bumpy-comment.yaml

# 🐸 Bumpy PR comment (dogfood)
# Privileged half of the fork-comment split: posts the release-plan comment that
# bumpy-check.yaml rendered. Triggered after that workflow completes. It NEVER checks
# out or runs PR code — it builds MAIN's bumpy and posts a pre-rendered body to the PR
# it resolves from the trusted workflow_run.head_sha. A normal project would just run
# `bunx @varlock/bumpy ci comment` instead of building from source.
#
# ⚠️ DO NOT COPY THIS FILE — see the recommended setup in the docs:
# ➡️ https://bumpy.varlock.dev/blob/main/docs/github-actions.md ⬅️
name: Bumpy PR Comment

on:
  workflow_run:
    workflows: ['Bumpy Check']
    types: [completed]

permissions:
  contents: read
  pull-requests: write

jobs:
  comment:
    runs-on: ubuntu-latest
    steps:
      # TRUSTED: default branch (main) only — never the PR. Build our own bumpy.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
      - run: bun install
      - run: bun run --filter @varlock/bumpy build
      - run: bun install # link the freshly-built CLI bin
      # Download to runner.temp (OUTSIDE the checkout) so the untrusted artifact can't
      # overwrite our trusted files.
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        continue-on-error: true # the check may not have produced a comment
        with:
          name: bumpy-comment
          path: ${{ runner.temp }}/bumpy-comment
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ github.token }}
      - run: bunx @varlock/bumpy ci comment --body-file "$RUNNER_TEMP/bumpy-comment/comment.md"
        env:
          GH_TOKEN: ${{ github.token }}