate version
        id: bumpVersion
        uses: Expensify/App/.github/actions/javascript/bumpVersion@main
        with:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
          SEMVER_LEVEL: ${{ inputs.SEMVER_LEVEL }}

      - name: Commit new version
        run: |
          git add \
            ./package.json \
            ./package-lock.json \
            ./android/app/build.gradle \
            ./ios/NewExpensify/Info.plist \
            ./ios/NewExpensifyTests/Info.plist
          git commit -m "Update version to ${{ steps.bumpVersion.outputs.NEW_VERSION }}"

      - name: Update main branch
        run: git push origin main

      - if: ${{ failure() }}
        uses: Expensify/App/.github/actions/composite/announceFailedWorkflowInSlack@main
        with:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}