Separate build work into 3 steps. Version bump using labels. And make test build using labels

.github/workflows/pr-create.yml

@@ -0,0 +1,71 @@
+name: Open / Update PR
+
+# Triggered by any push to a non-main branch where src/ files changed.
+# Opens a PR to main if one does not exist, or updates its body if it does.
+# When creating a new PR it assigns the default "bump:patch" label.
+# When updating an existing PR the label is NOT changed, preserving any
+# manual label change (e.g. bump:minor, bump:major) made by a reviewer.
+#
+# Pre-requisite: create the label once in the repo:
+#   gh label create "bump:patch" --color "0075ca" --description "Default patch-version bump"
+
+on:
+  push:
+    branches-ignore:
+      - main
+    paths:
+      - 'src/**'
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  pr:
+    runs-on: ubuntu-latest
+    if: github.actor != 'github-actions[bot]'
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Collect src/ commits on this branch
+        id: commits
+        run: |
+          LOG=$(git log "origin/main..HEAD" --oneline -- src/ | head -50)
+          EOF=$(dd if=/dev/urandom bs=15 count=1 2>/dev/null | base64)
+          echo "log<<$EOF" >> "$GITHUB_OUTPUT"
+          echo "$LOG"      >> "$GITHUB_OUTPUT"
+          echo "$EOF"      >> "$GITHUB_OUTPUT"
+
+      - name: Create or update PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BRANCH:  ${{ github.ref_name }}
+          COMMITS: ${{ steps.commits.outputs.log }}
+        run: |
+          TITLE="feat: $BRANCH"
+
+          {
+            echo "## Changes in \`$BRANCH\`"
+            echo ""
+            echo "${COMMITS:-No src/ changes detected.}"
+          } > /tmp/pr-body.md
+
+          EXISTING=$(gh pr list \
+            --head "$BRANCH" \
+            --json number --jq '.[0].number' 2>/dev/null || true)
+
+          if [[ -n "$EXISTING" ]]; then
+            gh pr edit "$EXISTING" --body-file /tmp/pr-body.md
+            echo "Updated PR #$EXISTING body (label unchanged)"
+          else
+            gh pr create \
+              --title "$TITLE" \
+              --body-file /tmp/pr-body.md \
+              --base main \
+              --head "$BRANCH" \
+              --label "bump:patch"
+            echo "Opened new PR with label bump:patch"
+          fi

.github/workflows/release.yml

@@ -1,10 +1,15 @@
 name: Build and Release
 
-# Triggered when a "Release vX.Y.Z" PR is merged into main
+# Triggered when debian/changelog changes on main — meaning version-bump.yml
-# (detected by a push to main that changes debian/changelog).
+# just committed a new version. Builds the .deb and publishes a GitHub Release.
+# The actor guard ensures this only fires for the bot's commit, not manual edits.
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - 'debian/changelog'
 
 permissions:
   contents: write
@@ -12,6 +17,7 @@ permissions:
 jobs:
   release:
     runs-on: ubuntu-latest
+    if: github.actor == 'github-actions[bot]'
 
     steps:
       - uses: actions/checkout@v4
@@ -76,4 +82,4 @@ jobs:
             --title "pve-mod $TAG" \
             --notes "$NOTES" \
             "$DEB" \
-            "src/install.sh"
+            "src/Scripts/install.sh"

.github/workflows/test-release.yml

@@ -1,18 +1,23 @@
 name: Test Release Build
 
-# Temporary workflow to validate the release build on the feature branch.
+# Runs on every push, manual dispatch, or when the 'make-test-build' label
+# is assigned to a pull request.
 
 on:
   push:
   workflow_dispatch:
+  pull_request:
+    types: [labeled]
 
 jobs:
   test-release-build:
     runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.label.name == 'make-test-build'
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Install build deps
         run: sudo apt-get install -y devscripts debhelper build-essential

.github/workflows/version-bump.yml

@@ -1,25 +1,20 @@
 name: Version Bump
 
-# Triggered by any push to src/ on non-main branches.
+# Triggered when src/ changes land on main (i.e. a PR just merged).
-# Increments the patch version in debian/changelog, commits it,
+# Increments the patch version in debian/changelog and commits it.
-# and opens (or updates) a "Release vX.Y.Z" PR to main.
+# The changelog commit only touches debian/changelog (not src/),
-# The changelog commit touches only debian/changelog (not src/),
 # so it does not re-trigger this workflow.
-#
+# release.yml picks up the changelog change and builds/publishes the release.
-# NOTE: GITHUB_TOKEN cannot push to forks, so this workflow only works for
-# branches on the upstream repo (Meliox/PVE-mods). External contributors
-# opening PRs from forks will not get an automatic version bump.
 
 on:
   push:
-    branches-ignore:
+    branches:
       - main
     paths:
       - 'src/**'
 
 permissions:
   contents: write
-  pull-requests: write
 
 jobs:
   bump:
@@ -44,7 +39,7 @@ jobs:
           echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
           echo "new=$NEW"         >> "$GITHUB_OUTPUT"
 
-      - name: Build PR body from src/ commits since last release
+      - name: Collect src/ commits since last tag
         id: commits
         run: |
           LAST_TAG=$(git tag -l 'v*' | sort -V | tail -n1)
@@ -53,7 +48,6 @@ jobs:
           else
             LOG=$(git log --oneline -- src/ | head -50)
           fi
-          # Escape for GitHub multiline output
           EOF=$(dd if=/dev/urandom bs=15 count=1 2>/dev/null | base64)
           echo "log<<$EOF" >> "$GITHUB_OUTPUT"
           echo "$LOG"      >> "$GITHUB_OUTPUT"
@@ -79,7 +73,7 @@ jobs:
           } > debian/changelog.new
           mv debian/changelog.new debian/changelog
 
-      - name: Commit changelog
+      - name: Commit and push changelog
         env:
           NEW_VERSION: ${{ steps.version.outputs.new }}
         run: |
@@ -88,36 +82,3 @@ jobs:
           git add debian/changelog
           git commit -m "Release v${NEW_VERSION}"
           git push
-
-      - name: Create or update release PR
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NEW_VERSION: ${{ steps.version.outputs.new }}
-          COMMITS: ${{ steps.commits.outputs.log }}
-          BRANCH: ${{ github.ref_name }}
-        run: |
-          TITLE="Release v${NEW_VERSION}"
-
-          {
-            echo "## Changes since last release"
-            echo ""
-            echo "${COMMITS:-No src/ changes detected.}"
-            echo ""
-            echo "---"
-            echo "*Merge this PR to build and publish the \`pve-mod_${NEW_VERSION}_all.deb\` release.*"
-          } > /tmp/pr-body.md
-
-          EXISTING=$(gh pr list \
-            --search "\"$TITLE\" in:title" \
-            --json number --jq '.[0].number' 2>/dev/null || true)
-
-          if [[ -n "$EXISTING" ]]; then
-            gh pr edit "$EXISTING" --body-file /tmp/pr-body.md
-            echo "Updated existing PR #$EXISTING"
-          else
-            gh pr create \
-              --title "$TITLE" \
-              --body-file /tmp/pr-body.md \
-              --base  main \
-              --head  "$BRANCH"
-          fi