From acc3532319dd0b2f00e119aeb4c883a7263b33b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Jos=C3=A9=20Mata?= <juanjo.mata@gmail.com>
Date: Fri, 17 Jul 2026 08:10:04 +0200
Subject: [PATCH] Fix automated version bumps and advance prerelease version
 (#2704)

* Bump version to next iteration after v0.7.3-alpha.3 release

* Fix automated version bump pull requests

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 .github/workflows/publish.yml | 10 ++++++----
 .sure-version                 |  2 +-
 charts/sure/Chart.yaml        |  4 ++--
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ef7e88958..7326c74ad 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -493,7 +493,9 @@ jobs:
       - name: Commit and push version bump
         env:
           SOURCE_BRANCH: ${{ steps.source_branch.outputs.branch }}
-          GH_TOKEN: ${{ secrets.VERSION_BUMP_PR_TOKEN || github.token }}
+          # The organization disallows GITHUB_TOKEN from creating pull requests,
+          # so prefer a dedicated token and fall back to the existing repository PAT.
+          GH_TOKEN: ${{ secrets.VERSION_BUMP_PR_TOKEN || secrets.GH_PAT || github.token }}
           REF_NAME: ${{ github.ref_name }}
         run: |
           set -euo pipefail
@@ -576,11 +578,11 @@ jobs:
           set -e
 
           if [[ $pr_create_status -ne 0 ]]; then
-            echo "::warning::Pushed ${BUMP_BRANCH}, but could not create the version bump PR: ${pr_create_output}"
+            echo "::error::Pushed ${BUMP_BRANCH}, but could not create the version bump PR: ${pr_create_output}"
             if grep -q "GitHub Actions is not permitted to create or approve pull requests" <<< "$pr_create_output"; then
-              echo "::notice::Enable the repository setting that allows GitHub Actions to create pull requests, or add a VERSION_BUMP_PR_TOKEN secret with contents, pull requests, and workflows permissions."
+              echo "::notice::Add a VERSION_BUMP_PR_TOKEN or GH_PAT secret with contents, pull requests, and workflows permissions."
             fi
-            exit 0
+            exit 1
           fi
 
           PR_URL="$pr_create_output"
diff --git a/.sure-version b/.sure-version
index 8212b52e3..0ad2651e5 100644
--- a/.sure-version
+++ b/.sure-version
@@ -1 +1 @@
-0.7.3-alpha.3
+0.7.3-alpha.4
diff --git a/charts/sure/Chart.yaml b/charts/sure/Chart.yaml
index fc31187bf..daf4d1456 100644
--- a/charts/sure/Chart.yaml
+++ b/charts/sure/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: sure
 description: Official Helm chart for deploying the Sure Rails app (web + Sidekiq) on Kubernetes with optional HA PostgreSQL (CloudNativePG) and Redis.
 type: application
-version: 0.7.3-alpha.3
-appVersion: "0.7.3-alpha.3"
+version: 0.7.3-alpha.4
+appVersion: "0.7.3-alpha.4"
 
 kubeVersion: ">=1.25.0-0"