ci: scope commitizen bump detection, tag only merged bumps, stop cancelling pending bumps

.github/workflows/bump-package.yml

@@ -46,6 +46,11 @@ on:
 jobs:
   bump:
     runs-on: ubuntu-latest
+    # Two bumps of the same package on the same branch would race for the bump
+    # branch and tag, so serialise them without ever cancelling a queued bump.
+    concurrency:
+      group: bump-${{ inputs.package_name }}-${{ inputs.target_branch }}
+      cancel-in-progress: false
     permissions:
       contents: write
       pull-requests: write

.github/workflows/main.yml

@@ -6,8 +6,12 @@ on:
       - main
       - release/mcp-v1
 
+# One group per pushed commit: a shared group only holds a single pending run,
+# so a newly queued merge cancels the merge waiting behind the running one and
+# that merge's version bump never happens. Same-package bumps stay serialised
+# by the per-package group in bump-package.yml.
 concurrency:
-  group: release-${{ github.ref_name }}
+  group: release-${{ github.ref_name }}-${{ github.sha }}
   cancel-in-progress: false
 
 jobs:
@@ -58,6 +62,9 @@ jobs:
       matrix:
         package: ${{ fromJson(needs.detect-changes.outputs.changed-packages) }}
       max-parallel: 1  # Process packages sequentially to avoid race conditions
+      # One package's refused or failed bump must not cancel its siblings'
+      # bumps: that is how the mcp bump was lost in the 3.0.0 incident rerun.
+      fail-fast: false
     uses: ./.github/workflows/bump-package.yml
     with:
       package_name: ${{ matrix.package.package_name }}

.github/workflows/pr.yml

@@ -69,6 +69,9 @@ jobs:
       - name: Run tests with coverage
         run: just test-coverage
 
+      - name: Test release tooling
+        run: just test-release-tooling
+
   release-preview:
     runs-on: ubuntu-latest
     needs: [validate-commits, lint-and-test]

justfile

@@ -71,6 +71,10 @@ changelog-preview BASE_BRANCH="origin/main":
 preview-versions FORMAT="markdown":
     uv run python scripts/version_preview.py --format {{FORMAT}}
 
+# Test the release tooling: bump plumbing plus per-package increment detection
+test-release-tooling:
+    uv run python -m unittest discover -s scripts -p 'test_*.py' -v
+
 # Bump version for a specific package
 bump-package PACKAGE_NAME PACKAGE_DIR:
     uv run python scripts/bump_package.py {{PACKAGE_NAME}} {{PACKAGE_DIR}}

packages/a2a/pyproject.toml

@@ -104,4 +104,25 @@ bump_message = "bump: keycardai-a2a $current_version → $new_version"
 major_version_zero = true
 
 [tool.commitizen.customize]
-changelog_pattern = "^(feat|fix|refactor|perf|test|build|ci|revert)\\(keycardai-a2a\\)(!)?:"
+# Scoped bump detection: without bump_pattern/bump_map commitizen falls back to
+# its default classifier, which matches any `feat(...)!:` regardless of scope.
+changelog_pattern = "^(feat|fix|refactor|perf|test|revert)\\(keycardai-a2a\\)(!)?:"
+bump_pattern = "^((?:feat|fix|refactor|perf|revert|BREAKING[\\- ]CHANGE)\\(keycardai-a2a\\)!?):"
+
+[tool.commitizen.customize.bump_map]
+"^.+\\(keycardai-a2a\\)!$" = "MAJOR"
+"^BREAKING[\\- ]CHANGE" = "MAJOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"
+
+[tool.commitizen.customize.bump_map_major_version_zero]
+"^.+\\(keycardai-a2a\\)!$" = "MINOR"
+"^BREAKING[\\- ]CHANGE" = "MINOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"

packages/fastmcp/pyproject.toml

@@ -131,4 +131,25 @@ bump_message = "bump: keycardai-fastmcp $current_version → $new_version"
 major_version_zero = true
 
 [tool.commitizen.customize]
-changelog_pattern = "^(feat|fix|refactor|perf|test|build|ci|revert)\\(keycardai-fastmcp\\)(!)?:"
+# Scoped bump detection: without bump_pattern/bump_map commitizen falls back to
+# its default classifier, which matches any `feat(...)!:` regardless of scope.
+changelog_pattern = "^(feat|fix|refactor|perf|test|revert)\\(keycardai-fastmcp\\)(!)?:"
+bump_pattern = "^((?:feat|fix|refactor|perf|revert|BREAKING[\\- ]CHANGE)\\(keycardai-fastmcp\\)!?):"
+
+[tool.commitizen.customize.bump_map]
+"^.+\\(keycardai-fastmcp\\)!$" = "MAJOR"
+"^BREAKING[\\- ]CHANGE" = "MAJOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"
+
+[tool.commitizen.customize.bump_map_major_version_zero]
+"^.+\\(keycardai-fastmcp\\)!$" = "MINOR"
+"^BREAKING[\\- ]CHANGE" = "MINOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"

packages/langchain/pyproject.toml

@@ -121,4 +121,25 @@ bump_message = "bump: keycardai-langchain $current_version → $new_version"
 major_version_zero = true
 
 [tool.commitizen.customize]
-changelog_pattern = "^(feat|fix|refactor|perf|test|build|ci|revert)\\(keycardai-langchain\\)(!)?:"
+# Scoped bump detection: without bump_pattern/bump_map commitizen falls back to
+# its default classifier, which matches any `feat(...)!:` regardless of scope.
+changelog_pattern = "^(feat|fix|refactor|perf|test|revert)\\(keycardai-langchain\\)(!)?:"
+bump_pattern = "^((?:feat|fix|refactor|perf|revert|BREAKING[\\- ]CHANGE)\\(keycardai-langchain\\)!?):"
+
+[tool.commitizen.customize.bump_map]
+"^.+\\(keycardai-langchain\\)!$" = "MAJOR"
+"^BREAKING[\\- ]CHANGE" = "MAJOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"
+
+[tool.commitizen.customize.bump_map_major_version_zero]
+"^.+\\(keycardai-langchain\\)!$" = "MINOR"
+"^BREAKING[\\- ]CHANGE" = "MINOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"

packages/mcp/pyproject.toml

@@ -152,4 +152,25 @@ bump_message = "bump: keycardai-mcp $current_version → $new_version"
 major_version_zero = false
 
 [tool.commitizen.customize]
-changelog_pattern = "^(feat|fix|refactor|perf|test|build|ci|revert)\\(keycardai-mcp\\)(!)?:"
+# Scoped bump detection: without bump_pattern/bump_map commitizen falls back to
+# its default classifier, which matches any `feat(...)!:` regardless of scope.
+changelog_pattern = "^(feat|fix|refactor|perf|test|revert)\\(keycardai-mcp\\)(!)?:"
+bump_pattern = "^((?:feat|fix|refactor|perf|revert|BREAKING[\\- ]CHANGE)\\(keycardai-mcp\\)!?):"
+
+[tool.commitizen.customize.bump_map]
+"^.+\\(keycardai-mcp\\)!$" = "MAJOR"
+"^BREAKING[\\- ]CHANGE" = "MAJOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"
+
+[tool.commitizen.customize.bump_map_major_version_zero]
+"^.+\\(keycardai-mcp\\)!$" = "MINOR"
+"^BREAKING[\\- ]CHANGE" = "MINOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"

packages/oauth/pyproject.toml

@@ -125,4 +125,25 @@ bump_message = "bump: keycardai-oauth $current_version → $new_version"
 major_version_zero = true
 
 [tool.commitizen.customize]
-changelog_pattern = "^(feat|fix|refactor|perf|test|build|ci|revert)\\(keycardai-oauth\\)(!)?:"
+# Scoped bump detection: without bump_pattern/bump_map commitizen falls back to
+# its default classifier, which matches any `feat(...)!:` regardless of scope.
+changelog_pattern = "^(feat|fix|refactor|perf|test|revert)\\(keycardai-oauth\\)(!)?:"
+bump_pattern = "^((?:feat|fix|refactor|perf|revert|BREAKING[\\- ]CHANGE)\\(keycardai-oauth\\)!?):"
+
+[tool.commitizen.customize.bump_map]
+"^.+\\(keycardai-oauth\\)!$" = "MAJOR"
+"^BREAKING[\\- ]CHANGE" = "MAJOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"
+
+[tool.commitizen.customize.bump_map_major_version_zero]
+"^.+\\(keycardai-oauth\\)!$" = "MINOR"
+"^BREAKING[\\- ]CHANGE" = "MINOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"

packages/starlette/pyproject.toml

@@ -122,4 +122,25 @@ bump_message = "bump: keycardai-starlette $current_version → $new_version"
 major_version_zero = true
 
 [tool.commitizen.customize]
-changelog_pattern = "^(feat|fix|refactor|perf|test|build|ci|revert)\\(keycardai-starlette\\)(!)?:"
+# Scoped bump detection: without bump_pattern/bump_map commitizen falls back to
+# its default classifier, which matches any `feat(...)!:` regardless of scope.
+changelog_pattern = "^(feat|fix|refactor|perf|test|revert)\\(keycardai-starlette\\)(!)?:"
+bump_pattern = "^((?:feat|fix|refactor|perf|revert|BREAKING[\\- ]CHANGE)\\(keycardai-starlette\\)!?):"
+
+[tool.commitizen.customize.bump_map]
+"^.+\\(keycardai-starlette\\)!$" = "MAJOR"
+"^BREAKING[\\- ]CHANGE" = "MAJOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"
+
+[tool.commitizen.customize.bump_map_major_version_zero]
+"^.+\\(keycardai-starlette\\)!$" = "MINOR"
+"^BREAKING[\\- ]CHANGE" = "MINOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"

pyproject.toml

@@ -106,7 +106,28 @@ bump_message = "bump: keycardai $current_version → $new_version"
 major_version_zero = true
 
 [tool.commitizen.customize]
-changelog_pattern = "^(feat|fix|refactor|perf|test|build|ci|revert)\\(keycardai\\)(!)?:"
+# Scoped bump detection: without bump_pattern/bump_map commitizen falls back to
+# its default classifier, which matches any `feat(...)!:` regardless of scope.
+changelog_pattern = "^(feat|fix|refactor|perf|test|revert)\\(keycardai\\)(!)?:"
+bump_pattern = "^((?:feat|fix|refactor|perf|revert|BREAKING[\\- ]CHANGE)\\(keycardai\\)!?):"
+
+[tool.commitizen.customize.bump_map]
+"^.+\\(keycardai\\)!$" = "MAJOR"
+"^BREAKING[\\- ]CHANGE" = "MAJOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"
+
+[tool.commitizen.customize.bump_map_major_version_zero]
+"^.+\\(keycardai\\)!$" = "MINOR"
+"^BREAKING[\\- ]CHANGE" = "MINOR"
+"^feat" = "MINOR"
+"^fix" = "PATCH"
+"^refactor" = "PATCH"
+"^perf" = "PATCH"
+"^revert" = "PATCH"
 
 [dependency-groups]
 dev = [