version-guard.yml

name: version-guard

# Releasing is a maintainer-only action: the maintainer merges a version-bump PR
# into main, and `release-tag.yml` turns that merge into the matching `vX.Y.Z`
# tag, which triggers the release pipeline (dist-generated release.yml builds
# binaries + installers, and publish-crates.yml publishes to crates.io). Since a
# merged bump now cuts a release on its own, this check fails any pull request
# that changes the `version` field.
#
# Maintainer escape hatch: add the `release` label to a PR to allow the version
# bump (e.g. the release PR itself). That same label is what `release-tag.yml`
# requires before it will tag, so this label is the single opt-in for a release.

on:
  pull_request:
    branches: [ "main" ]
    types: [ opened, synchronize, reopened, labeled, unlabeled ]

permissions:
  contents: read

jobs:
  no-version-bump:
    name: Version bump is maintainer-only
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Fail if the crate version changed
        env:
          LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
          BASE_REF: ${{ github.base_ref }}
        run: |
          set -euo pipefail

          if printf '%s' "$LABELS" | grep -q '"release"'; then
            echo "PR carries the 'release' label — version bump allowed."
            exit 0
          fi

          extract() { grep -E -m1 '^version[[:space:]]*=' | sed -E 's/.*"([^"]+)".*/\1/'; }

          git fetch --no-tags --depth=1 origin "$BASE_REF"
          BASE_VERSION="$(git show "FETCH_HEAD:Cargo.toml" | extract)"
          PR_VERSION="$(extract < Cargo.toml)"

          echo "base ($BASE_REF): $BASE_VERSION"
          echo "this PR:          $PR_VERSION"

          if [ "$PR_VERSION" != "$BASE_VERSION" ]; then
            echo "::error file=Cargo.toml::Crate version changed ($BASE_VERSION -> $PR_VERSION). Version bumps trigger an automated release and are maintainer-only. Please revert the version in Cargo.toml — the maintainer bumps it at release time. (Maintainers: add the 'release' label to allow this.)"
            exit 1
          fi

          echo "Crate version unchanged ($BASE_VERSION). OK."