Adjust workflow tags to be full semver

.github/actions/start-tsp/action.yaml

@@ -7,7 +7,7 @@
 #
 # Example usage (be sure to decrypt the env file first):
 # - name: Start TSP
-#   uses: IronCoreLabs/workflows/.github/actions/start-tsp@start-tsp-v1
+#   uses: IronCoreLabs/workflows/.github/actions/start-tsp@start-tsp-v1.0.0
 #   with:
 #     gcloud-auth: ${{ secrets.GCLOUD_AUTH }}
 #     env-file-path: .github/.env.integration

.github/move-tags.list.sh

@@ -5,10 +5,10 @@
 # content. See RELEASING.md and move-tags.yaml for details.
 #
 # Each reusable workflow and composite action declares its major version in a
-# "# tag-version: vN" comment in its yaml file. For each declaration, the tag "NAME-vN"
-# is printed on stdout if it doesn't exist, or if the workflow's files (the yaml file
-# plus any ".github/NAME.*.sh" helper scripts, or the action's directory) differ
-# between the tag and HEAD.
+# "# tag-version: vN" comment in its yaml file. For each declaration, the tag
+# "NAME-vN.0.0" is printed on stdout if it doesn't exist, or if the workflow's files
+# (the yaml file plus any ".github/NAME.*.sh" helper scripts, or the action's
+# directory) differ between the tag and HEAD.
 #
 # A reusable workflow or action without a usable declaration is a misconfiguration:
 # it's reported on stderr and the script exits nonzero, after checking everything.
@@ -46,12 +46,22 @@ check() {
         return 0
     fi
 
+    # The parse above stops at the first dot, so a dotted declaration would be silently
+    # truncated to its major, discarding whatever the author meant by the rest. Since
+    # the tags are dotted, that's an easy comment to write by mistake.
+    if grep -qE '^# tag-version: v[0-9]+\.' "$vfile" ; then
+        echo "$name: $vfile declares a dotted version; the comment carries the major only, as 'v$version'" 1>&2
+        ERRORS=1
+        return 0
+    fi
+
     # Never touch a tag older than the newest existing one. That means the comment is
     # stale or was decremented, and moving the old tag would break its consumers.
     local newest=""
     local t n
     while IFS= read -r t ; do
         n="${t#"$name"-v}"
+        n="${n%%.*}"
         [[ "$n" =~ ^[0-9]+$ ]] || continue
         if [ -z "$newest" ] || [ "$n" -gt "$newest" ] ; then
             newest="$n"
@@ -63,7 +73,10 @@ check() {
         return 0
     fi
 
-    local tag="$name-v$version"
+    # Dotted because Dependabot only recognizes a bare "vN" ref when the "v" starts it:
+    # a prefixed "$name-v$version" is invisible to it, so consumers pinned to that name
+    # never get upgrade PRs. The tag still floats; the digits are for the parser only.
+    local tag="$name-v$version.0.0"
     if ! git rev-parse -q --verify "refs/tags/$tag" > /dev/null ; then
         TAGS+=("$tag")
     elif ! git diff --quiet "refs/tags/$tag" HEAD -- "$@" ; then

.github/spec/move_tags_spec.sh

@@ -38,15 +38,15 @@ Describe 'move-tags.list.sh'
     }
     It 'creates the tag for a new workflow'
         When call new_workflow
-        The output should equal 'foo-v1'
+        The output should equal 'foo-v1.0.0'
         The status should be success
     End
 
     up_to_date_workflow() {
         setup_repo
         reusable_workflow v1 > .github/workflows/foo.yaml
         commit_all
-        git tag foo-v1
+        git tag foo-v1.0.0
         "$SCRIPT"
     }
     It 'is quiet when the tag matches the content'
@@ -55,26 +55,39 @@ Describe 'move-tags.list.sh'
         The status should be success
     End
 
-    changed_workflow() {
+    legacy_tag_only() {
         setup_repo
         reusable_workflow v1 > .github/workflows/foo.yaml
         commit_all
         git tag foo-v1
+        "$SCRIPT"
+    }
+    It 'creates the dotted tag for a version that only has the legacy name'
+        When call legacy_tag_only
+        The output should equal 'foo-v1.0.0'
+        The status should be success
+    End
+
+    changed_workflow() {
+        setup_repo
+        reusable_workflow v1 > .github/workflows/foo.yaml
+        commit_all
+        git tag foo-v1.0.0
         printf '# a change\n' >> .github/workflows/foo.yaml
         commit_all
         "$SCRIPT"
     }
     It 'moves the tag when the workflow file changed'
         When call changed_workflow
-        The output should equal 'foo-v1'
+        The output should equal 'foo-v1.0.0'
         The status should be success
     End
 
     unrelated_change() {
         setup_repo
         reusable_workflow v1 > .github/workflows/foo.yaml
         commit_all
-        git tag foo-v1
+        git tag foo-v1.0.0
         printf 'docs\n' > README.md
         commit_all
         "$SCRIPT"
@@ -89,37 +102,37 @@ Describe 'move-tags.list.sh'
         setup_repo
         reusable_workflow v1 > .github/workflows/foo.yaml
         commit_all
-        git tag foo-v1
+        git tag foo-v1.0.0
         printf 'echo hi\n' > .github/foo.build.sh
         commit_all
         "$SCRIPT"
     }
     It 'moves the tag when a helper script changed'
         When call changed_helper_script
-        The output should equal 'foo-v1'
+        The output should equal 'foo-v1.0.0'
         The status should be success
     End
 
     major_bump() {
         setup_repo
         reusable_workflow v1 > .github/workflows/foo.yaml
         commit_all
-        git tag foo-v1
+        git tag foo-v1.0.0
         reusable_workflow v2 > .github/workflows/foo.yaml
         commit_all
         "$SCRIPT"
     }
     It 'creates the new tag on a major bump, leaving the old one alone'
         When call major_bump
-        The output should equal 'foo-v2'
+        The output should equal 'foo-v2.0.0'
         The status should be success
     End
 
     decremented_version() {
         setup_repo
         reusable_workflow v2 > .github/workflows/foo.yaml
         commit_all
-        git tag foo-v2
+        git tag foo-v2.0.0
         reusable_workflow v1 > .github/workflows/foo.yaml
         commit_all
         "$SCRIPT"
@@ -131,6 +144,35 @@ Describe 'move-tags.list.sh'
         The status should be failure
     End
 
+    decremented_past_legacy_tag() {
+        setup_repo
+        reusable_workflow v2 > .github/workflows/foo.yaml
+        commit_all
+        git tag foo-v2
+        reusable_workflow v1 > .github/workflows/foo.yaml
+        commit_all
+        "$SCRIPT"
+    }
+    It 'counts a legacy undotted tag when checking for a decrement'
+        When call decremented_past_legacy_tag
+        The output should equal ''
+        The stderr should not equal ''
+        The status should be failure
+    End
+
+    dotted_declaration() {
+        setup_repo
+        reusable_workflow v1.0.1 > .github/workflows/foo.yaml
+        commit_all
+        "$SCRIPT"
+    }
+    It 'fails for a tag-version comment carrying more than the major'
+        When call dotted_declaration
+        The output should equal ''
+        The stderr should not equal ''
+        The status should be failure
+    End
+
     reusable_without_version() {
         setup_repo
         printf 'on:\n  workflow_call:\n' > .github/workflows/foo.yaml
@@ -153,7 +195,7 @@ Describe 'move-tags.list.sh'
     }
     It 'still lists good tags while failing on a misconfigured workflow'
         When call good_and_bad_workflows
-        The output should equal 'foo-v1'
+        The output should equal 'foo-v1.0.0'
         The stderr should include 'bad'
         The status should be failure
     End
@@ -176,14 +218,14 @@ Describe 'move-tags.list.sh'
         mkdir -p .github/actions/tsp
         printf '# tag-version: v1\nname: tsp\n' > .github/actions/tsp/action.yaml
         commit_all
-        git tag tsp-v1
+        git tag tsp-v1.0.0
         printf 'echo hi\n' > .github/actions/tsp/helper.sh
         commit_all
         "$SCRIPT"
     }
     It 'moves the tag when any file in a composite action changed'
         When call changed_action
-        The output should equal 'tsp-v1'
+        The output should equal 'tsp-v1.0.0'
         The status should be success
     End
 
@@ -196,8 +238,8 @@ Describe 'move-tags.list.sh'
     }
     It 'prints multiple tags sorted'
         When call multiple_workflows
-        The line 1 of output should equal 'bar-v2'
-        The line 2 of output should equal 'foo-v1'
+        The line 1 of output should equal 'bar-v2.0.0'
+        The line 2 of output should equal 'foo-v1.0.0'
         The status should be success
     End
 End

.github/workflows/rebuild.yaml

@@ -5,10 +5,10 @@
 # This should _not_ be used for hotfix branches, as we don't bump versions in those cases.
 #
 # Usage:
-#   uses: IronCoreLabs/workflows/.github/workflows/rebuild.yaml@rebuild-v1
+#   uses: IronCoreLabs/workflows/.github/workflows/rebuild.yaml@rebuild-v0.0.0
 #
 # With multiple refs:
-#   uses: IronCoreLabs/workflows/.github/workflows/rebuild.yaml@rebuild-v1
+#   uses: IronCoreLabs/workflows/.github/workflows/rebuild.yaml@rebuild-v0.0.0
 #   with:
 #     refs: '["main", "release/v1"]'