From be251ea519528f9a570d4c8837436620236da6d0 Mon Sep 17 00:00:00 2001
From: Ahmet Bora <ahmet@getkirby.com>
Date: Fri, 3 Jul 2026 15:31:13 +0300
Subject: [PATCH] ci: enforce release branch workflow and auto-bump version

Add two GitHub Actions workflows:

- bump-version: on push to release/X.Y.Z, validate the branch name and
  sync composer.json version to match, committing the bump automatically.
- enforce-branch: require PRs targeting main to originate from a
  release/X.Y.Z branch.
---
 .github/workflows/bump-version.yml   | 34 ++++++++++++++++++++++++++++
 .github/workflows/enforce-branch.yml | 18 +++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 .github/workflows/bump-version.yml
 create mode 100644 .github/workflows/enforce-branch.yml

diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
new file mode 100644
index 0000000..d966d3b
--- /dev/null
+++ b/.github/workflows/bump-version.yml
@@ -0,0 +1,34 @@
+name: Bump version
+
+on:
+  push:
+    branches:
+      - 'release/**'
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.ref_name }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Validate & bump
+        run: |
+          VERSION="${GITHUB_REF_NAME#release/}"
+          if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error::Branch name must be release/X.Y.Z (got '$GITHUB_REF_NAME')"
+            exit 1
+          fi
+          CURRENT=$(composer config version 2>/dev/null || echo "")
+          if [ "$CURRENT" != "$VERSION" ]; then
+            composer config version "$VERSION"
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git add composer.json
+            git commit -m "chore: bump composer.json to $VERSION"
+            git push origin "${GITHUB_REF_NAME}"
+          fi
diff --git a/.github/workflows/enforce-branch.yml b/.github/workflows/enforce-branch.yml
new file mode 100644
index 0000000..f8163a8
--- /dev/null
+++ b/.github/workflows/enforce-branch.yml
@@ -0,0 +1,18 @@
+name: Enforce branch
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  check-branch:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate source branch
+        run: |
+          if [[ ! "$GITHUB_HEAD_REF" =~ ^release/[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::PRs to main must come from a release/X.Y.Z branch (got '$GITHUB_HEAD_REF')"
+            exit 1
+          fi
+          echo "OK: source branch '$GITHUB_HEAD_REF' is a valid release branch"