-
Notifications
You must be signed in to change notification settings - Fork 41
Merge master into dev #769
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
929eb97
eeb9be4
98f73a8
2864032
af83f76
955643d
09aac2f
fdcfde3
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||
|---|---|---|---|---|---|---|---|---|
|
|
@@ -14,13 +14,19 @@ Draft the next release version and changelog from merged PRs. | |||||||
|
|
||||||||
| ## Workflow | ||||||||
|
|
||||||||
| 0. Ask for elevated permissions with network access to run `git fetch --all --tags` and the GitHub CLI PR commands used to collect merged PRs (for example `gh pr list`, `gh pr view`, or `gh api`). | ||||||||
| 1. Fetch the latest refs and tags: | ||||||||
| 0. Ask for elevated permissions with network access to run the `git fetch` and GitHub CLI PR commands used to collect merged PRs (for example `gh pr list`, `gh pr view`, or `gh api`). | ||||||||
| 1. Fetch the latest refs and tags from `origin` only. Do **not** use | ||||||||
| `git fetch --all` — it also fetches unrelated remotes (e.g. a personal fork or | ||||||||
| another contributor's remote) and can fail on those or clobber local tags, | ||||||||
| aborting the whole fetch: | ||||||||
|
|
||||||||
| ```bash | ||||||||
| git fetch --all --tags | ||||||||
| git fetch --tags origin | ||||||||
| ``` | ||||||||
|
|
||||||||
| If you only need to read the tags without touching local state, use | ||||||||
| `git ls-remote --tags origin` instead. | ||||||||
|
|
||||||||
| 2. Determine the next version number: | ||||||||
| - Consider only tags that start with `v` and match strict semver: | ||||||||
| `^v[0-9]+\.[0-9]+\.[0-9]+$` (ignore pre-release/build suffixes). | ||||||||
|
|
@@ -45,18 +51,32 @@ git fetch --all --tags | |||||||
| - `Bug Fixes` | ||||||||
| - `Breaking Changes` | ||||||||
|
|
||||||||
| 5. Classify PRs deterministically: | ||||||||
| - `Breaking Changes` if any of: | ||||||||
| - title contains `!` in conventional-commit style segment, or | ||||||||
| - label indicates breaking change (e.g., `breaking`), or | ||||||||
| - body contains `BREAKING CHANGE`. | ||||||||
| - Otherwise `New Features` if labels/titles indicate feature work | ||||||||
| (e.g., `feature`, `enhancement`, `feat`). | ||||||||
| 5. Drop reverted pairs first. If a PR in scope reverts another PR that is also | ||||||||
| in scope (revert PRs usually say "Revert ..." and name the reverted PR or | ||||||||
| commit in the title/body), the two cancel out to no net user-facing change. | ||||||||
| Omit both from the sections and instead list them under a short | ||||||||
| `Reverted (no net change)` note at the end, so the reader knows why those PR | ||||||||
| numbers are absent. | ||||||||
|
|
||||||||
| 6. Classify the remaining PRs. This repo does not use conventional-commit | ||||||||
| markers, and its labels are topical (`proc`, `viz`, `spool`, `IO`, | ||||||||
| `transform`, `bug`, ...) rather than semantic, so labels alone are not | ||||||||
| enough — read each PR's title and body and use judgment: | ||||||||
| - `Breaking Changes` if the change removes or alters existing public API, | ||||||||
| defaults, or behavior in a way that can break callers — regardless of whether | ||||||||
| any `!`, `breaking` label, or `BREAKING CHANGE` text is present. A signature | ||||||||
| or keyword change to a documented `Patch`/`dc` method is breaking even when | ||||||||
| unlabeled; when unsure, list it here with a one-line note on what changed. | ||||||||
| - Otherwise `New Features` if the PR adds a capability, option, or notable | ||||||||
| performance improvement (judge from the title/body, not just a | ||||||||
| `feature`/`enhancement` label, which is often missing). | ||||||||
| - Otherwise `Bug Fixes`. | ||||||||
| - Sort entries by PR number ascending. | ||||||||
| - Prefer user-facing behavior over internal implementation when deciding and | ||||||||
| when summarizing. | ||||||||
| - Sort entries within each section by PR number ascending. | ||||||||
| - Include a link to the PR in the changelog. | ||||||||
|
|
||||||||
| 6. Print to screen: | ||||||||
| 7. Print to screen: | ||||||||
| - The new version tag. | ||||||||
| - The drafted changelog. | ||||||||
|
|
||||||||
|
|
@@ -73,6 +93,8 @@ Next Version: vX.Y.Z | |||||||
|
|
||||||||
| ## Breaking Changes | ||||||||
| - #125: Short summary (https://github.com/OWNER/REPO/pull/125) | ||||||||
|
|
||||||||
| Reverted (no net change): #126 reverted by #127 | ||||||||
|
Comment on lines
+96
to
+97
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win Include links for reverted PRs too. The output example omits links for Proposed wording-Reverted (no net change): `#126` reverted by `#127`
+Reverted (no net change): `#126` (https://github.com/OWNER/REPO/pull/126) reverted by `#127` (https://github.com/OWNER/REPO/pull/127)📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||
| ``` | ||||||||
|
|
||||||||
| ## Notes | ||||||||
|
|
@@ -81,3 +103,4 @@ Next Version: vX.Y.Z | |||||||
| - Prefer explicit, user-facing PR summaries over internal implementation details. | ||||||||
| - If no merged PRs are found in scope, still print the next version and include | ||||||||
| all sections with `- None`. | ||||||||
| - Omit the `Reverted (no net change)` line when no reverted pairs exist. | ||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -31,7 +31,7 @@ jobs: | |
| name: github-pages | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@v5 | ||
| with: | ||
| fetch-tags: "true" | ||
| fetch-depth: '0' | ||
|
Comment on lines
+34
to
37
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '--- workflow checkout occurrences ---\n'
for f in $(git ls-files '.github/workflows/*'); do
echo "### $f"
nl -ba "$f" | sed -n '1,120p' | grep -n -A4 -B2 'actions/checkout' || true
done
printf '\n--- network_tests context references ---\n'
rg -n "network_tests|persist-credentials|fetch-tags|fetch-depth" .github/workflows || trueRepository: DASDAE/dascore Length of output: 243 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow checkout occurrences ---'
find .github/workflows -maxdepth 1 -type f -print | sort | while read -r f; do
echo "### $f"
nl -ba "$f" | sed -n '1,120p' | grep -n -A4 -B2 'actions/checkout' || true
done
printf '%s\n' ''
printf '%s\n' '--- network_tests / persist-credentials / fetch flags references ---'
rg -n "network_tests|persist-credentials|fetch-tags|fetch-depth" .github/workflows || trueRepository: DASDAE/dascore Length of output: 2701 🌐 Web query:
💡 Result: In actions/checkout v5, the persist-credentials input parameter defaults to true [1][2]. When set to true (the default), the action configures the GitHub Actions authentication token or SSH key in the local git configuration [2][3]. This allows your workflow scripts to run authenticated git commands (such as git push or git pull) against the repository [2][4]. The action automatically removes these credentials during the post-job cleanup process [2][5]. If you wish to prevent the action from configuring these credentials, you can explicitly set persist-credentials to false in your workflow file [2][3]: - uses: actions/checkout@v5 with: persist-credentials: false Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow checkout lines with line numbers ---'
find .github/workflows -maxdepth 1 -type f -print | sort | while read -r f; do
echo "### $f"
grep -n -C 3 'actions/checkout' "$f" || true
done
printf '%s\n' ''
printf '%s\n' '--- YAML references to ghp-token / gh-token / git fetch --tags / auth in docs workflows ---'
rg -n 'ghp-token|gh-token|git fetch|--fetch|fetch tags|mamba-install-dascore|uses: mamba' .github/workflows || true
printf '%s\n' ''
printf '%s\n' '--- file sizes ---'
find .github/workflows -maxdepth 1 -type f -print | sort | xargs wc -lRepository: DASDAE/dascore Length of output: 5021 Disable persisted checkout credentials where checkout credentials are not needed.
🧰 Tools🪛 zizmor (1.26.1)[warning] 34-37: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 📍 Affects 9 files
🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Verify reverted pairs before omitting them.
A “Revert …” title/body is not sufficient proof that the original PR and revert produce no net user-facing change; reverts can be partial or followed by dependent changes. Require a diff/result check before dropping both PRs from the main sections.
Proposed wording
📝 Committable suggestion
🤖 Prompt for AI Agents