name: Bump version

on:
  push:
    branches:
      - master

# Ensure only one version bump runs at a time. Concurrent runs would race to
# bump the version and push tags, which has caused release failures in the past.
# Queue subsequent pushes instead of cancelling an in-flight bump/release.
concurrency:
  group: bump-version
  cancel-in-progress: false

jobs:
  bump-version:
    if: "!startsWith(github.event.head_commit.message, 'bump:') && !startsWith(github.event.head_commit.message, 'chore(release):')"
    runs-on: ubuntu-latest
    name: "Bump version and create changelog"
    permissions:
      contents: write
    outputs:
      bumped: ${{ steps.bump.outputs.bumped }}
      tag: ${{ steps.bump.outputs.tag }}
    steps:
      - name: Check out
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.11'

      - name: Install uv
        run: |
          curl -LsSf https://astral.sh/uv/install.sh | sh
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH

      - name: Configure git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Detect and bump version
        id: bump
        run: |
          set -euo pipefail

          echo "Checking for version bump..."

          # Record the current version tag before attempting a bump. commitizen
          # is the single source of truth for whether a release is warranted: it
          # only bumps for feat/fix/breaking changes and emits
          # [NO_COMMITS_TO_BUMP] (exit 0) for release-irrelevant commits such as
          # ci:, docs:, chore:, etc. We therefore let it decide and detect a
          # release by whether the latest tag actually changed.
          tag_before=$(git tag --sort=-creatordate | grep -E '^v[0-9]' | head -n 1 || echo "")
          echo "Latest tag before bump: ${tag_before:-<none>}"

          # Run the bump. The script exits 0 both when it bumps and when there
          # is nothing to bump, so we compare tags rather than trusting exit code.
          ./scripts/bump-mcp.sh

          tag_after=$(git tag --sort=-creatordate | grep -E '^v[0-9]' | head -n 1 || echo "")
          echo "Latest tag after bump: ${tag_after:-<none>}"

          if [ -n "$tag_after" ] && [ "$tag_after" != "$tag_before" ]; then
            echo "Version bumped to $tag_after"
            echo "bumped=true" >> $GITHUB_OUTPUT
            echo "tag=$tag_after" >> $GITHUB_OUTPUT
          else
            echo "No version bump required (no release-relevant commits)"
            echo "bumped=false" >> $GITHUB_OUTPUT
          fi

      - name: Push tags
        if: steps.bump.outputs.bumped == 'true'
        run: |
          git push
          git push --tags

      - name: Summary
        run: |
          if [ "${{ steps.bump.outputs.bumped }}" == "true" ]; then
            tag=$(git tag --sort=-creatordate | grep -E '^v[0-9]' | head -n 1)
            echo "## Version Bump Summary" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "- **MCP Server**: \`$tag\`" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "Tag has been pushed and release workflows will trigger automatically." >> $GITHUB_STEP_SUMMARY
          else
            echo "## Version Bump Summary" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "No version bump required - no relevant commits found since last release." >> $GITHUB_STEP_SUMMARY
          fi

  release:
    needs: bump-version
    if: needs.bump-version.outputs.bumped == 'true'
    uses: ./.github/workflows/release.yml
    with:
      tag: ${{ needs.bump-version.outputs.tag }}
    permissions:
      id-token: write
      contents: read

  docker:
    needs: bump-version
    if: needs.bump-version.outputs.bumped == 'true'
    uses: ./.github/workflows/docker-build-publish.yml
    with:
      tag: ${{ needs.bump-version.outputs.tag }}
    permissions:
      contents: read
      packages: write