From 07eeaeeda051ccb91e28e4062e79bd661dc97a63 Mon Sep 17 00:00:00 2001 From: Yordis Prieto Date: Mon, 21 Sep 2026 17:55:18 -0400 Subject: [PATCH 1/7] chore: release with release-please Consumers have to pin a full commit SHA, so without tags and a changelog there is nothing telling them which SHA is worth moving to. Signed-off-by: Yordis Prieto --- .github/release-please-config.json | 24 ++++++++++++++++ .github/release-please-manifest.json | 3 ++ .github/workflows/release-please.yml | 24 ++++++++++++++++ README.md | 41 ++++++++++++++++++++++++++++ 4 files changed, 92 insertions(+) create mode 100644 .github/release-please-config.json create mode 100644 .github/release-please-manifest.json create mode 100644 .github/workflows/release-please.yml diff --git a/.github/release-please-config.json b/.github/release-please-config.json new file mode 100644 index 0000000..b075504 --- /dev/null +++ b/.github/release-please-config.json @@ -0,0 +1,24 @@ +{ + "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", + "release-type": "simple", + "bump-minor-pre-major": true, + "bump-patch-for-minor-pre-major": false, + "include-component-in-tag": false, + "include-v-in-tag": true, + "changelog-sections": [ + { "type": "feat", "section": "Features", "hidden": false }, + { "type": "fix", "section": "Bug Fixes", "hidden": false }, + { "type": "chore", "section": "Miscellaneous", "hidden": true } + ], + "packages": { + ".": {} + }, + "plugins": [ + { "type": "sentence-case" } + ], + "draft": false, + "draft-pull-request": false, + "prerelease": false, + "separate-pull-requests": false, + "signoff": "SHT Bot <61149376+sht-bot@users.noreply.github.com>" +} diff --git a/.github/release-please-manifest.json b/.github/release-please-manifest.json new file mode 100644 index 0000000..e18ee07 --- /dev/null +++ b/.github/release-please-manifest.json @@ -0,0 +1,3 @@ +{ + ".": "0.0.0" +} diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml new file mode 100644 index 0000000..3611326 --- /dev/null +++ b/.github/workflows/release-please.yml @@ -0,0 +1,24 @@ +name: Release Please + +on: + push: + branches: [main] + +permissions: {} + +jobs: + release-please: + name: Release Please + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: write + pull-requests: write + steps: + # The PAT rather than github.token, so the release pull request and the + # tag it produces trigger the workflows that react to them. + - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 + with: + token: ${{ secrets.GH_PAT_RELEASE_PLEASE_ACTION }} + config-file: .github/release-please-config.json + manifest-file: .github/release-please-manifest.json diff --git a/README.md b/README.md index 284e822..b2759fd 100644 --- a/README.md +++ b/README.md @@ -1 +1,42 @@ # github-actions + +Shared GitHub Actions for [TrogonStack][trogonstack] and +[straw-hat-team][straw-hat-team]. + +| Action | Purpose | +| --- | --- | +| [`semconv/pull-request`](actions/semconv/pull-request) | Fails a pull request whose title is not a Conventional Commit | + +## Using an action + +```yaml +- uses: TrogonStack/github-actions/actions/semconv/pull-request@ # v0.1.0 +``` + +The reference must be a full commit SHA. Both organizations set +`sha_pinning_required`, so a branch or tag reference makes the job refuse to +start rather than fail. Put the release it belongs to in a trailing comment so +the pin is readable, and let Dependabot move it. + +## Versioning + +One version covers the whole repository. A release that only touches one action +still bumps the number every consumer sees, which costs nothing: consumers pin +SHAs, so nothing changes for them until they choose to move. + +Releases are cut by [release-please][release-please] from Conventional Commit +subjects on `main`. `feat` and `fix` produce releases, everything else is a +chore. There is no floating major tag. + +## Contributing + +```sh +mise run github:actions:ci:lint +``` + +Task files live under `.config/mise/tasks/` on a path mirroring the workflow +that calls them, so CI and a local run are the same command. + +[trogonstack]: https://github.com/TrogonStack +[straw-hat-team]: https://github.com/straw-hat-team +[release-please]: https://github.com/googleapis/release-please From 5941f12a9a4bebd05f7183ec36d1a3b600b30f6e Mon Sep 17 00:00:00 2001 From: Yordis Prieto Date: Mon, 21 Sep 2026 17:59:55 -0400 Subject: [PATCH 2/7] chore: version each action on its own A bump should mean the thing you pinned changed, not that something else in the repository moved. Signed-off-by: Yordis Prieto --- .github/release-please-config.json | 9 ++++++--- .github/release-please-manifest.json | 2 +- README.md | 14 ++++++++++---- 3 files changed, 17 insertions(+), 8 deletions(-) diff --git a/.github/release-please-config.json b/.github/release-please-config.json index b075504..362360f 100644 --- a/.github/release-please-config.json +++ b/.github/release-please-config.json @@ -3,15 +3,19 @@ "release-type": "simple", "bump-minor-pre-major": true, "bump-patch-for-minor-pre-major": false, - "include-component-in-tag": false, + "include-component-in-tag": true, "include-v-in-tag": true, + "tag-separator": "@", + "separate-pull-requests": true, "changelog-sections": [ { "type": "feat", "section": "Features", "hidden": false }, { "type": "fix", "section": "Bug Fixes", "hidden": false }, { "type": "chore", "section": "Miscellaneous", "hidden": true } ], "packages": { - ".": {} + "actions/semconv/pull-request": { + "component": "semconv-pull-request" + } }, "plugins": [ { "type": "sentence-case" } @@ -19,6 +23,5 @@ "draft": false, "draft-pull-request": false, "prerelease": false, - "separate-pull-requests": false, "signoff": "SHT Bot <61149376+sht-bot@users.noreply.github.com>" } diff --git a/.github/release-please-manifest.json b/.github/release-please-manifest.json index e18ee07..4087617 100644 --- a/.github/release-please-manifest.json +++ b/.github/release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.0.0" + "actions/semconv/pull-request": "0.0.0" } diff --git a/README.md b/README.md index b2759fd..d42705a 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ Shared GitHub Actions for [TrogonStack][trogonstack] and ## Using an action ```yaml -- uses: TrogonStack/github-actions/actions/semconv/pull-request@ # v0.1.0 +- uses: TrogonStack/github-actions/actions/semconv/pull-request@ # semconv-pull-request@v0.1.0 ``` The reference must be a full commit SHA. Both organizations set @@ -20,14 +20,20 @@ the pin is readable, and let Dependabot move it. ## Versioning -One version covers the whole repository. A release that only touches one action -still bumps the number every consumer sees, which costs nothing: consumers pin -SHAs, so nothing changes for them until they choose to move. +Every action carries its own version. A change to one action releases that +action and leaves the others untouched, so a version bump always means +something changed in the thing you pinned. + +Tags are `@vX.Y.Z`, for example `semconv-pull-request@v0.1.0`, and +each action keeps its own `CHANGELOG.md` next to its `action.yml`. Releases are cut by [release-please][release-please] from Conventional Commit subjects on `main`. `feat` and `fix` produce releases, everything else is a chore. There is no floating major tag. +Adding an action means adding it to `.github/release-please-config.json` and +`.github/release-please-manifest.json`, or it will never be released. + ## Contributing ```sh From 6cf36320a5e24a1aa4e0685fa8cc1f881d061f6c Mon Sep 17 00:00:00 2001 From: Yordis Prieto Date: Mon, 21 Sep 2026 18:02:09 -0400 Subject: [PATCH 3/7] chore: match the changelog sections used across the organization Signed-off-by: Yordis Prieto --- .github/release-please-config.json | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/.github/release-please-config.json b/.github/release-please-config.json index 362360f..271709f 100644 --- a/.github/release-please-config.json +++ b/.github/release-please-config.json @@ -8,9 +8,16 @@ "tag-separator": "@", "separate-pull-requests": true, "changelog-sections": [ - { "type": "feat", "section": "Features", "hidden": false }, - { "type": "fix", "section": "Bug Fixes", "hidden": false }, - { "type": "chore", "section": "Miscellaneous", "hidden": true } + { + "type": "feat", + "section": "Features", + "hidden": false + }, + { + "type": "fix", + "section": "Bug Fixes", + "hidden": false + } ], "packages": { "actions/semconv/pull-request": { @@ -18,7 +25,9 @@ } }, "plugins": [ - { "type": "sentence-case" } + { + "type": "sentence-case" + } ], "draft": false, "draft-pull-request": false, From ca4e360d2c1c2ca75a8eff56bffb1298c3670b52 Mon Sep 17 00:00:00 2001 From: Yordis Prieto Date: Mon, 21 Sep 2026 18:08:50 -0400 Subject: [PATCH 4/7] chore: start releases at 0.0.1 Nothing here has proven itself yet, so a feature should move the patch rather than claim a minor. Signed-off-by: Yordis Prieto --- .github/release-please-config.json | 2 +- README.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/release-please-config.json b/.github/release-please-config.json index 271709f..62c1991 100644 --- a/.github/release-please-config.json +++ b/.github/release-please-config.json @@ -2,7 +2,7 @@ "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", "release-type": "simple", "bump-minor-pre-major": true, - "bump-patch-for-minor-pre-major": false, + "bump-patch-for-minor-pre-major": true, "include-component-in-tag": true, "include-v-in-tag": true, "tag-separator": "@", diff --git a/README.md b/README.md index d42705a..e0731bc 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ Shared GitHub Actions for [TrogonStack][trogonstack] and ## Using an action ```yaml -- uses: TrogonStack/github-actions/actions/semconv/pull-request@ # semconv-pull-request@v0.1.0 +- uses: TrogonStack/github-actions/actions/semconv/pull-request@ # semconv-pull-request@v0.0.1 ``` The reference must be a full commit SHA. Both organizations set @@ -24,7 +24,7 @@ Every action carries its own version. A change to one action releases that action and leaves the others untouched, so a version bump always means something changed in the thing you pinned. -Tags are `@vX.Y.Z`, for example `semconv-pull-request@v0.1.0`, and +Tags are `@vX.Y.Z`, for example `semconv-pull-request@v0.0.1`, and each action keeps its own `CHANGELOG.md` next to its `action.yml`. Releases are cut by [release-please][release-please] from Conventional Commit From 0b7f8c185e980ebe479a9c5eee01b72d98d17b1f Mon Sep 17 00:00:00 2001 From: Yordis Prieto Date: Mon, 21 Sep 2026 18:09:53 -0400 Subject: [PATCH 5/7] chore: introduce the repository in the readme Signed-off-by: Yordis Prieto --- README.md | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index e0731bc..812e2d7 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,24 @@ # github-actions -Shared GitHub Actions for [TrogonStack][trogonstack] and -[straw-hat-team][straw-hat-team]. +**The one place [TrogonStack][trogonstack] and [straw-hat-team][straw-hat-team] +keep the checks every repository runs.** One copy of each check, versioned, so +that fixing it once fixes it everywhere. + +**Each check ships as a composite action with its opinions already decided.** An +action here wraps a maintained upstream tool, pins it to a commit, and fixes its +configuration so consumers inherit a decision rather than repeat it. Only the +settings that genuinely differ between repositories are left as inputs. + +**It exists because a check drifts the moment it is copied.** Conventional +commit validation was enforced across fifteen repositories by four separate +implementations that had quietly stopped agreeing on which types were allowed, +which is the same as not enforcing it at all. A single implementation means one +change reaches every consumer instead of fifteen edits nobody finishes. + +**It is for maintainers of repositories in either organization**, and for anyone +setting a new one up who would rather inherit the conventions than rediscover +them. Nothing here is specific to either organization's private work, so an +action is equally usable from a public repository. | Action | Purpose | | --- | --- | From 91c02a35033d6ec3945987d0c57ce0089ebe05a4 Mon Sep 17 00:00:00 2001 From: Yordis Prieto Date: Mon, 21 Sep 2026 18:26:05 -0400 Subject: [PATCH 6/7] chore: shorten the readme to the essentials Signed-off-by: Yordis Prieto --- README.md | 39 ++++----------------------------------- 1 file changed, 4 insertions(+), 35 deletions(-) diff --git a/README.md b/README.md index 812e2d7..f13f44e 100644 --- a/README.md +++ b/README.md @@ -24,42 +24,11 @@ action is equally usable from a public repository. | --- | --- | | [`semconv/pull-request`](actions/semconv/pull-request) | Fails a pull request whose title is not a Conventional Commit | -## Using an action +Each action documents its own inputs and usage in its `README.md`. Versions are +per action, tagged `@vX.Y.Z`, with a `CHANGELOG.md` next to the +`action.yml`. -```yaml -- uses: TrogonStack/github-actions/actions/semconv/pull-request@ # semconv-pull-request@v0.0.1 -``` - -The reference must be a full commit SHA. Both organizations set -`sha_pinning_required`, so a branch or tag reference makes the job refuse to -start rather than fail. Put the release it belongs to in a trailing comment so -the pin is readable, and let Dependabot move it. - -## Versioning - -Every action carries its own version. A change to one action releases that -action and leaves the others untouched, so a version bump always means -something changed in the thing you pinned. - -Tags are `@vX.Y.Z`, for example `semconv-pull-request@v0.0.1`, and -each action keeps its own `CHANGELOG.md` next to its `action.yml`. - -Releases are cut by [release-please][release-please] from Conventional Commit -subjects on `main`. `feat` and `fix` produce releases, everything else is a -chore. There is no floating major tag. - -Adding an action means adding it to `.github/release-please-config.json` and -`.github/release-please-manifest.json`, or it will never be released. - -## Contributing - -```sh -mise run github:actions:ci:lint -``` - -Task files live under `.config/mise/tasks/` on a path mirroring the workflow -that calls them, so CI and a local run are the same command. +To work on this repository, run `mise run github:actions:ci:lint`. [trogonstack]: https://github.com/TrogonStack [straw-hat-team]: https://github.com/straw-hat-team -[release-please]: https://github.com/googleapis/release-please From 50c2c61db77035fe8bbe36e4d0a39bddfd354320 Mon Sep 17 00:00:00 2001 From: Yordis Prieto Date: Mon, 21 Sep 2026 18:26:49 -0400 Subject: [PATCH 7/7] chore: point at the actions directory instead of listing it Signed-off-by: Yordis Prieto --- README.md | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index f13f44e..4fcfd23 100644 --- a/README.md +++ b/README.md @@ -20,13 +20,8 @@ setting a new one up who would rather inherit the conventions than rediscover them. Nothing here is specific to either organization's private work, so an action is equally usable from a public repository. -| Action | Purpose | -| --- | --- | -| [`semconv/pull-request`](actions/semconv/pull-request) | Fails a pull request whose title is not a Conventional Commit | - -Each action documents its own inputs and usage in its `README.md`. Versions are -per action, tagged `@vX.Y.Z`, with a `CHANGELOG.md` next to the -`action.yml`. +The actions live in [`actions/`](actions), each with its own `README.md`, +version tagged `@vX.Y.Z`, and `CHANGELOG.md`. To work on this repository, run `mise run github:actions:ci:lint`.