mirror of
https://github.com/jdx/mise-action.git
synced 2026-05-14 13:50:33 +00:00
a0eaf7aa03
Some checks failed
release-plz / release-plz (push) Has been cancelled
build-test / build (push) Has been cancelled
zizmor / zizmor (push) Has been cancelled
Continuous Integration / TypeScript Tests (push) Has been cancelled
Check dist/ / Check dist/ (push) Has been cancelled
CodeQL / Analyze (push) Has been cancelled
Test Redacted Environment Variables / test-redacted-env (push) Has been cancelled
build-test / alpine (push) Has been cancelled
build-test / macos (push) Has been cancelled
build-test / ubuntu (push) Has been cancelled
build-test / windows (push) Has been cancelled
build-test / specific_version (push) Has been cancelled
build-test / checksum_failure (push) Has been cancelled
build-test / custom_cache_key (push) Has been cancelled
build-test / fetch_from_github (push) Has been cancelled
build-test / final (push) Has been cancelled
## Summary
- Follow-up to [#471](https://github.com/jdx/mise-action/pull/471): the
release-plz checkout now uses `persist-credentials: false`, so the token
isn't written to `.git/config` and `git push origin release --force` in
[scripts/release-plz.sh](scripts/release-plz.sh) would 403.
- Mirror the workaround already applied to
[scripts/postversion.sh:9](scripts/postversion.sh:9) by calling `gh auth
setup-git` after the `git config user.{name,email}` block, before any
`git push`.
Flagged by Cursor Bugbot on
https://github.com/jdx/mise-action/pull/471#pullrequestreview-4275760577.
## Test plan
- [ ] Next scheduled release-plz run (or manual `workflow_dispatch`)
successfully pushes the `release` branch without a 403.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> Low risk CI-only change that affects the release automation path; main
impact is whether the workflow can successfully push the `release`
branch.
>
> **Overview**
> Fixes the `scripts/release-plz.sh` release automation to run `gh auth
setup-git` after setting the git author, ensuring `git push` works when
`actions/checkout` uses `persist-credentials: false`.
>
> This prevents 403 failures when pushing the forced `release` branch
during automated version bump PR creation.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
f69419101e. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
84 lines
2.9 KiB
Bash
Executable file
84 lines
2.9 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# shellcheck shell=bash
|
|
set -euxo pipefail
|
|
|
|
# Get the current package.json version before any modifications
|
|
cur_pkg_version="$(jq -r .version package.json)"
|
|
|
|
# Get the latest GitHub release version
|
|
latest_release="$(gh release view --json tagName --jq .tagName 2>/dev/null || echo "")"
|
|
latest_release_version="${latest_release#v}"
|
|
|
|
# Check if package.json version is newer than the latest release
|
|
if [ -n "$latest_release_version" ] && [ "$cur_pkg_version" = "$latest_release_version" ]; then
|
|
echo "Package version $cur_pkg_version matches latest release $latest_release. Nothing to release."
|
|
# Still check if we need to create a new PR for unreleased changes
|
|
|
|
# Get the latest released version tag
|
|
latest_tag="$(git tag --list | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$' | sort -V | tail -1)"
|
|
|
|
# Check if there are commits since the last release
|
|
if [ -n "$latest_tag" ]; then
|
|
commits_since_release="$(git rev-list "$latest_tag"..HEAD --count)"
|
|
if [ "$commits_since_release" -eq 0 ]; then
|
|
echo "No commits since last release $latest_tag"
|
|
exit 0
|
|
fi
|
|
echo "Found $commits_since_release commits since $latest_tag"
|
|
fi
|
|
|
|
# Get the next version and changelog from git-cliff
|
|
version="$(git cliff --bumped-version)"
|
|
changelog="$(git cliff --bump --unreleased | tail -n +2)"
|
|
|
|
if [ "${DRY_RUN:-1}" == 1 ]; then
|
|
echo "version: $version"
|
|
echo "changelog: $changelog"
|
|
exit 0
|
|
fi
|
|
|
|
# Check if there are any unreleased changes
|
|
if [ -z "$changelog" ] || [ "$changelog" = "<!-- generated by git-cliff -->" ]; then
|
|
echo "No unreleased changes found"
|
|
exit 0
|
|
fi
|
|
|
|
# Configure git for automated commits
|
|
git config user.name mise-en-dev
|
|
git config user.email 123107610+mise-en-dev@users.noreply.github.com
|
|
|
|
# Configure git to use gh's credential helper. The checkout step uses
|
|
# persist-credentials: false (per zizmor's artipacked audit), so the
|
|
# token isn't written to .git/config and raw `git push` would 403.
|
|
gh auth setup-git
|
|
|
|
# Create a PR with the version bump
|
|
npm version "${version#v}" --no-git-tag-version
|
|
|
|
git add package.json package-lock.json
|
|
git status
|
|
|
|
# Create release branch and commit
|
|
git checkout -B release
|
|
git commit -m "chore: release $version"
|
|
|
|
# Push to release branch
|
|
git push origin release --force
|
|
|
|
# Create or update PR
|
|
if gh pr create --title "chore: release $version" --body "$changelog" --label "release"; then
|
|
echo "Created new release PR"
|
|
else
|
|
gh pr edit --title "chore: release $version" --body "$changelog"
|
|
echo "Updated existing release PR"
|
|
fi
|
|
elif [ -n "$cur_pkg_version" ] && [ "$cur_pkg_version" != "$latest_release_version" ]; then
|
|
# Package version is different from latest release
|
|
echo "Package version v$cur_pkg_version is newer than latest release $latest_release."
|
|
echo "Release will be created by the release.yml workflow when the PR is merged."
|
|
# Exit successfully - the release.yml workflow handles actual release creation
|
|
exit 0
|
|
else
|
|
echo "No action needed"
|
|
exit 0
|
|
fi
|