bump-vscode-typescript.yml

name: Bump vscode-typescript

on:
  workflow_dispatch:
    inputs:
      bump:
        description: Version component to bump
        required: true
        type: choice
        options:
          - patch
          - minor
          - major

run-name: Bump vscode-typescript (${{ inputs.bump }})

permissions:
  contents: read

defaults:
  run:
    shell: bash

jobs:
  prepare:
    if: github.repository == 'microsoft/TypeScript'
    runs-on: ubuntu-latest
    outputs:
      source-sha: ${{ steps.source.outputs.sha }}

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
          filter: blob:none
          fetch-depth: 0
          persist-credentials: false

      - name: Record source commit
        id: source
        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 'lts/*'

      - run: npm ci

      - name: Update extension version
        env:
          BUMP: ${{ inputs.bump }}
        run: |
          set -euo pipefail
          currentVersion="$(jq -r '.version' packages/vscode-typescript/package.json)"
          if [ "$currentVersion" = "0.0.0" ] && [ "$BUMP" != "major" ]; then
            echo "The first extension release must use a major bump from 0.0.0 to 1.0.0." >&2
            exit 1
          fi

          npm version "$BUMP" \
            --workspace native-preview \
            --no-git-tag-version \

          packageVersion="$(jq -r '.version' packages/vscode-typescript/package.json)"
          lockVersion="$(jq -r '.packages["packages/vscode-typescript"].version' package-lock.json)"
          if [ "$packageVersion" != "$lockVersion" ]; then
            echo "package.json version $packageVersion does not match package-lock.json version $lockVersion." >&2
            exit 1
          fi

      - run: npm test -w native-preview

      - name: Package extension
        run: npx hereby vscode-typescript:pack --forRelease --vscodeTypescriptRelease

      - name: Create version bump patch
        run: git diff --binary -- packages/vscode-typescript/package.json package-lock.json > vscode-typescript-bump.patch

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: vscode-typescript-bump
          path: vscode-typescript-bump.patch
          if-no-files-found: error

  create-pr:
    needs: prepare
    if: github.repository == 'microsoft/TypeScript'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    environment:
      name: azure
      deployment: false

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.prepare.outputs.source-sha }}
          filter: blob:none
          fetch-depth: 0
          persist-credentials: false

      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          name: vscode-typescript-bump
          path: ${{ runner.temp }}

      - name: Apply version bump
        run: |
          set -euo pipefail
          git apply --index "$RUNNER_TEMP/vscode-typescript-bump.patch"

          mapfile -t changedFiles < <(git diff --cached --name-only)
          expectedFiles=("package-lock.json" "packages/vscode-typescript/package.json")
          if [ "${changedFiles[*]}" != "${expectedFiles[*]}" ]; then
            echo "Unexpected files in version bump: ${changedFiles[*]}" >&2
            exit 1
          fi

      - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

      - name: Create GitHub App token
        id: app-token
        uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
        with:
          client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
          key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
          owner: microsoft
          repositories: TypeScript
          permission-contents: write
          permission-pull-requests: write

      - name: Commit, push, and open pull request
        env:
          SOURCE_SHA: ${{ needs.prepare.outputs.source-sha }}
          GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }}
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          set -euo pipefail
          EXTENSION_VERSION="$(jq -r '.version' packages/vscode-typescript/package.json)"
          branch="vscode-typescript-release/v$EXTENSION_VERSION"
          git switch -c "$branch"
          git config user.email "290192711+typescript-automation[bot]@users.noreply.github.com"
          git config user.name "typescript-automation[bot]"
          git config core.hooksPath /dev/null
          git commit -m "Bump vscode-typescript to $EXTENSION_VERSION"

          basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')"
          echo "::add-mask::$basic_auth"
          git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}"

          if git ls-remote --exit-code --heads origin "$branch" >/dev/null; then
            git fetch origin "refs/heads/$branch:refs/remotes/origin/$branch"
            existingCommit="$(git rev-parse "origin/$branch")"
            existingParent="$(git rev-parse "origin/$branch^")"
            if [ "$existingParent" != "$SOURCE_SHA" ] || ! git diff --quiet HEAD "$existingCommit"; then
              echo "Existing branch $branch does not match this release bump." >&2
              exit 1
            fi
          else
            git push --set-upstream origin "$branch"
          fi

          existingPr="$(gh pr list \
            --repo microsoft/TypeScript \
            --base main \
            --head "$branch" \
            --state open \
            --json url \
            --jq '.[0].url // empty')"
          if [ -n "$existingPr" ]; then
            echo "Pull request already exists: $existingPr"
          else
            gh pr create \
              --repo microsoft/TypeScript \
              --base main \
              --head "$branch" \
              --title "Bump vscode-typescript to $EXTENSION_VERSION" \
              --body "Updates the vscode-typescript extension to $EXTENSION_VERSION."
          fi