feat: rework PR bump preview workflow#102
Open
bearomorphism wants to merge 3 commits intocommitizen-tools:masterfrom
Open
feat: rework PR bump preview workflow#102bearomorphism wants to merge 3 commits intocommitizen-tools:masterfrom
bearomorphism wants to merge 3 commits intocommitizen-tools:masterfrom
Conversation
Replace the previous draft (poetry-based) attempt with a simpler, robust implementation: * Use commitizen-tools/setup-cz instead of installing Poetry/cz from the project lockfile. The action repo doesn't need its own Python toolchain to run cz. * Trigger on pull_request_target so the workflow has pull-requests: write even for fork PRs. Only `cz bump --dry-run` is executed, so PR-controlled scripts are not run. * Capture the dry-run exit status. Treat exit code 21 (NoneIncrementExit) as 'no eligible commits' instead of a hard failure, and surface other non-zero codes in the comment. * Use a hidden HTML marker so the comment is replaced (rather than duplicated) on every push. Closes commitizen-tools/commitizen#1510 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bearomorphism
changed the title
Mirrors the security fix on commitizen-tools/commitizen#1957: * `cz bump` can render Jinja templates from the working directory when `update_changelog_on_bump` is set in config, using a non-sandboxed loader. Under `pull_request_target` this would let a fork PR execute arbitrary code with a write token, so gate the job to same-repo PRs only (`head.repo == base.repo`). * Add `persist-credentials: false` on `actions/checkout` as defense in depth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Author
|
Note for reviewers: the duplication across this repo, |
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Reworks the PR bump preview workflow that addresses commitizen-tools/commitizen#1510. Whenever a PR is opened, reopened, synchronised, or marked ready for review, the workflow runs
cz bump --dry-runand posts (or updates) a sticky comment showing the would-be version bump and changelog entries.What changed since the draft
commitizen-tools/setup-czinstead of bootstrapping Poetry to install commitizen — fewer moving parts, no need for the action repo to ship a working Python project to run cz.pull_request_targetso the workflow haspull-requests: writepermission for PRs from forks too. The job only runscz bump --dry-run, a read-only command, so PR-controlled scripts are not executed.NoneIncrementExit) as "no eligible bump" rather than a workflow failure. Other non-zero codes are surfaced inside the comment body so they're visible without digging into the run logs.<!-- commitizen-bump-preview -->) —peter-evans/create-or-update-commentreplaces the previous preview on each push instead of stacking comments.ready_for_review.A matching workflow has been opened in
commitizen-tools/commitizen(PR #1957) and an example will be added tocommitizen-tools/setup-cz.Closes commitizen-tools/commitizen#1510
Expected output
The workflow posts (and replaces on every push) a single sticky comment whose body depends on the dry-run exit code.
cz bump --dry-run --yessucceeds (status 0) — eligible bump:Rendered comment
NoneIncrementExit(status 21) — no eligible commits:Any other non-zero status — error surfaced inside the comment:
Steps to test
Once merged, open a follow-up PR against this repository and confirm a
🔍 Commitizen bump previewcomment appears and updates as you push commits.