From 10da51c2031f9b939acc0bb566b4de9dd2f85a91 Mon Sep 17 00:00:00 2001
From: agent <agent@refining.dev>
Date: Tue, 7 Apr 2026 14:03:25 +0800
Subject: [PATCH] =?UTF-8?q?ci:=20=E6=B7=BB=E5=8A=A0=E7=89=88=E6=9C=AC=20bu?=
 =?UTF-8?q?mp=20=E7=A1=AC=E6=A3=80=E6=9F=A5=EF=BC=8C=E9=98=B2=E6=AD=A2?=
 =?UTF-8?q?=E4=BB=A3=E7=A0=81=E5=8F=98=E6=9B=B4=E6=9C=AA=E5=8F=91=E7=89=88?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- CI 工作流解析版本时检查 crates/ 变更是否伴随版本 bump
- 若代码变更但版本号未变，直接失败并提示
- 与 scripts/release-check.sh 本地检查形成双保险
---
 .gitea/workflows/secrets.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.gitea/workflows/secrets.yml b/.gitea/workflows/secrets.yml
index a4b15e2..f331475 100644
--- a/.gitea/workflows/secrets.yml
+++ b/.gitea/workflows/secrets.yml
@@ -48,6 +48,18 @@ jobs:
           echo "version=${version}" >> "$GITHUB_OUTPUT"
           echo "tag=${tag}" >> "$GITHUB_OUTPUT"
 
+          # 版本 bump 硬检查：若本次推送包含 crates/ 或 Cargo.toml 变更，
+          # 但版本号与上一提交一致，则视为未发版，直接失败。
+          prev_version=$(git show HEAD^:crates/secrets-mcp/Cargo.toml 2>/dev/null | grep -m1 '^version' | sed 's/.*"\(.*\)".*/\1/' || true)
+          if [ -n "$prev_version" ] && [ "$version" = "$prev_version" ]; then
+            # 确认本次推送是否包含 crates/ 或 Cargo.toml 变更
+            if git diff --name-only HEAD^ HEAD 2>/dev/null | grep -qE '^crates/|^Cargo\.toml$'; then
+              echo "::error::工作区包含 crates/ 或 Cargo.toml 变更，但版本号未 bump（${version} == ${prev_version}）"
+              echo "按规则，每次代码变更必须 bump crates/secrets-mcp/Cargo.toml 中的 version。"
+              exit 1
+            fi
+          fi
+
           if git rev-parse "refs/tags/${tag}" >/dev/null 2>&1; then
             echo "⚠ 版本 ${tag} 已存在，将覆盖重新发版。"
             echo "tag_exists=true" >> "$GITHUB_OUTPUT"