Repository navigation
110 lines (102 loc) · 3.77 KB
/
Copy pathpr-bump-preview.yml
File metadata and controls
110 lines (102 loc) · 3.77 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
name: PR bump preview
on:
pull_request_target:
types: [opened, reopened, synchronize, ready_for_review]
permissions:
contents: read
pull-requests: write
jobs:
bump-preview:
# Skip drafts, and skip fork PRs entirely. `pull_request_target` runs with
# the base repo's GITHUB_TOKEN (write access to PR comments). `cz bump`
# can render Jinja templates from the checked-out workspace whenever
# `update_changelog_on_bump` is set in config, and the renderer is not
# sandboxed (FileSystemLoader('.')) — running it against fork-controlled
# files would risk RCE / token exfiltration. Same-repo PRs are written by
# collaborators who already have push access, so the same risk doesn't
# apply.
if: >
${{
github.event.pull_request.draft == false &&
github.event.pull_request.head.repo.full_name ==
github.event.pull_request.base.repo.full_name
}}
runs-on: ubuntu-latest
steps:
- name: Check out PR head
uses: actions/checkout@v7
with:
ref: ${{ github.event.pull_request.head.sha }}
fetch-depth: 0
fetch-tags: true
# Defense in depth: don't write the workflow token to .git/config.
persist-credentials: false
- name: Set up Commitizen
uses: commitizen-tools/setup-cz@main
with:
set-git-config: false
- name: Run cz bump --dry-run
id: dry-run
run: |
set +e
output="$(cz bump --dry-run --yes 2>&1)"
status=$?
set -e
{
echo "status=${status}"
echo "output<<__CZ_BUMP_PREVIEW__"
printf '%s\n' "${output}"
echo "__CZ_BUMP_PREVIEW__"
} >> "$GITHUB_OUTPUT"
- name: Build comment body
env:
STATUS: ${{ steps.dry-run.outputs.status }}
OUTPUT: ${{ steps.dry-run.outputs.output }}
run: |
{
echo "<!-- commitizen-bump-preview -->"
echo "## 🔍 Commitizen bump preview"
echo ""
case "${STATUS}" in
0)
echo "Merging this PR will produce the following bump:"
echo ""
echo '```'
printf '%s\n' "${OUTPUT}"
echo '```'
;;
21)
echo "No commits in this PR are eligible for a version bump."
;;
*)
echo "⚠️ \`cz bump --dry-run\` exited with status \`${STATUS}\`:"
echo ""
echo '```'
printf '%s\n' "${OUTPUT}"
echo '```'
;;
esac
} > comment.md
# Look up an existing preview comment so the next step edits it in
# place instead of appending a new one on every run.
# `peter-evans/create-or-update-comment` does not search by body
# itself -- it only creates new comments, or updates a specific
# `comment-id`.
- name: Find existing preview comment
id: find-comment
uses: peter-evans/find-comment@v4
with:
token: ${{ secrets.GITHUB_TOKEN }}
issue-number: ${{ github.event.pull_request.number }}
comment-author: "github-actions[bot]"
body-includes: "<!-- commitizen-bump-preview -->"
- name: Post or update PR comment
uses: peter-evans/create-or-update-comment@v5
with:
token: ${{ secrets.GITHUB_TOKEN }}
# When empty (no prior comment found) a new one is created;
# otherwise the existing comment is edited in place.
comment-id: ${{ steps.find-comment.outputs.comment-id }}
issue-number: ${{ github.event.pull_request.number }}
body-path: comment.md
edit-mode: replace