Overhaul versions.py to handle generic named versions

.github/workflows/android-maven-release.yml

@@ -13,7 +13,7 @@
 name: Publish Release (Android)
 
 # This workflow relies on the following secrets:
-# - GITHUB_TOKEN: Required for creating a release on GitHub
+# - GITHUB_TOKEN: With the permission scope: `contents: write`. Required for creating a release on GitHub.
 # - GPG_SECRET_KEYS
 # - GPG_OWNERTRUST
 # - SONATYPE_USERNAME
@@ -41,7 +41,6 @@ on:
           The variant used to control the GitHub release title suffix and Maven publish command (ex: core -> v3.2.1-core & make core-publish-main). 
           If not specified, uses the default values for both.
         type: string
-        required: false
         default: ''
 
       version-validation-paths:
@@ -53,27 +52,24 @@ on:
 
           **Example:**
           `"code/edge/src/main/java/com/adobe/marketing/mobile/EdgeConstants.java, code/gradle.properties"`
-
-          This argument is required.
         type: string
-        required: true
+        default: ''
 
       version-validation-dependencies:
         description: |
           A comma-separated list of dependencies with their versions. 
           Each dependency can optionally specify a semicolon-separated list of the file paths where it applies using the `@` symbol.
 
-          **Syntax:** `<name> <version>[@file_path1[;file_path2;...]]`
+          **Syntax:** `<name> <version>[@file_path1[:pattern_type][;file_path2[:pattern_type];...]]`
 
-          - If the `@` syntax is used, the dependency will only apply to the specified files.
-          - If the `@` symbol is omitted, the dependency applies to all relevant files.
+          - If the `@` syntax is used, the paths provided in the `-p` argument will be overridden, and the dependency will only be applied to the specified files.
           - When specifying custom file paths, you must provide either an absolute or relative path to each file.
           - If a dependency is missing a version, it will be skipped.
+          - `<name>` does not have to be regex-escaped, this is handled automatically.
 
           **Example:**
-          `"Core 7.8.9, EdgeIdentity 8.9.10@code/gradle.properties;code/Constants.kt"`
+          `"Core 7.8.9, EdgeIdentity 8.9.10@code/gradle.properties;code/Constants.kt:test_version"`
         type: string
-        required: false
         default: ''
 
 jobs:
@@ -102,7 +98,7 @@ jobs:
           java-version: 17
 
       - name: Cache Gradle packages
-        uses: actions/cache@v4.0.2
+        uses: actions/cache@v4.1.2
         with:
           path: ~/.gradle/caches
           key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}

.github/workflows/ios-custom-command-build-and-test.yml

@@ -140,7 +140,7 @@ jobs:
 
       - name: Upload Code Coverage
         if: ${{ inputs.enable-codecov }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           flags: ${{ inputs.codecov-flag }}

.github/workflows/ios-release.yml

@@ -13,7 +13,7 @@
 name: Release (iOS)
 
 # This workflow relies on the following secrets:
-# - GITHUB_TOKEN: Required for creating a release on GitHub.
+# - GITHUB_TOKEN: With the permission scope: `contents: write`. Required for creating a release on GitHub.
 # - COCOAPODS_TRUNK_TOKEN: Required for publishing a pod to Cocoapods.
 # These can be passed using the `secrets: inherit` option in the caller workflow file.
 

.github/workflows/update-workflow-versions.yml

@@ -0,0 +1,70 @@
+#
+# Copyright 2024 Adobe. All rights reserved.
+# This file is licensed to you under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under
+# the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+# OF ANY KIND, either express or implied. See the License for the specific language
+# governing permissions and limitations under the License.
+#
+
+name: Update Reusable Workflow Versions
+
+on:
+  workflow_dispatch:
+    inputs:
+      platform:
+        description: 'The platform to update the reusable workflows for (ex: iOS, Android).'
+        type: choice
+        options:
+        - Android
+        - iOS
+        required: true
+      version:
+        description: |
+          The new version to use for the iOS reusable workflows (ex: 1.2.3). 
+          The workflow will automatically construct the final version (ex: gha-ios-1.2.3).
+        type: string
+        required: true
+      branch:
+        description: 'The target branch where the version update will be applied and the pull request will be merged into.'
+        type: string
+        required: true
+
+jobs:
+  update-versions-ios:
+    if: ${{ github.event.inputs.platform == 'iOS' }}
+    permissions:
+      actions: write
+      contents: write
+      pull-requests: write
+    uses: ./.github/workflows/versions.yml
+    with:
+      version: gha-ios-${{ github.event.inputs.version }}
+      branch: ${{ github.event.inputs.branch }}
+      dependencies: >
+        adobe/aepsdk-commons/.github/workflows/versions.yml gha-ios-${{ github.event.inputs.version }}@.github/workflows/ios-release.yml:yml_uses,
+        adobe/aepsdk-commons/.github/workflows/ios-validate-code.yml gha-ios-${{ github.event.inputs.version }},
+        adobe/aepsdk-commons/.github/workflows/ios-custom-command-build-and-test.yml gha-ios-${{ github.event.inputs.version }},
+        adobe/aepsdk-commons/.github/actions/ios-setup-dependencies-action gha-ios-${{ github.event.inputs.version }}
+      paths: >
+        .github/workflows:yml_uses
+      update: true
+    secrets: inherit
+
+  update-versions-android:
+    if: ${{ github.event.inputs.platform == 'Android' }}
+    permissions:
+      actions: write
+      contents: write
+      pull-requests: write
+    uses: ./.github/workflows/versions.yml
+    with:
+      version: gha-android-${{ github.event.inputs.version }}
+      branch: ${{ github.event.inputs.branch }}
+      dependencies: >
+        adobe/aepsdk-commons/.github/workflows/versions.yml gha-android-${{ github.event.inputs.version }}@.github/workflows/android-maven-release.yml:yml_uses
+      update: true
+    secrets: inherit

.github/workflows/versions.yml

@@ -16,6 +16,12 @@ name: Update or Validate Versions
 # 1. Navigate to: Settings -> Code and automation -> Actions -> General.
 # 2. Under "Workflow permissions," select:
 #    - "Allow GitHub Actions to create and approve pull requests."
+#
+# It also relies on the following secrets:
+# - GITHUB_TOKEN: With the permission scopes: `contents: write` and `pull-requests: write`. Required for creating a PR.
+# - WORKFLOW_TOKEN: (Optional) An optional GitHub PAT with the minimum required scopes of `contents:write` and `workflows:write`. 
+#     Only required for Actions that need to modify .github/workflow files.
+# These can be passed using the `secrets: inherit` option in the caller workflow file.
 
 env:
   WORKFLOW_TAG: gha-ios-5.0.0
@@ -45,38 +51,40 @@ on:
           **Example:**
           `"Package.swift:swift_spm, AEPCore/Sources/configuration/ConfigurationConstants.swift, AEPCore/Tests/MobileCoreTests.swift:swift_test_version"`
           `"code/edge/src/main/java/com/adobe/marketing/mobile/EdgeConstants.java, code/gradle.properties"`
-
-          This argument is required.
         type: string
-        required: true
+        default: ''
 
       dependencies:
         description: |
           A comma-separated list of dependencies with their versions. 
           Each dependency can optionally specify a semicolon-separated list of the file paths where it applies using the `@` symbol.
 
-          **Syntax:** `<name> <version>[@file_path1[;file_path2;...]]`
+          **Syntax:** `<name> <version>[@file_path1[:pattern_type][;file_path2[:pattern_type];...]]`
 
-          - If the `@` syntax is used, the dependency will only apply to the specified files.
-          - If the `@` symbol is omitted, the dependency applies to all relevant files.
+          - If the `@` syntax is used, the paths provided in the `-p` argument will be overridden, and the dependency will only be applied to the specified files.
           - When specifying custom file paths, you must provide either an absolute or relative path to each file.
           - If a dependency is missing a version, it will be skipped.
+          - `<name>` does not have to be regex-escaped, this is handled automatically.
 
           **Example:**
-          iOS: `"AEPCore 3.1.1, AEPServices 8.9.10@AEPCore.podspec;AEPIdentity.podspec"`
-          Android: `"AEPCore 7.8.9, AEPEdgeIdentity 8.9.10@code/gradle.properties;code/Constants.kt"`
+          iOS: `"AEPCore 3.1.1, AEPServices 8.9.10@AEPCore.podspec;Package.swift:swift_spm"`
+          Android: `"AEPCore 7.8.9, AEPEdgeIdentity 8.9.10@code/gradle.properties;code/Constants.kt:test_version"`
         type: string
-        required: false
         default: ''
 
       update:
         description: |
           If `true`, the workflow will update the versions in the specified files. 
           If `false`, the workflow will validate the existing versions instead.
         type: boolean
-        required: false
         default: false
 
+    secrets:
+      WORKFLOW_TOKEN:
+        description: | 
+          An optional GitHub PAT with the minimum required scopes of `contents:write` and `workflows:write`.
+          Only required for Actions that need to modify .github/workflow files.
+        required: false
 jobs:
   update-versions:
     runs-on: ubuntu-latest
@@ -85,6 +93,7 @@ jobs:
       with:
         repository: ${{ github.repository }}
         ref: ${{ inputs.branch }}
+        token: ${{ secrets.WORKFLOW_TOKEN || secrets.GITHUB_TOKEN }}
 
     - name: Restore cached scripts from aepsdk-commons
       id: cache-scripts
@@ -119,21 +128,19 @@ jobs:
     - name: Remove scripts from aepsdk-commons
       run: rm -rf .github/aepsdk-commons
 
-    - name: Configure GitHub Actions bot user
-      if: ${{ inputs.update }}
-      run: |
-        git config --global user.email "github-actions[bot]@users.noreply.github.com"
-        git config --global user.name "github-actions[bot]"
-
     - name: Create pull request
       if: ${{ inputs.update }}
       env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
+        git config --global user.name "github-actions[bot]"
+        git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
         branch_name="version-${{ inputs.version }}-update"
-        git checkout -b $branch_name
+        git checkout -b "$branch_name"
         git add .
         git commit -m "Updating version to ${{ inputs.version }}."
-        git push origin $branch_name
-        gh pr create --base ${{ inputs.branch }} --head $branch_name --title "Updating version to ${{ inputs.version }}" --body "Updating version to ${{ inputs.version }}"
+        git push origin "$branch_name"
+
+        gh pr create --base "${{ inputs.branch }}" --head "$branch_name" --title "Updating version to ${{ inputs.version }}" --body "Updating version to ${{ inputs.version }}"