feat: enhance versioning workflow with branch creation and automatic patch application

Author: CasperKristiansson

CHANGELOG.md

@@ -8,6 +8,17 @@ The project follows [Semantic Versioning](https://semver.org/) and adheres to th
 
 - Nothing yet.
 
+## [1.4.0] - 2025-10-10
+
+### Added
+
+- Push the generated `chore/bump-python-<track>` branch before creating the pull request so the GitHub API accepts the head reference.
+- Apply resolved patch versions to the working tree automatically when not in dry-run mode, preserving the minimal diff behaviour.
+
+### Fixed
+
+- Documented the repository-level workflow permission toggle required for PR creation.
+
 ## [1.3.0] - 2025-10-10
 
 - Detect the default branch correctly even when `GITHUB_BASE_REF` is present but empty in scheduled workflows.

README.md

@@ -217,6 +217,8 @@ This workflow requires:
 permissions:
   contents: write
   pull-requests: write
+
+In addition to per-job permissions, the repository (or organization) wide setting under **Settings → Actions → General → Workflow permissions** must grant **Read and write permissions** and enable **“Allow GitHub Actions to create and approve pull requests”**. If that toggle cannot be enabled, provide a classic personal access token with `repo` scope via a secret (for example `PATCH_PR_TOKEN`) and export it as `GITHUB_TOKEN` when running the action.
 ```
 
 ## FAQ

dist/index.js

@@ -80178,17 +80178,56 @@ exports.collectAnHTTPQuotedString = (input, position) => {
 /***/ }),
 
 /***/ 26454:
-/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
 
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.executeAction = executeAction;
+const promises_1 = __nccwpck_require__(51455);
+const node_path_1 = __importDefault(__nccwpck_require__(76760));
 const pr_body_1 = __nccwpck_require__(62706);
 const DEFAULT_IGNORES = ['**/node_modules/**', '**/.git/**', '**/dist/**'];
 function uniqueFiles(matches) {
     return Array.from(new Set(matches.map((match) => match.file))).sort();
 }
+function groupMatchesByFile(matches) {
+    const grouped = new Map();
+    for (const match of matches) {
+        const existing = grouped.get(match.file);
+        if (existing) {
+            existing.push(match);
+        }
+        else {
+            grouped.set(match.file, [match]);
+        }
+    }
+    return grouped;
+}
+async function applyVersionUpdates(workspace, groupedMatches, newVersion) {
+    for (const [relativePath, fileMatches] of groupedMatches) {
+        const absolutePath = node_path_1.default.join(workspace, relativePath);
+        const originalContent = await (0, promises_1.readFile)(absolutePath, 'utf8');
+        const sortedMatches = [...fileMatches].sort((a, b) => b.index - a.index);
+        let updatedContent = originalContent;
+        let changed = false;
+        for (const match of sortedMatches) {
+            if (match.matched === newVersion) {
+                continue;
+            }
+            const start = match.index;
+            const end = start + match.matched.length;
+            updatedContent = updatedContent.slice(0, start) + newVersion + updatedContent.slice(end);
+            changed = true;
+        }
+        if (changed && updatedContent !== originalContent) {
+            await (0, promises_1.writeFile)(absolutePath, updatedContent, 'utf8');
+        }
+    }
+}
 function determineMissingRunners(availability) {
     if (!availability) {
         return ['linux', 'mac', 'win'];
@@ -80328,6 +80367,7 @@ async function executeAction(options, dependencies) {
         };
     }
     const filesChanged = uniqueFiles(matchesNeedingUpdate);
+    const groupedMatches = groupMatchesByFile(matchesNeedingUpdate);
     if (dryRun || !allowPrCreation) {
         return {
             status: 'success',
@@ -80336,6 +80376,14 @@ async function executeAction(options, dependencies) {
             dryRun: true,
         };
     }
+    if (!dependencies.createBranchAndCommit || !dependencies.pushBranch) {
+        return {
+            status: 'success',
+            newVersion: latestVersion,
+            filesChanged,
+            dryRun: false,
+        };
+    }
     if (!githubToken || !repository) {
         return {
             status: 'success',
@@ -80371,17 +80419,36 @@ async function executeAction(options, dependencies) {
         };
     }
     try {
+        await applyVersionUpdates(workspace, groupedMatches, latestVersion);
+        const commitResult = await dependencies.createBranchAndCommit({
+            repoPath: workspace,
+            track,
+            files: filesChanged,
+            commitMessage: `chore: bump python ${track} to ${latestVersion}`,
+        });
+        if (!commitResult.commitCreated) {
+            return {
+                status: 'success',
+                newVersion: latestVersion,
+                filesChanged,
+                dryRun: false,
+            };
+        }
+        await dependencies.pushBranch({
+            repoPath: workspace,
+            branch: commitResult.branch,
+        });
         const prBody = (0, pr_body_1.generatePullRequestBody)({
             track,
             newVersion: latestVersion,
             filesChanged,
-            branchName,
+            branchName: commitResult.branch,
             defaultBranch,
         });
         const pullRequest = await dependencies.createOrUpdatePullRequest({
             owner: repository.owner,
             repo: repository.repo,
-            head: branchName,
+            head: commitResult.branch,
             base: defaultBranch,
             title: `chore: bump python ${track} to ${latestVersion}`,
             body: prBody,
@@ -80442,6 +80509,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createBranchAndCommit = createBranchAndCommit;
+exports.pushBranch = pushBranch;
 const node_child_process_1 = __nccwpck_require__(31421);
 const node_process_1 = __importDefault(__nccwpck_require__(1708));
 const node_util_1 = __nccwpck_require__(57975);
@@ -80510,6 +80578,18 @@ async function createBranchAndCommit(options) {
     });
     return { branch, commitCreated: true, filesCommitted: stagedFiles };
 }
+async function pushBranch(options) {
+    const { repoPath, branch, remote = 'origin', forceWithLease = true, setUpstream = true, } = options;
+    const args = ['push'];
+    if (setUpstream) {
+        args.push('--set-upstream');
+    }
+    if (forceWithLease) {
+        args.push('--force-with-lease');
+    }
+    args.push(remote, branch);
+    await runGit(args, repoPath);
+}
 
 
 /***/ }),
@@ -80520,9 +80600,10 @@ async function createBranchAndCommit(options) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.findExistingPullRequest = exports.createOrUpdatePullRequest = exports.createBranchAndCommit = void 0;
+exports.findExistingPullRequest = exports.createOrUpdatePullRequest = exports.pushBranch = exports.createBranchAndCommit = void 0;
 var branch_1 = __nccwpck_require__(28030);
 Object.defineProperty(exports, "createBranchAndCommit", ({ enumerable: true, get: function () { return branch_1.createBranchAndCommit; } }));
+Object.defineProperty(exports, "pushBranch", ({ enumerable: true, get: function () { return branch_1.pushBranch; } }));
 var pull_request_1 = __nccwpck_require__(10689);
 Object.defineProperty(exports, "createOrUpdatePullRequest", ({ enumerable: true, get: function () { return pull_request_1.createOrUpdatePullRequest; } }));
 Object.defineProperty(exports, "findExistingPullRequest", ({ enumerable: true, get: function () { return pull_request_1.findExistingPullRequest; } }));
@@ -80895,6 +80976,8 @@ function buildDependencies() {
         fetchLatestFromPythonOrg: versioning_1.fetchLatestFromPythonOrg,
         enforcePreReleaseGuard: versioning_1.enforcePreReleaseGuard,
         fetchRunnerAvailability: versioning_1.fetchRunnerAvailability,
+        createBranchAndCommit: git_1.createBranchAndCommit,
+        pushBranch: git_1.pushBranch,
         findExistingPullRequest: git_1.findExistingPullRequest,
         createOrUpdatePullRequest: git_1.createOrUpdatePullRequest,
         fetchReleaseNotes: versioning_1.fetchReleaseNotes,

src/action-execution.ts

@@ -1,3 +1,5 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
 import {
   determineSingleTrack,
   type TrackAlignmentResult,
@@ -12,7 +14,13 @@ import {
   resolveLatestPatch,
   type LatestPatchResult,
 } from './versioning';
-import { createOrUpdatePullRequest, findExistingPullRequest, type PullRequestResult } from './git';
+import {
+  createBranchAndCommit,
+  createOrUpdatePullRequest,
+  findExistingPullRequest,
+  pushBranch,
+  type PullRequestResult,
+} from './git';
 import { generatePullRequestBody } from './pr-body';
 import type { StableTag } from './github';
 
@@ -54,6 +62,8 @@ export interface ExecuteDependencies {
   fetchLatestFromPythonOrg: typeof fetchLatestFromPythonOrg;
   enforcePreReleaseGuard: typeof enforcePreReleaseGuard;
   fetchRunnerAvailability: typeof fetchRunnerAvailability;
+  createBranchAndCommit?: typeof createBranchAndCommit;
+  pushBranch?: typeof pushBranch;
   findExistingPullRequest?: typeof findExistingPullRequest;
   createOrUpdatePullRequest?: typeof createOrUpdatePullRequest;
   fetchReleaseNotes?: typeof fetchReleaseNotes;
@@ -83,6 +93,52 @@ function uniqueFiles(matches: VersionMatch[]): string[] {
   return Array.from(new Set(matches.map((match) => match.file))).sort();
 }
 
+function groupMatchesByFile(matches: VersionMatch[]): Map<string, VersionMatch[]> {
+  const grouped = new Map<string, VersionMatch[]>();
+
+  for (const match of matches) {
+    const existing = grouped.get(match.file);
+    if (existing) {
+      existing.push(match);
+    } else {
+      grouped.set(match.file, [match]);
+    }
+  }
+
+  return grouped;
+}
+
+async function applyVersionUpdates(
+  workspace: string,
+  groupedMatches: Map<string, VersionMatch[]>,
+  newVersion: string,
+): Promise<void> {
+  for (const [relativePath, fileMatches] of groupedMatches) {
+    const absolutePath = path.join(workspace, relativePath);
+    const originalContent = await readFile(absolutePath, 'utf8');
+
+    const sortedMatches = [...fileMatches].sort((a, b) => b.index - a.index);
+
+    let updatedContent = originalContent;
+    let changed = false;
+
+    for (const match of sortedMatches) {
+      if (match.matched === newVersion) {
+        continue;
+      }
+
+      const start = match.index;
+      const end = start + match.matched.length;
+      updatedContent = updatedContent.slice(0, start) + newVersion + updatedContent.slice(end);
+      changed = true;
+    }
+
+    if (changed && updatedContent !== originalContent) {
+      await writeFile(absolutePath, updatedContent, 'utf8');
+    }
+  }
+}
+
 function determineMissingRunners(
   availability: Awaited<ReturnType<typeof fetchRunnerAvailability>>,
 ): string[] {
@@ -273,6 +329,7 @@ export async function executeAction(
   }
 
   const filesChanged = uniqueFiles(matchesNeedingUpdate);
+  const groupedMatches = groupMatchesByFile(matchesNeedingUpdate);
 
   if (dryRun || !allowPrCreation) {
     return {
@@ -283,6 +340,15 @@ export async function executeAction(
     } satisfies SuccessResult;
   }
 
+  if (!dependencies.createBranchAndCommit || !dependencies.pushBranch) {
+    return {
+      status: 'success',
+      newVersion: latestVersion,
+      filesChanged,
+      dryRun: false,
+    } satisfies SuccessResult;
+  }
+
   if (!githubToken || !repository) {
     return {
       status: 'success',
@@ -323,18 +389,41 @@ export async function executeAction(
   }
 
   try {
+    await applyVersionUpdates(workspace, groupedMatches, latestVersion);
+
+    const commitResult = await dependencies.createBranchAndCommit({
+      repoPath: workspace,
+      track,
+      files: filesChanged,
+      commitMessage: `chore: bump python ${track} to ${latestVersion}`,
+    });
+
+    if (!commitResult.commitCreated) {
+      return {
+        status: 'success',
+        newVersion: latestVersion,
+        filesChanged,
+        dryRun: false,
+      } satisfies SuccessResult;
+    }
+
+    await dependencies.pushBranch({
+      repoPath: workspace,
+      branch: commitResult.branch,
+    });
+
     const prBody = generatePullRequestBody({
       track,
       newVersion: latestVersion,
       filesChanged,
-      branchName,
+      branchName: commitResult.branch,
       defaultBranch,
     });
 
     const pullRequest = await dependencies.createOrUpdatePullRequest({
       owner: repository.owner,
       repo: repository.repo,
-      head: branchName,
+      head: commitResult.branch,
       base: defaultBranch,
       title: `chore: bump python ${track} to ${latestVersion}`,
       body: prBody,

src/git/branch.ts

@@ -20,6 +20,14 @@ export interface BranchCommitResult {
   filesCommitted: string[];
 }
 
+export interface PushBranchOptions {
+  repoPath: string;
+  branch: string;
+  remote?: string;
+  forceWithLease?: boolean;
+  setUpstream?: boolean;
+}
+
 async function branchExists(branch: string, repoPath: string): Promise<boolean> {
   try {
     await runGit(['show-ref', '--verify', `refs/heads/${branch}`], repoPath);
@@ -105,3 +113,27 @@ export async function createBranchAndCommit(
 
   return { branch, commitCreated: true, filesCommitted: stagedFiles };
 }
+
+export async function pushBranch(options: PushBranchOptions): Promise<void> {
+  const {
+    repoPath,
+    branch,
+    remote = 'origin',
+    forceWithLease = true,
+    setUpstream = true,
+  } = options;
+
+  const args = ['push'];
+
+  if (setUpstream) {
+    args.push('--set-upstream');
+  }
+
+  if (forceWithLease) {
+    args.push('--force-with-lease');
+  }
+
+  args.push(remote, branch);
+
+  await runGit(args, repoPath);
+}

src/git/index.ts

@@ -1,5 +1,5 @@
-export { createBranchAndCommit } from './branch';
-export type { BranchCommitOptions, BranchCommitResult } from './branch';
+export { createBranchAndCommit, pushBranch } from './branch';
+export type { BranchCommitOptions, BranchCommitResult, PushBranchOptions } from './branch';
 
 export { createOrUpdatePullRequest, findExistingPullRequest } from './pull-request';
 export type { PullRequestOptions, PullRequestResult, OctokitClient } from './pull-request';