feat: rework PR bump preview workflow - #102
Open
bearomorphism wants to merge 3 commits into
Open
Conversation
Copy link
Copy Markdown
Sorry, something went wrong.
Replace the previous draft (poetry-based) attempt with a simpler, robust implementation: * Use commitizen-tools/setup-cz instead of installing Poetry/cz from the project lockfile. The action repo doesn't need its own Python toolchain to run cz. * Trigger on pull_request_target so the workflow has pull-requests: write even for fork PRs. Only `cz bump --dry-run` is executed, so PR-controlled scripts are not run. * Capture the dry-run exit status. Treat exit code 21 (NoneIncrementExit) as 'no eligible commits' instead of a hard failure, and surface other non-zero codes in the comment. * Use a hidden HTML marker so the comment is replaced (rather than duplicated) on every push. Closes commitizen-tools/commitizen#1510 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bearomorphism
marked this pull request as ready for review
May 9, 2026 07:15
bearomorphism
marked this pull request as draft
May 9, 2026 08:33
bearomorphism
marked this pull request as ready for review
May 9, 2026 08:36
Mirrors the security fix on commitizen-tools/commitizen#1957: * `cz bump` can render Jinja templates from the working directory when `update_changelog_on_bump` is set in config, using a non-sandboxed loader. Under `pull_request_target` this would let a fork PR execute arbitrary code with a write token, so gate the job to same-repo PRs only (`head.repo == base.repo`). * Add `persist-credentials: false` on `actions/checkout` as defense in depth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copy link
Copy Markdown
Author
|
Note for reviewers: the duplication across this repo, commitizen-action, and setup-cz is intentional for now. Tracked as a follow-up in commitizen-tools/commitizen#1959 (mirrored at commitizen-tools/setup-cz#20) — once these PRs are merged and we have one or two real bump-preview comments in production, we plan to promote the example into a reusable workflow in setup-cz and shrink the workflows in commitizen + commitizen-action to ~8-line wrappers pinned to a tagged setup-cz release. |
Sorry, something went wrong.
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Reworks the PR bump preview workflow that addresses commitizen-tools/commitizen#1510. Whenever a PR is opened, reopened, synchronised, or marked ready for review, the workflow runs cz bump --dry-run and posts (or updates) a sticky comment showing the would-be version bump and changelog entries.
What changed since the draft
A matching workflow has been opened in commitizen-tools/commitizen (PR #1957) and an example will be added to commitizen-tools/setup-cz.
Closes commitizen-tools/commitizen#1510
Expected output
The workflow posts (and replaces on every push) a single sticky comment whose body depends on the dry-run exit code.
cz bump --dry-run --yes succeeds (status 0) — eligible bump:
Rendered commentNoneIncrementExit (status 21) — no eligible commits:
Any other non-zero status — error surfaced inside the comment:
Steps to test
Once merged, open a follow-up PR against this repository and confirm a 🔍 Commitizen bump preview comment appears and updates as you push commits.