Update version_branch.yml

.github/workflows/version_branch.yml

@@ -132,160 +132,12 @@ jobs:
 
           chmod 0755 "$CI_HELPERS"
 
-      - name: Validate inputs and policy locks
+      $1
+
+      - name: Sanity check workflow and control characters
         run: |
           source "$CI_HELPERS"
-          moko_init "Validate inputs and policy locks"
+          moko_init "Sanity check"
-
-          VERSION_TEXT="$(moko_trim "${VERSION_TEXT}")"
-
-          echo "[INFO] Inputs received:"
-          echo "  NEW_VERSION=${NEW_VERSION}"
-          echo "  VERSION_TEXT=${VERSION_TEXT}"
-          echo "  REPORT_ONLY=${REPORT_ONLY}"
-          echo "  COMMIT_CHANGES=${COMMIT_CHANGES}"
-          echo "  BASE_BRANCH=${BASE_BRANCH}"
-          echo "  BRANCH_PREFIX=${BRANCH_PREFIX}"
-
-          [[ -n "${NEW_VERSION}" ]] || { echo "[ERROR] new_version missing" >&2; exit 2; }
-          [[ "${NEW_VERSION}" =~ ^[0-9]{2}[.][0-9]{2}[.][0-9]{2}$ ]] || { echo "[ERROR] Invalid version format: ${NEW_VERSION}" >&2; exit 2; }
-
-          if [[ "${BRANCH_PREFIX}" != "dev/" ]]; then
-            echo "[FATAL] BRANCH_PREFIX is locked by policy. Expected 'dev/' but got '${BRANCH_PREFIX}'." >&2
-            exit 2
-          fi
-
-          if ! moko_bool "${REPORT_ONLY}" && [[ "${COMMIT_CHANGES}" != "true" ]]; then
-            echo "[FATAL] commit_changes must be 'true' when report_only is 'false' to ensure the branch is auditable." >&2
-            exit 2
-          fi
-
-          if [[ -n "${VERSION_TEXT}" ]]; then
-            if [[ ! "${VERSION_TEXT}" =~ ^[A-Za-z0-9._-]{1,32}$ ]]; then
-              echo "[FATAL] version_text must match ^[A-Za-z0-9._-]{1,32}$ when set." >&2
-              exit 2
-            fi
-          fi
-
-          git ls-remote --exit-code --heads origin "${BASE_BRANCH}" >/dev/null 2>&1 || {
-            echo "[ERROR] Base branch does not exist on origin: ${BASE_BRANCH}" >&2
-            echo "[INFO] Remote branches:" >&2
-            git ls-remote --heads origin | awk '{sub("refs/heads/","",$2); print $2}' >&2
-            exit 2
-          }
-
-          echo "VERSION_TEXT=${VERSION_TEXT}" >> "$GITHUB_ENV"
-
-      - name: Enterprise policy gate
-        run: |
-          source "$CI_HELPERS"
-          moko_init "Enterprise policy gate"
-
-          required=(
-            "LICENSE.md"
-            "CONTRIBUTING.md"
-            "CODE_OF_CONDUCT.md"
-            "SECURITY.md"
-            "GOVERNANCE.md"
-            "CHANGELOG.md"
-          )
-
-          missing=0
-          for f in "${required[@]}"; do
-            if [[ ! -f "${f}" ]]; then
-              echo "[ERROR] Missing required file: ${f}" >&2
-              missing=1
-              continue
-            fi
-            if [[ ! -s "${f}" ]]; then
-              echo "[ERROR] Required file is empty: ${f}" >&2
-              missing=1
-              continue
-            fi
-          done
-
-          if [[ "${missing}" -ne 0 ]]; then
-            echo "[FATAL] Policy gate failed. Add missing governance artifacts before versioning." >&2
-            exit 2
-          fi
-
-          echo "[INFO] Policy gate passed"
-
-      - name: Branch namespace collision defense
-        run: |
-          source "$CI_HELPERS"
-          moko_init "Branch namespace collision defense"
-
-          PREFIX_TOP="${BRANCH_PREFIX%%/*}"
-          if git ls-remote --exit-code --heads origin "${PREFIX_TOP}" >/dev/null 2>&1; then
-            echo "[FATAL] Branch namespace collision detected: '${PREFIX_TOP}' exists on origin." >&2
-            exit 2
-          fi
-
-      - name: Configure git identity
-        if: ${{ env.REPORT_ONLY != 'true' }}
-        run: |
-          source "$CI_HELPERS"
-          moko_init "Configure git identity"
-
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-      - name: Create version branch (local)
-        if: ${{ env.REPORT_ONLY != 'true' }}
-        run: |
-          source "$CI_HELPERS"
-          moko_init "Create version branch (local)"
-
-          BRANCH_NAME="${BRANCH_PREFIX}${NEW_VERSION}"
-          echo "[INFO] Creating local branch: ${BRANCH_NAME} from origin/${BASE_BRANCH}"
-
-          git fetch --all --tags --prune
-
-          if git ls-remote --exit-code --heads origin "${BRANCH_NAME}" >/dev/null 2>&1; then
-            echo "[FATAL] Branch already exists on origin: ${BRANCH_NAME}" >&2
-            exit 2
-          fi
-
-          git checkout -B "${BRANCH_NAME}" "origin/${BASE_BRANCH}"
-          echo "BRANCH_NAME=${BRANCH_NAME}" >> "$GITHUB_ENV"
-
-      - name: Enforce release generated update feeds are absent (update.xml, updates.xml)
-        if: ${{ env.REPORT_ONLY != 'true' }}
-        run: |
-          source "$CI_HELPERS"
-          moko_init "Enforce update feed deletion"
-
-          git rm -f --ignore-unmatch update.xml updates.xml || true
-          rm -f update.xml updates.xml || true
-
-          if [[ -f update.xml || -f updates.xml ]]; then
-            echo "[FATAL] update feed files still present after deletion attempt." >&2
-            ls -la update.xml updates.xml 2>/dev/null || true
-            exit 2
-          fi
-
-      - name: Preflight discovery (governed version markers outside .github)
-        run: |
-          source "$CI_HELPERS"
-          moko_init "Preflight discovery"
-
-          COUNT=$(grep -RIn --exclude-dir=.git --exclude-dir=.github -i -E "VERSION[[:space:]]*:[[:space:]]*[0-9]{2}[.][0-9]{2}[.][0-9]{2}" . | wc -l || true)
-          COUNT2=$(grep -RIn --exclude-dir=.git --exclude-dir=.github "<version" . | wc -l || true)
-
-          echo "[INFO] VERSION: hits (repo wide): ${COUNT}"
-          echo "[INFO] <version> hits (repo wide): ${COUNT2}"
-
-          if [[ "${COUNT}" -eq 0 && "${COUNT2}" -eq 0 ]]; then
-            echo "[FATAL] No governed version markers found outside .github" >&2
-            exit 2
-          fi
-
-      - name: Bump versions and update manifest dates (targeted, excluding .github)
-        run: |
-          source "$CI_HELPERS"
-          moko_init "Version bump"
-
           python3 - <<'PY'
 import json
 import os
@@ -404,6 +256,234 @@ print("[INFO] Would update manifests:", len(would_update_manifests))
 print("[INFO] Updated files:", len(updated_files))
 print("[INFO] Updated manifests:", len(updated_manifests))
 PY
+$2
+        run: |
+          source "$CI_HELPERS"
+          moko_init "Enterprise policy gate"
+
+          required=(
+            "LICENSE.md"
+            "CONTRIBUTING.md"
+            "CODE_OF_CONDUCT.md"
+            "SECURITY.md"
+            "GOVERNANCE.md"
+            "CHANGELOG.md"
+          )
+
+          missing=0
+          for f in "${required[@]}"; do
+            if [[ ! -f "${f}" ]]; then
+              echo "[ERROR] Missing required file: ${f}" >&2
+              missing=1
+              continue
+            fi
+            if [[ ! -s "${f}" ]]; then
+              echo "[ERROR] Required file is empty: ${f}" >&2
+              missing=1
+              continue
+            fi
+          done
+
+          if [[ "${missing}" -ne 0 ]]; then
+            echo "[FATAL] Policy gate failed. Add missing governance artifacts before versioning." >&2
+            exit 2
+          fi
+
+          echo "[INFO] Policy gate passed"
+
+      - name: Branch namespace collision defense
+        run: |
+          source "$CI_HELPERS"
+          moko_init "Branch namespace collision defense"
+
+          PREFIX_TOP="${BRANCH_PREFIX%%/*}"
+          if git ls-remote --exit-code --heads origin "${PREFIX_TOP}" >/dev/null 2>&1; then
+            echo "[FATAL] Branch namespace collision detected: '${PREFIX_TOP}' exists on origin." >&2
+            exit 2
+          fi
+
+      - name: Configure git identity
+        if: ${{ env.REPORT_ONLY != 'true' }}
+        run: |
+          source "$CI_HELPERS"
+          moko_init "Configure git identity"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Create version branch (local)
+        if: ${{ env.REPORT_ONLY != 'true' }}
+        run: |
+          source "$CI_HELPERS"
+          moko_init "Create version branch (local)"
+
+          BRANCH_NAME="${BRANCH_PREFIX}${NEW_VERSION}"
+          echo "[INFO] Creating local branch: ${BRANCH_NAME} from origin/${BASE_BRANCH}"
+
+          git fetch --all --tags --prune
+
+          if git ls-remote --exit-code --heads origin "${BRANCH_NAME}" >/dev/null 2>&1; then
+            echo "[FATAL] Branch already exists on origin: ${BRANCH_NAME}" >&2
+            exit 2
+          fi
+
+          git checkout -B "${BRANCH_NAME}" "origin/${BASE_BRANCH}"
+          echo "BRANCH_NAME=${BRANCH_NAME}" >> "$GITHUB_ENV"
+
+      - name: Enforce release generated update feeds are absent (update.xml, updates.xml)
+        if: ${{ env.REPORT_ONLY != 'true' }}
+        run: |
+          source "$CI_HELPERS"
+          moko_init "Enforce update feed deletion"
+
+          git rm -f --ignore-unmatch update.xml updates.xml || true
+          rm -f update.xml updates.xml || true
+
+          if [[ -f update.xml || -f updates.xml ]]; then
+            echo "[FATAL] update feed files still present after deletion attempt." >&2
+            ls -la update.xml updates.xml 2>/dev/null || true
+            exit 2
+          fi
+
+      - name: Preflight discovery (governed version markers outside .github)
+        run: |
+          source "$CI_HELPERS"
+          moko_init "Preflight discovery"
+
+          COUNT=$(grep -RIn --exclude-dir=.git --exclude-dir=.github -i -E "VERSION[[:space:]]*:[[:space:]]*[0-9]{2}[.][0-9]{2}[.][0-9]{2}" . | wc -l || true)
+          COUNT2=$(grep -RIn --exclude-dir=.git --exclude-dir=.github "<version" . | wc -l || true)
+
+          echo "[INFO] VERSION: hits (repo wide): ${COUNT}"
+          echo "[INFO] <version> hits (repo wide): ${COUNT2}"
+
+          if [[ "${COUNT}" -eq 0 && "${COUNT2}" -eq 0 ]]; then
+            echo "[FATAL] No governed version markers found outside .github" >&2
+            exit 2
+          fi
+
+      - name: Bump versions and update manifest dates (targeted, excluding .github)
+        run: |
+          source "$CI_HELPERS"
+          moko_init "Version bump"
+
+          python3 - <<'PY'
+          import json
+          import os
+          import re
+          from pathlib import Path
+          from collections import defaultdict
+          from datetime import datetime, timezone
+
+          new_version = (os.environ.get("NEW_VERSION") or "").strip()
+          version_text = (os.environ.get("VERSION_TEXT") or "").strip()
+          report_only = (os.environ.get("REPORT_ONLY") or "").strip().lower() == "true"
+          report_path = (os.environ.get("REPORT_PATH") or "").strip() or None
+
+          stamp = datetime.now(timezone.utc).strftime("%Y-%m-%d")
+          root = Path(".").resolve()
+
+          # No literal tab characters. Use 	 escape sequences.
+          header_re = re.compile(r"(?im)(VERSION[ 	]*:[ 	]*)([0-9]{2}[.][0-9]{2}[.][0-9]{2})")
+          manifest_marker_re = re.compile(r"(?is)<extension")
+          xml_version_re = re.compile(r"(?is)(<version[ 	]*>)([^<]*?)(</version[ 	]*>)")
+          xml_date_res = [
+            re.compile(r"(?is)(<creationDate[ 	]*>)([^<]*?)(</creationDate[ 	]*>)"),
+            re.compile(r"(?is)(<date[ 	]*>)([^<]*?)(</date[ 	]*>)"),
+            re.compile(r"(?is)(<releaseDate[ 	]*>)([^<]*?)(</releaseDate[ 	]*>)"),
+          ]
+
+          skip_ext = {
+            ".json", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".ico", ".pdf",
+            ".zip", ".7z", ".tar", ".gz", ".woff", ".woff2", ".ttf", ".otf",
+            ".mp3", ".mp4",
+          }
+          skip_dirs = {".git", ".github", "node_modules", "vendor", ".venv", "dist", "build"}
+
+          counters = defaultdict(int)
+          updated_files = []
+          updated_manifests = []
+          would_update_files = []
+          would_update_manifests = []
+
+          def should_skip(p: Path) -> bool:
+            if p.suffix.lower() in skip_ext:
+              counters["skipped_by_ext"] += 1
+              return True
+            parts = {x.lower() for x in p.parts}
+            if any(d in parts for d in skip_dirs):
+              counters["skipped_by_dir"] += 1
+              return True
+            return False
+
+          for p in root.rglob("*"):
+            if not p.is_file():
+              continue
+            if should_skip(p):
+              continue
+
+            if p.parent == root and p.name.lower() in {"update.xml", "updates.xml"}:
+              counters["skipped_release_artifacts"] += 1
+              continue
+
+            try:
+              original = p.read_text(encoding="utf-8", errors="replace")
+            except Exception:
+              counters["skipped_read_error"] += 1
+              continue
+
+            text = original
+
+            text, n1 = header_re.subn(lambda m: m.group(1) + new_version, text)
+            if n1:
+              counters["header_replacements"] += n1
+
+            is_manifest = (p.suffix.lower() == ".xml" and manifest_marker_re.search(original) is not None)
+            if is_manifest:
+              text, n2 = xml_version_re.subn(lambda m: m.group(1) + new_version + m.group(3), text)
+              if n2:
+                counters["xml_version_replacements"] += n2
+
+              for rx in xml_date_res:
+                text, n3 = rx.subn(lambda m: m.group(1) + stamp + m.group(3), text)
+                if n3:
+                  counters["xml_date_replacements"] += n3
+
+            if text != original:
+              would_update_files.append(str(p))
+              if is_manifest:
+                would_update_manifests.append(str(p))
+
+              if not report_only:
+                p.write_text(text, encoding="utf-8")
+                updated_files.append(str(p))
+                if is_manifest:
+                  updated_manifests.append(str(p))
+
+          report = {
+            "mode": "report_only" if report_only else "apply",
+            "new_version": new_version,
+            "version_text": version_text,
+            "stamp_utc": stamp,
+            "counters": dict(counters),
+            "updated_files": updated_files,
+            "updated_manifests": updated_manifests,
+            "would_update_files": would_update_files,
+            "would_update_manifests": would_update_manifests,
+          }
+
+          payload = json.dumps(report, indent=2)
+
+          if report_path:
+            Path(report_path).write_text(payload, encoding="utf-8")
+          else:
+            print(payload)
+
+          print("[INFO] Mode:", report["mode"])
+          print("[INFO] Would update files:", len(would_update_files))
+          print("[INFO] Would update manifests:", len(would_update_manifests))
+          print("[INFO] Updated files:", len(updated_files))
+          print("[INFO] Updated manifests:", len(updated_manifests))
+          PY
 
       - name: Commit changes
         if: ${{ env.REPORT_ONLY != 'true' }}