From 952c609acb891e26bf944d2b08cd7c65307c9541 Mon Sep 17 00:00:00 2001
From: Andrew Ghostuhin <me@torinasakura.name>
Date: Thu, 27 Aug 2026 01:04:49 +0300
Subject: [PATCH] fix(workflows): scope pull request versioning

---
 .github/workflows/version.yaml | 65 +++++++++++++++++++++++++++++++---
 1 file changed, 60 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/version.yaml b/.github/workflows/version.yaml
index 0a00a27..a3677ec 100644
--- a/.github/workflows/version.yaml
+++ b/.github/workflows/version.yaml
@@ -9,34 +9,89 @@ on:
 jobs:
   run:
     name: Version
+    if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
-          ref: master
+          ref: '${{ github.event.pull_request.base.sha }}'
+
+      - name: Compare pull request
+        env:
+          BASE_SHA: '${{ github.event.pull_request.base.sha }}'
+          HEAD_SHA: '${{ github.event.pull_request.merge_commit_sha }}'
+        run: |
+          set -euo pipefail
+
+          if [[ -z "${BASE_SHA}" || -z "${HEAD_SHA}" ]]; then
+            echo '::error::Pull request comparison identity is incomplete.'
+            exit 1
+          fi
+
+          echo "Fetching pull request head ${HEAD_SHA} from base ${BASE_SHA}."
+          git fetch --no-tags origin "${HEAD_SHA}"
+          git checkout --detach "${HEAD_SHA}"
+
+          checked_out_sha="$(git rev-parse HEAD)"
+
+          if [[ "${checked_out_sha}" != "${HEAD_SHA}" ]]; then
+            echo "::error::Checked out ${checked_out_sha}, expected ${HEAD_SHA}."
+            exit 1
+          fi
+
+          if ! git merge-base --is-ancestor "${BASE_SHA}" "${HEAD_SHA}"; then
+            echo "::error::Pull request base ${BASE_SHA} is not an ancestor of ${HEAD_SHA}."
+            exit 1
+          fi
+
+          echo "Pull request comparison: ${BASE_SHA}..${HEAD_SHA}"
+          git diff --name-status --find-renames "${BASE_SHA}" "${HEAD_SHA}"
 
       - name: Setup Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: '18.13'
 
       - name: Install
-        run: yarn install
+        run: yarn install --immutable
         env:
           GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
 
+      - name: Select workspaces
+        id: workspaces
+        env:
+          BASE_SHA: '${{ github.event.pull_request.base.sha }}'
+        run: |
+          set -euo pipefail
+
+          selected="$(yarn workspaces list --since="${BASE_SHA}" --no-private --json)"
+
+          if [[ -z "${selected}" ]]; then
+            echo 'No non-private workspaces selected.'
+            echo 'selected=false' >> "${GITHUB_OUTPUT}"
+            exit 0
+          fi
+
+          echo 'Selected non-private workspaces:'
+          echo "${selected}"
+          echo 'selected=true' >> "${GITHUB_OUTPUT}"
+
       - name: Version
-        run: yarn workspaces changed foreach --no-private --verbose version patch --deferred
+        if: steps.workspaces.outputs.selected == 'true'
+        run: yarn workspaces foreach --since="${BASE_SHA}" --no-private --verbose version patch --deferred
         env:
+          BASE_SHA: '${{ github.event.pull_request.base.sha }}'
           GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
 
       - name: Commit changes
+        if: steps.workspaces.outputs.selected == 'true'
         uses: EndBug/add-and-commit@v7
         env:
           GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
         with:
+          add: '.yarn/versions'
           author_name: github-actions
           author_email: github-bot@atls.team
           message: 'chore(common): versions'