ci: update ci: version bump, changelog

.github/actions/setup-cocogitto/action.yml

@@ -0,0 +1,23 @@
+name: "Setup Cocogitto"
+description: "Installs a specific version of Cocogitto and cleans up the workspace"
+inputs:
+  version:
+    description: "Cocogitto version to install"
+    required: true
+    default: "7.0.0"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install Cocogitto
+      shell: bash
+      run: |
+        VERSION="${{ inputs.version }}"
+        URL="https://github.com/cocogitto/cocogitto/releases/download/${VERSION}/cocogitto-${VERSION}-x86_64-unknown-linux-musl.tar.gz"
+
+        curl -LOf "$URL"
+        tar -xzf "cocogitto-${VERSION}-x86_64-unknown-linux-musl.tar.gz"
+
+        sudo mv $(find . -name cog -type f -executable) /usr/local/bin/
+        git clean -fd
+        cog --version

.github/workflows/bump.yml

@@ -0,0 +1,77 @@
+name: Bump version
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: bump
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    uses: ./.github/workflows/verify.yml
+
+  bump:
+    needs: verify
+    runs-on: ubuntu-latest
+    outputs:
+      bumped: ${{ steps.check-bump.outputs.bumped }}
+      new_version: ${{ steps.get-tag.outputs.version }}
+    steps:
+      - name: Generate token
+        id: generate_token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.XBOCT_BOT_ID }}
+          private-key: ${{ secrets.XBOCT_BOT_PRIVATE_KEY }}
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          token: ${{ steps.generate_token.outputs.token }}
+          fetch-depth: 0
+
+      - name: Setup Cocogitto
+        uses: ./.github/actions/setup-cocogitto
+
+      - name: Check if bump is needed
+        id: check-bump
+        run: |
+          BUMP_OUTPUT=$(cog bump --auto --dry-run 2>&1)
+
+          if [[ "$BUMP_OUTPUT" == *"No conventional commits"* ]]; then
+            echo "No bump needed."
+            echo "bumped=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Changes detected, proceeding..."
+            echo "bumped=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Bump and push
+        if: steps.check-bump.outputs.bumped == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          cog bump --auto
+          git push origin main --tags
+
+      - name: Get new version
+        id: get-tag
+        if: steps.check-bump.outputs.bumped == 'true'
+        run: |
+          VERSION=$(git describe --tags --abbrev=0)
+          echo "Detected version: $VERSION"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+  release:
+    needs: bump
+    if: needs.bump.outputs.bumped == 'true'
+    uses: ./.github/workflows/release.yml
+    with:
+      version: ${{ needs.bump.outputs.new_version }}
+    secrets: inherit

.github/workflows/deploy.yml

@@ -17,34 +17,7 @@ concurrency:
 
 jobs:
   verify:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: ^11.20.0
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: |
-            pnpm-lock.yaml
-            web/pnpm-lock.yaml
-
-      - name: Install root dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Install web dependencies
-        working-directory: web
-        run: pnpm install --frozen-lockfile
-
-      - name: Run quality gate
-        run: pnpm verify
+    uses: ./.github/workflows/verify.yml
 
   build:
     needs: verify

.github/workflows/quality.yml

@@ -16,35 +16,7 @@ concurrency:
 
 jobs:
   verify:
-    name: Fast quality gate
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: ^11.20.0
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: |
-            pnpm-lock.yaml
-            web/pnpm-lock.yaml
-
-      - name: Install root dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Install web dependencies
-        working-directory: web
-        run: pnpm install --frozen-lockfile
-
-      - name: Run quality gate
-        run: pnpm verify
+    uses: ./.github/workflows/verify.yml
 
   e2e:
     name: E2E (non-blocking baseline)

.github/workflows/release.yml

@@ -0,0 +1,58 @@
+name: GitHub Release
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Версия для релиза (например, v0.2.0)"
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate token
+        id: generate_token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.XBOCT_BOT_ID }}
+          private-key: ${{ secrets.XBOCT_BOT_PRIVATE_KEY }}
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          token: ${{ steps.generate_token.outputs.token }}
+          fetch-depth: 0
+
+      - name: Setup Cocogitto
+        uses: ./.github/actions/setup-cocogitto
+
+      - name: Sync and reset
+        run: |
+          git fetch origin main --tags --force
+          git reset --hard origin/main
+
+      - name: Get changelog
+        run: |
+          cog changelog "${{ inputs.version }}" > GITHUB_CHANGELOG.md
+          if [ ! -s GITHUB_CHANGELOG.md ]; then
+            echo "Release ${{ inputs.version }}" > GITHUB_CHANGELOG.md
+            echo "::warning title=Changelog::Changelog was empty, used default text."
+          fi
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ inputs.version }}
+          name: Release ${{ inputs.version }}
+          body_path: GITHUB_CHANGELOG.md
+          token: ${{ steps.generate_token.outputs.token }}

.github/workflows/verify.yml

@@ -0,0 +1,39 @@
+name: Verify
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Fast quality gate
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: ^11.20.0
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: |
+            pnpm-lock.yaml
+            web/pnpm-lock.yaml
+
+      - name: Install root dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install web dependencies
+        working-directory: web
+        run: pnpm install --frozen-lockfile
+
+      - name: Run quality gate
+        run: pnpm verify