Skip to content

feat(examples): add PR bump preview example#19

Open
bearomorphism wants to merge 2 commits into
commitizen-tools:mainfrom
bearomorphism:feat/pr-bump-preview-example
Open

feat(examples): add PR bump preview example#19
bearomorphism wants to merge 2 commits into
commitizen-tools:mainfrom
bearomorphism:feat/pr-bump-preview-example

Conversation

@bearomorphism
Copy link
Copy Markdown
Collaborator

@bearomorphism bearomorphism commented May 9, 2026

Description

Adds an example workflow examples/pr-bump-preview.yaml showing how to use setup-cz to post a sticky comment on every pull request previewing the version bump that would happen on merge. This addresses commitizen-tools/commitizen#1510.

What it does

  • Triggers on pull_request_target so the workflow has pull-requests: write permission for fork PRs too. Only cz bump --dry-run (a read-only command) is executed against the PR commits.
  • Uses commitizen-tools/setup-cz@main to install the cz CLI.
  • Captures cz bump --dry-run --yes output and exit code:
    • 0: dry-run succeeded — the comment shows the next version, tag, increment, and changelog preview.
    • 21 (NoneIncrementExit): treated as "no eligible commits for a bump" instead of a workflow failure.
    • Any other code: surfaced inside the comment so reviewers can see what went wrong.
  • Uses peter-evans/create-or-update-comment@v4 with a hidden <!-- commitizen-bump-preview --> marker so the comment is replaced (rather than duplicated) on every push.

Companion changes

  • commitizen-tools/commitizen PR #1957 adds the same workflow to the commitizen repo and documents the pattern.
  • commitizen-tools/commitizen-action PR #102 adopts the same pattern.

Closes commitizen-tools/commitizen#1510

Expected output

The workflow posts (and replaces on every push) a single sticky comment whose body depends on the dry-run exit code.

cz bump --dry-run --yes succeeds (status 0) — eligible bump:

Rendered comment

🔍 Commitizen bump preview

Merging this PR will produce the following bump:

bump: version 4.15.1 → 4.16.0
tag to create: v4.16.0
increment detected: MINOR
<!-- commitizen-bump-preview -->
## 🔍 Commitizen bump preview

Merging this PR will produce the following bump:

```
bump: version 4.15.1 → 4.16.0
tag to create: v4.16.0
increment detected: MINOR
```

NoneIncrementExit (status 21) — no eligible commits:

🔍 Commitizen bump preview

No commits in this PR are eligible for a version bump.

Any other non-zero status — error surfaced inside the comment:

🔍 Commitizen bump preview

⚠️ cz bump --dry-run exited with status 3:

NoCommitsFoundError

Adds an example workflow showing how to run `cz bump --dry-run`
against incoming pull requests and post (or update) a sticky comment
with the preview. Useful for catching unexpected version bumps before
merging.

Closes commitizen-tools/commitizen#1510

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Mirrors the security fix on commitizen-tools/commitizen#1957:

* `cz bump` can render Jinja templates from the working directory when
  `update_changelog_on_bump` is set in config, using a non-sandboxed
  loader. Under `pull_request_target` this would let a fork PR execute
  arbitrary code with a write token, so gate the job to same-repo PRs
  only (`head.repo == base.repo`).
* Add `persist-credentials: false` on `actions/checkout` as defense
  in depth.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bearomorphism
Copy link
Copy Markdown
Collaborator Author

bearomorphism commented May 9, 2026

Note for reviewers: the duplication across this repo, commitizen-action, and setup-cz is intentional for now. Tracked as a follow-up in commitizen-tools/commitizen#1959 (mirrored at #20) — once these PRs are merged and we have one or two real bump-preview comments in production, we plan to promote the example into a reusable workflow in setup-cz and shrink the workflows in commitizen + commitizen-action to ~8-line wrappers pinned to a tagged setup-cz release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Generate expected bump version comment when receiving a new pull request

1 participant