update github actions

.github/workflows/check-if-merged-pr.yml

@@ -0,0 +1,28 @@
+name: Check if the commit is part of a merged PR
+
+on:
+  workflow_call:
+    outputs:
+      is_merged_pr:
+        description: "Whether the current push came from a merged PR"
+        value: ${{ jobs.check-pr.outputs.is_merged_pr }}
+
+jobs:
+  check-pr:
+    runs-on: ubuntu-latest
+    outputs:
+      is_merged_pr: ${{ steps.check-pr.outputs.result }}
+    steps:
+      - name: Check if this commit is from a merged PR
+        id: check-pr
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const commitSha = context.sha;
+            const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              commit_sha: commitSha
+            });
+            const mergedPr = prs.find(pr => pr.merged_at !== null);
+            return Boolean(mergedPr);

.github/workflows/is-vtag.yml

@@ -0,0 +1,23 @@
+name: Whether the tag is a semver tag
+
+on:
+  workflow_call:
+    outputs:
+      is_vtag:
+        description: 'Whether the tag is a semver tag'
+        value: ${{ jobs.filter-vtags.outputs.is_vtag }}
+
+jobs:
+  filter-vtags:
+    runs-on: ubuntu-latest
+    outputs:
+      is_vtag: ${{ fromJSON(steps.check-tag.outputs.is_vtag) }}
+    steps:
+      - name: Check tag pattern
+        id: check-tag
+        run: |
+          if [[ "${GITHUB_REF_TYPE}" == "tag" && "${GITHUB_REF_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "is_vtag=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "is_vtag=false" >> "$GITHUB_OUTPUT"
+          fi

.github/workflows/pxt-buildpush.yml

@@ -2,32 +2,78 @@ name: pxt-buildpush
 
 on:
   push:
-    # main/master has its own build that includes the crowdin key
-    branches-ignore:
-      - 'main'
-      - 'master'
+    branches:
+      - '**' # Run workflow when any branch is updated
+    tags:
+      - '*'  # Run workflow when any new tag is pushed
+
+permissions:
+  contents: write
 
 jobs:
-  build:
+  filter-vtags:
+    uses: ./.github/workflows/is-vtag.yml
+
+  tag-bump-commit:
+    uses: ./.github/workflows/tag-bump-commit.yml
+    needs: filter-vtags
+    if: needs.filter-vtags.outputs.is_vtag == false
 
+  buildpush:
+    name: buildpush
     runs-on: ubuntu-latest
+    needs: tag-bump-commit
+    if: always() && needs.tag-bump-commit.outputs.did_tag == false
+    steps:
+      - uses: actions/checkout@main
+        with:
+          fetch-depth: 0
+          fetch-tags: true
 
-    strategy:
-      matrix:
-        node-version: [16.x]
+      - name: Use Node.js
+        uses: actions/setup-node@main
+        with:
+          node-version: 18.x
+
+      - name: npm install
+        run: |
+          sudo apt-get install xvfb
+          sudo npm install -g pxt
+          npm install
 
+      - name: pxt ci (without publish capability)
+        run: |
+          pxt ci
+        env:
+          CHROME_BIN: chromium-browser
+          DISPLAY: :99.0
+          CI: true
+
+  # This job is nearly identical to that found in pxt-buildvtag.yml
+  buildvtag:
+    name: buildvtag
+    runs-on: ubuntu-latest
+    needs: tag-bump-commit
+    # Only run this job if the push is a version tag
+    if: always() && needs.tag-bump-commit.outputs.did_tag == true
     steps:
       - uses: actions/checkout@main
-      - name: Use Node.js ${{ matrix.node-version }}
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Use Node.js
         uses: actions/setup-node@main
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version: 18.x
+
       - name: npm install
         run: |
           sudo apt-get install xvfb
           sudo npm install -g pxt
           npm install
-      - name: pxt ci
+
+      - name: pxt ci (with publish capability)
         run: |
           pxt ci
         env:

.github/workflows/pxt-buildmain.yml → .github/workflows/pxt-buildvtag.yml

@@ -1,37 +1,41 @@
-name: pxt-buildmain
+name: pxt-buildvtag
 
 on:
   push:
-    branches:
-      - 'master'
-      - 'main'
-  create:
+    tags:
+      - 'v*' # Run workflow when any new semver-ish tag is pushed
 
 jobs:
-  build:
+  filter-vtags:
+    uses: ./.github/workflows/is-vtag.yml
 
+  buildvtag:
+    name: buildvtag
+    # Only run this job if the push is a version tag
+    needs: filter-vtags
+    if: needs.filter-vtags.outputs.is_vtag == true
     runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        node-version: [16.x]
-
     steps:
       - uses: actions/checkout@main
-      - name: Use Node.js ${{ matrix.node-version }}
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Use Node.js
         uses: actions/setup-node@main
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version: 18.x
+
       - name: npm install
         run: |
           sudo apt-get install xvfb
           sudo npm install -g pxt
           npm install
-      - name: pxt ci
+
+      - name: pxt ci (with publish capability)
         run: |
           pxt ci
         env:
-          CROWDIN_KEY: ${{ secrets.CROWDIN_KEY }}
           PXT_ACCESS_TOKEN: ${{ secrets.PXT_ACCESS_TOKEN }}
           PXT_RELEASE_REPO: ${{ secrets.PXT_RELEASE_REPO }}
           NPM_ACCESS_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}

.github/workflows/tag-bump-commit.yml

@@ -0,0 +1,65 @@
+name: Tag version on merged bump commit
+
+on:
+  workflow_call:
+    outputs:
+      did_tag:
+        description: 'Whether a tag was created'
+        value: ${{ jobs.return.outputs.did_tag }}
+
+jobs:
+  check-merge:
+    uses: ./.github/workflows/check-if-merged-pr.yml
+
+  tag-version:
+    needs: check-merge
+    if: needs.check-merge.outputs.is_merged_pr == true
+    runs-on: ubuntu-latest
+    outputs:
+      did_tag: ${{ steps.tag-op.outputs.did_tag }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Tag commit if it's a version bump
+        id: tag-op
+        shell: bash
+        run: |
+          TAGGED=false
+          git fetch --tags
+          COMMIT_SHA="${{ github.sha }}"
+          COMMIT_MSG=$(git log -1 --pretty=%s "$COMMIT_SHA")
+          echo "Commit message: $COMMIT_MSG"
+          if [[ "$COMMIT_MSG" =~ \[pxt-cli\]\ bump\ version\ to\ v([0-9]+\.[0-9]+\.[0-9]+) ]]; then
+            VERSION="v${BASH_REMATCH[1]}"
+            if git rev-parse "$VERSION" >/dev/null 2>&1; then
+              echo "::warning::Tag $VERSION already exists — skipping tagging."
+            else
+              echo "Tagging commit $COMMIT_SHA with $VERSION"
+              git tag "$VERSION" "$COMMIT_SHA"
+              git push origin "$VERSION"
+              TAGGED=true
+            fi
+          else
+            echo "No bump commit found — skipping tag."
+          fi
+          echo "did_tag=$TAGGED" >> "$GITHUB_OUTPUT"
+
+  not-tag-version:
+    needs: check-merge
+    if: needs.check-merge.outputs.is_merged_pr == false
+    runs-on: ubuntu-latest
+    outputs:
+      did_tag: false
+    steps:
+      - run: echo "No tag because not a PR merge."
+
+  return:
+    runs-on: ubuntu-latest
+    needs: [tag-version, not-tag-version]
+    if: always()
+    outputs:
+      did_tag: ${{ fromJSON(needs.tag-version.outputs.did_tag || 'false') }}
+    steps:
+      - run: echo "Returning did_tag = ${{ fromJSON(needs.tag-version.outputs.did_tag || 'false') }}"