[webern]

Human Summary

Adds an actions program that can take the version number as an input, bump the version and open a PR. Optionally, it can run cargo update as well.

AI Summary

Adds .github/workflows/bump-version.yml, a workflow_dispatch workflow that:

• takes a version input (no leading v, e.g. 3.4.1, format-validated) and an update_crates boolean
• bumps the crate version in Cargo.toml (and Cargo.lock via cargo check)
• optionally runs cargo update when update_crates is true
• runs cargo check and only opens the PR chore: bump version to v<version> if it passes

Security posture follows release.yml: top-level contents: read, with the job scoped to contents: write + pull-requests: write, actions pinned by SHA, inputs validated before checkout, serialized via concurrency, and only runnable from main by users with write access (workflow_dispatch). Note that PRs created with GITHUB_TOKEN do not trigger other workflows, so the in-workspace cargo check is the verification gate.

[sshine]

I have some thoughts, I will provide them tomorrow, 2026-09-28.

[sshine]

• Using sed is a little brittle. Technically, the Cargo.toml format allows for multiple ^version.

  sed -i -E '0,/^version = "[^"]*"/s//version = "'"$VERSION"'"/' Cargo.toml.
  

  at least terminates at the first one.
• cargo check seems like not enough: How about make ci?
• If version is the current one and update_crates is false, git diff --quiet could short-circuit the CI and save quite a few minutes.
• There is no "greater than the previous version" bounds check.
• While release.yml has an unprivileged verify job, bump-version.yml does not.
• # Nothing at the top level sits above permissions: contents: read, which is not nothing.

[webern]

• Using sed is a little brittle. Technically, the Cargo.toml format allows for multiple ^version.

  sed -i -E '0,/^version = "[^"]*"/s//version = "'"$VERSION"'"/' Cargo.toml.
  

  at least terminates at the first one.

• cargo check seems like not enough: How about make ci?

• If version is the current one and update_crates is false, git diff --quiet could short-circuit the CI and save quite a few minutes.

• There is no "greater than the previous version" bounds check.

• While release.yml has an unprivileged verify job, bump-version.yml does not.

• # Nothing at the top level sits above permissions: contents: read, which is not nothing.

Looks like it fixed everything (see quote below). It decided to go with allowing a same version (i.e. no bump) which would then be able to update all deps without bumping the crate version. Seems fine to me. Good call on the permission splitting; fixed. Thank you.

How each comment was handled in .github/workflows/bump-version.yml:

1. sed is brittle: I used his first-match form, so only the first version = line is rewritten. cargo metadata still confirms the new version, and cargo update --workspace updates our own entry in Cargo.lock without touching dependencies.
2. cargo check isn't enough: it now runs make ci.
3. Skip work when nothing changes: if Cargo.toml and Cargo.lock are unchanged, the run logs a notice and skips make ci and the PR.
4. No "greater than the previous version" check: a version lower than the one in Cargo.toml is now rejected. The comparison follows semver rules, so 3.4.1-rc1 counts as lower than 3.4.1.
5. No unprivileged verify job: it's now split like release.yml.
   • A read-only verify job makes the change, runs make ci, and uploads it as a patch.
   • An open-pr job is the only one with write access. It applies that patch to the same commit, pushes the branch and opens the PR. It runs only if verify passed and something changed.
6. Misleading "Nothing at the top level" comment: it now says "Read-only by default; only the open-pr job is granted write access."