ci: add workflow to create a PR for crate bumps
What changed, and why it matters
This commit adds a new GitHub Actions workflow that automates the creation of pull requests to bump the version numbers of Rust crates in the Core Lightning project. It is a routine development and release automation change with no direct security relevance.
No security action required. As a standard hygiene measure, ensure the workflow's `GITHUB_TOKEN` permissions follow the principle of least privilege (the default `contents: write` and `pull-requests: write` are typical for create-pull-request workflows).
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit introduces .github/workflows/crate-bump.yml, a manually-triggered (workflow_dispatch) CI workflow. It checks out the repository, installs Rust tooling (cargo-release, cargo-semver-checks), determines the appropriate semantic version bump for a selected crate (cln-plugin, cln-rpc, or cln-grpc), applies the version bump, and opens a pull request using the standard GITHUB_TOKEN. The workflow uses pinned versions for third-party actions and pinned tool versions.
Changed components
.github/workflows/crate-bump.ymlInspect captured patch +68 / −0
diff --git a/.github/workflows/crate-bump.yml b/.github/workflows/crate-bump.yml
new file mode 100644
index 00000000..418fe10f
--- /dev/null
+++ b/.github/workflows/crate-bump.yml
@@ -0,0 +1,68 @@
+name: Bump Rust 🦀 crate version
+
+on:
+ workflow_dispatch:
+ inputs:
+ dist-location:
+ description: 'Distribution location'
+ type: choice
+ options:
+ - cln-plugin
+ - cln-rpc
+ - cln-grpc
+ default: 'cln-plugin'
+ required: true
+
+jobs:
+ bump:
+ runs-on: ubuntu-latest
+ timeout-minutes: 60
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+
+ - name: Setup protoc
+ uses: arduino/setup-protoc@v3
+
+ - name: Setup rust
+ uses: dtolnay/rust-toolchain@1.77
+
+ - name: Install cargo binstall
+ uses: cargo-bins/cargo-binstall@main
+
+ - name: Install cargo-release and cargo-semver-checks
+ run: |
+ cargo binstall cargo-release --version 0.25.10
+ cargo binstall cargo-semver-checks --version 0.36.0
+
+ - name: Determine version
+ id: determine-version
+ run: |
+ if cargo semver-checks -p ${{ github.event.inputs.dist-location }} --release-type patch; then
+ echo "bump=patch" >> $GITHUB_OUTPUT
+ elif cargo semver-checks -p ${{ github.event.inputs.dist-location }} --release-type minor; then
+ echo "bump=minor" >> $GITHUB_OUTPUT
+ elif cargo semver-checks -p ${{ github.event.inputs.dist-location }} --release-type major; then
+ echo "bump=minor" >> $GITHUB_OUTPUT
+ else
+ echo "bump=unknown" >> $GITHUB_OUTPUT
+ exit 1
+ fi
+
+ - name: Bump version
+ run: |
+ cargo release version -p ${{ github.event.inputs.dist-location }} ${{ steps.determine-version.outputs.bump }} --execute --no-confirm
+
+ - name: Create Pull Request
+ uses: peter-evans/create-pull-request@v7
+ with:
+ token: ${{ secrets.GITHUB_TOKEN }}
+ commit-message: "${{ github.event.inputs.dist-location }}: Bump the ${{ steps.determine-version.outputs.bump }} version"
+ title: "${{ github.event.inputs.dist-location }}: Bump the ${{ steps.determine-version.outputs.bump }} version"
+ body: |
+ Triggered manually with option: ${{ github.event.inputs.dist-location }}
+ Version bump determined by `cargo semver-checks`
+ branch: "${{ github.event.inputs.dist-location }}-version-bump"
+ base: master
+ labels: version-bump, automated
+ delete-branch: true
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.