From ee9163897833c84615982f7b31ff832a428e7dcf Mon Sep 17 00:00:00 2001
From: Chris Mitchell <chris.mitchell@xero.com>
Date: Mon, 10 Aug 2026 16:17:49 +1200
Subject: [PATCH 1/2] [XAPI-2340] Open a PR for OAuth2Client version bumps
 instead of pushing to master

master is a protected branch requiring PRs and a passing status check, so the
workflow's direct `git push origin HEAD:master` always failed once there were
actual changes to publish (every prior "successful" run had short-circuited
before reaching this step). The version bump commit and tag are now pushed to
a branch and opened as a PR instead, with the PR URL surfaced in the job's
step summary.
---
 .../publish-Oauth2Client-package.yml          | 44 ++++++++++++++-----
 1 file changed, 33 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/publish-Oauth2Client-package.yml b/.github/workflows/publish-Oauth2Client-package.yml
index 39697d7b..b8c9a054 100644
--- a/.github/workflows/publish-Oauth2Client-package.yml
+++ b/.github/workflows/publish-Oauth2Client-package.yml
@@ -17,6 +17,7 @@ jobs:
       # Used to conditionally run publish steps and notifications
       client_version: ${{steps.calc_version.outputs.version}}
       should_publish: ${{steps.check_changes.outputs.has_changes}}
+      version_bump_pr_url: ${{steps.commit_tag_and_pr.outputs.pr_url}}
 
     permissions:
       contents: write
@@ -154,22 +155,43 @@ jobs:
       run: dotnet nuget push ./Xero.NetStandard.OAuth2Client/bin/Release/Xero.NetStandard.OAuth2Client.${{steps.calc_version.outputs.version}}.nupkg --api-key ${{ steps.nuget_login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json
       working-directory: Xero-NetStandard
 
-    - name: Commit, Push and Tag
+    - name: Commit, Tag and Open PR
       if: steps.check_changes.outputs.has_changes == 'true'
+      id: commit_tag_and_pr
       run: |
         git config user.name "github-actions[bot]"
         git config user.email "github-actions[bot]@users.noreply.github.com"
-        
-        # Commit the version bump
+
+        VERSION="${{steps.calc_version.outputs.version}}"
+        BRANCH="bump-oauth2client-v${VERSION}"
+
+        # master is a protected branch (requires PR + status checks), so the
+        # version bump has to land via PR rather than a direct push.
+        git checkout -b "$BRANCH"
         git add ./Xero.NetStandard.OAuth2Client/Xero.NetStandard.OAuth2Client.csproj
-        git commit -m "Bump OAuth2Client version to ${{steps.calc_version.outputs.version}}"
-        
-        # Push the commit to master
-        git push origin HEAD:master
-        
-        # Create and push the tag
-        git tag "OAuthClient-v${{steps.calc_version.outputs.version}}"
-        git push origin "OAuthClient-v${{steps.calc_version.outputs.version}}"
+        git commit -m "Bump OAuth2Client version to ${VERSION}"
+        git push origin "$BRANCH"
+
+        # Tags aren't covered by the branch protection rule, so this can still
+        # be pushed directly and keeps "Check for changes" working next run.
+        git tag "OAuthClient-v${VERSION}"
+        git push origin "OAuthClient-v${VERSION}"
+
+        PR_URL=$(gh pr create \
+          --base master \
+          --head "$BRANCH" \
+          --title "Bump OAuth2Client version to ${VERSION}" \
+          --body "Automated version bump for OAuth2Client \`${VERSION}\`, already published to nuget.org by this workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}")
+
+        echo "pr_url=$PR_URL" >> "$GITHUB_OUTPUT"
+
+        {
+          echo "## OAuth2Client version bump"
+          echo "Package \`${VERSION}\` was published to nuget.org."
+          echo "\`master\` is protected, so the version bump commit still needs to be merged:"
+          echo ""
+          echo "**➡️ [$PR_URL]($PR_URL)**"
+        } >> "$GITHUB_STEP_SUMMARY"
       working-directory: Xero-NetStandard
       env:
         GH_TOKEN: ${{secrets.GITHUB_TOKEN}}

From abc88a28bde868139c1afe2cf07d3aa806d41052 Mon Sep 17 00:00:00 2001
From: Chris Mitchell <chris.mitchell@xero.com>
Date: Mon, 10 Aug 2026 16:28:50 +1200
Subject: [PATCH 2/2] [XAPI-2340] Trim comments in OAuth2Client version-bump
 step

---
 .github/workflows/publish-Oauth2Client-package.yml | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/publish-Oauth2Client-package.yml b/.github/workflows/publish-Oauth2Client-package.yml
index b8c9a054..beb3523a 100644
--- a/.github/workflows/publish-Oauth2Client-package.yml
+++ b/.github/workflows/publish-Oauth2Client-package.yml
@@ -165,15 +165,13 @@ jobs:
         VERSION="${{steps.calc_version.outputs.version}}"
         BRANCH="bump-oauth2client-v${VERSION}"
 
-        # master is a protected branch (requires PR + status checks), so the
-        # version bump has to land via PR rather than a direct push.
+        # Open a PR for the version bump; master requires one.
         git checkout -b "$BRANCH"
         git add ./Xero.NetStandard.OAuth2Client/Xero.NetStandard.OAuth2Client.csproj
         git commit -m "Bump OAuth2Client version to ${VERSION}"
         git push origin "$BRANCH"
 
-        # Tags aren't covered by the branch protection rule, so this can still
-        # be pushed directly and keeps "Check for changes" working next run.
+        # Push the tag directly.
         git tag "OAuthClient-v${VERSION}"
         git push origin "OAuthClient-v${VERSION}"
 
@@ -187,8 +185,7 @@ jobs:
 
         {
           echo "## OAuth2Client version bump"
-          echo "Package \`${VERSION}\` was published to nuget.org."
-          echo "\`master\` is protected, so the version bump commit still needs to be merged:"
+          echo "Package \`${VERSION}\` was published to nuget.org. Merge the version bump PR:"
           echo ""
           echo "**➡️ [$PR_URL]($PR_URL)**"
         } >> "$GITHUB_STEP_SUMMARY"