Auto-bump patch version before twine upload and release

The stable publish job now bumps the patch in both stable.toml and
dev.toml, commits the bump back to main with [skip ci], and then
builds/uploads/releases using the new version. Developers no longer
need to hand-edit the TOMLs before merging to main. CLAUDE.md updated
to describe the new behaviour.

Author: JE-Chen

.github/workflows/ci-stable.yml

@@ -67,6 +67,8 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -76,13 +78,41 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install build twine
-      - name: Use stable.toml as pyproject.toml
-        run: cp stable.toml pyproject.toml
-      - name: Extract version
+      - name: Bump patch version in stable.toml and dev.toml
         id: version
         run: |
-          VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          python - <<'PY'
+          import os
+          import pathlib
+          import re
+
+          def bump(path: pathlib.Path) -> str:
+              text = path.read_text(encoding="utf-8")
+              match = re.search(r'^version = "(\d+)\.(\d+)\.(\d+)"', text, re.MULTILINE)
+              if match is None:
+                  raise SystemExit(f"no version line found in {path}")
+              major, minor, patch = (int(g) for g in match.groups())
+              new = f"{major}.{minor}.{patch + 1}"
+              path.write_text(text.replace(match.group(0), f'version = "{new}"', 1), encoding="utf-8")
+              return new
+
+          stable_version = bump(pathlib.Path("stable.toml"))
+          dev_version = bump(pathlib.Path("dev.toml"))
+          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fp:
+              fp.write(f"version={stable_version}\n")
+              fp.write(f"dev_version={dev_version}\n")
+          print(f"stable.toml -> {stable_version}")
+          print(f"dev.toml    -> {dev_version}")
+          PY
+      - name: Commit bumped versions back to main
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add stable.toml dev.toml
+          git commit -m "Bump version to v${{ steps.version.outputs.version }} [skip ci]"
+          git push origin HEAD:main
+      - name: Use stable.toml as pyproject.toml
+        run: cp stable.toml pyproject.toml
       - name: Build sdist and wheel
         run: python -m build
       - name: Twine check

CLAUDE.md

@@ -94,10 +94,11 @@ automation_file/
 
 - `main` branch: stable releases, publishes `automation_file` to PyPI (version in `stable.toml`).
 - `dev` branch: development, publishes `automation_file_dev` to PyPI (version in `dev.toml`).
-- Keep both TOMLs in sync when bumping. `dependencies` and `[project.optional-dependencies]` (`dev`) must also stay in sync. Backends (`boto3`, `azure-storage-blob`, `dropbox`, `paramiko`) and `PySide6` are first-class runtime deps — do not move them back under extras.
+- Keep `dependencies` and `[project.optional-dependencies]` (`dev`) in sync across both TOMLs. Backends (`boto3`, `azure-storage-blob`, `dropbox`, `paramiko`) and `PySide6` are first-class runtime deps — do not move them back under extras.
+- **Version bumping is automatic.** The stable publish job bumps the patch in both `stable.toml` and `dev.toml`, commits the bump back to `main` with `[skip ci]`, then builds and releases. Do not hand-bump before merging to `main`.
 - CI: GitHub Actions (Windows, Python 3.10 / 3.11 / 3.12) — one matrix workflow per branch: `.github/workflows/ci-dev.yml`, `.github/workflows/ci-stable.yml`.
 - CI steps: `lint` (ruff check + ruff format --check + mypy) → `pytest` with coverage → uploads `coverage.xml` as an artifact.
-- Stable branch additionally runs a `publish` job on push to `main`: builds the sdist + wheel, `twine check`, `twine upload` using `PYPI_API_TOKEN`, then `gh release create v<version> --generate-notes`.
+- Stable branch additionally runs a `publish` job on push to `main`: auto-bumps the patch in both TOMLs and commits back, then builds the sdist + wheel, `twine check`, `twine upload` using `PYPI_API_TOKEN`, then `gh release create v<version> --generate-notes`.
 - `pre-commit` is configured (`.pre-commit-config.yaml`): trailing-whitespace, eof-fixer, check-yaml, check-toml, check-added-large-files, ruff, ruff-format, mypy. Install with `pre-commit install` after cloning.
 
 ## Development