Repository navigation
ci(release): leave contributor-only commits out of server release notes - #691
Merged
Merged
Conversation
![umm-actually[bot]](https://avatars.githubusercontent.com/in/4233716?s=60&v=4){kind=small}
|
umm-actually re-reviewed at 1 new finding(s) posted (12 tracked finding(s) across all runs). umm-actually · z-ai/glm-5.3-flash |
generate-notes.sh now skips dev-dependency bumps and Claude Code hook changes (scopes deps-dev and hooks), and commits that change only AGENTS.md, CHANGELOG.md, or files under .claude/ or .husky/. CLI release notes are unchanged: they still list every commit that touches cli/, dependency bumps included. CONTRIBUTING.md now says what each release's notes list. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… lockfile Security updates and overrides of transitive dev packages arrive with the `deps` scope, so the `deps-dev` scope alone kept them in the notes (the markdown-it/markdownlint-cli2 bump is the next release's case). A commit that changes only the root package.json and package-lock.json, and moves only packages the lockfile marks `"dev": true`, is now left out too. Ship-Check: pr-review · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…r notes A commit that changes only dotfiles at the repository root (.gitignore, .trivyignore and the like) or files under .devin/ now stays out of server release notes, beside the existing .claude/ and .husky/ rule. .github/ stays listed, so CI changes still show. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- generate-notes.sh: named regex groups, explicit names for single-letter and shorthand variables, one hash strip with its reason, a named manifests-only boolean, and dead fallbacks removed - comments: state the package.json fields the dev-dependency rule allows, the first-release range, the gh repo fallback, lockfile key shape, and the empty-commit guard; narrow "anything unreadable" to a missing manifest - CONTRIBUTING.md: name each notes generator, state the package.json fields the dev-dependency rule allows, and say a tag push deploys and creates the GitHub Release Generated notes are byte-identical before and after for every commit from v0.1.1 to HEAD. Ship-Check: code-quality · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…f failing the release read_json_at now warns and returns None for a package.json or package-lock.json that does not parse, so the dev-dependency check keeps that commit in the notes instead of stopping the release job. Ship-Check: triage · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs generate-notes.sh for real against a temporary git repository per test. Covers the contributor-only scopes and paths, the dev-dependency check over package.json and package-lock.json, the warning for a manifest that is not valid JSON, and the heading layout. Ship-Check: test-audit · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-script tests Ship-Check: triage · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ship-Check: triage · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nnot read A lockfile without a packages map (npm 6's lockfileVersion 1) compared as two empty maps, so a lockfile-only commit that moved production packages was left out of the server notes. Such a commit is now listed. A package.json or package-lock.json that is valid JSON but not an object crashed the script; it now warns and lists the commit, like invalid JSON. Ship-Check: bug-check · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CONTRIBUTING.md said every change lands via PR, but the release workflows push their version-bump and CHANGELOG commits directly. It now says so, matching DEPLOY.md. Ship-Check: triage · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e lockfile's own entry changed_paths now warns and returns no paths when git diff-tree fails, so the commit stays listed instead of the notes step failing after deploy, as the manifest reads already do. The lockfile's project entry may change the same fields as package.json (devDependencies and overrides), so the rule no longer depends on whether npm copies overrides into it. Ship-Check: pr-monitor · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A commit git cannot diff got a warning that it was listed, then the scope rule left it out. The scope rule now runs first, so the warning only fires for commits it keeps. Tests cover both outcomes of a failed diff. Ship-Check: bug-check · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Manual Release and Release CLI push their version-bump commits to main directly, as the next sentence in CONTRIBUTING.md and DEPLOY.md says. Ship-Check: bug-check · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The root-dotfile rule now skips .dockerignore, which decides what the image build copies, so a change to it alone stays listed. git output is decoded with replacement characters, so a path or manifest that isn't UTF-8 no longer stops the notes step. The lockfile comment again says npm leaves overrides out of the project's own entry. Ship-Check: pr-monitor · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…cy commits Ship-Check: pr-monitor · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…t isn't an object DEPLOY.md has deployers copy the root .env.example, so a commit changing only it stays in the notes beside .dockerignore. A package-lock.json entry that isn't an object now keeps the commit listed instead of stopping the notes step, like every other unreadable manifest. Ship-Check: pr-monitor · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
changed_keys compared missing and null values as equal, so an install path added as null slipped past the not-an-object check and the commit was left out. A sentinel now tells a missing key from a null one. The not-an-object test also covers the project's own entry and a new null entry. Ship-Check: triage · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…cript tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
aliasunder
force-pushed
the
worktree-release-notes-dev-only
branch
from
October 21, 2026 19:09
274931b to
b08b69a
Compare
…n object Ship-Check: pr-monitor · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ship-Check: pr-monitor · claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Server release notes listed every commit, including ones that change nothing a user installs: the bot's own "Update CHANGELOG.md" commit, dev-dependency bumps, Claude Code hook changes and contributor config.
generate-notes.shnow leaves out:deps-dev, and commits that change onlydevDependenciesoroverridesin the rootpackage.jsonand, inpackage-lock.json, only packages marked"dev": true(Dependabot titles transitive dev updates such as chore(deps): bump markdown-it and markdownlint-cli2 #689deps, so the scope alone misses them)hooks; hook commits also change their tests undersrc/__tests__/, so a path rule alone misses them)AGENTS.md,CHANGELOG.md, dotfiles at the repository root (.gitignore,.trivyignore), or files under.claude/,.devin/or.husky/.github/,.dockerignoreand.env.examplestay listed: CI changes still show,.dockerignoredecides what the image build copies, and DEPLOY.md has deployers copy.env.example. The scope rules decide first, from the commit title alone, so adeps-devorhookscommit is left out without its files being read. Among the other commits, one the file checks can't classify (a manifest that is missing, not valid JSON or holds an entry that isn't an object, a lockfile without apackagesmap, a failedgit diff-tree) stays listed, with a warning where something failed.CLI release notes (
cli_release.yml) are unchanged: they list every commit that touchescli/, so CLI dependency bumps stay visible there.Also in this PR:
main.src/__tests__/generate-notes.test.tsruns the real script in a temporary repository per test; AGENTS.md's shell-script test exception now names it.generate-notes.shfrom review. The notes it prints are unchanged apart from the commits above.Test plan
src/__tests__/generate-notes.test.ts: 36 tests asserting the exact notes for each rule, both ways (left out and kept). Breaking each rule on purpose fails the test written for it.deps-devbumps, and dev-onlydepsbumps and overrides, including dev-only security updates (fix(deps): bump brace-expansion to 5.0.8 for CVE-2026-14257 #374, chore(deps): bump nanoid to 3.3.18 for GHSA-2v37-7h3g-55p8 #418, build(deps): override smol-toml to 1.8.0 to clear GHSA-7w5x-hrqm-74c2 #551, build(deps): override katex to 0.18.2 and smol-toml to 1.9.0 #649, chore(deps): bump markdown-it and markdownlint-cli2 #689)hookscommits.devin/wiki.json,.coderabbit.yaml,.pr_agent.tomland.gitignorecommitsnpm test, ESLint, Prettier, markdownlint and ShellCheck pass.🤖 Generated with Claude Code