{{ message }}
ci: add PR bump preview workflow - #1957
Merged
bearomorphism merged 2 commits intoMay 19, 2026
Merged
Conversation
Adds a workflow that runs cz bump --dry-run on incoming pull requests and posts (or updates) a sticky comment summarising the would-be version bump and changelog entries. This makes unexpected version bumps visible to reviewers before merging, addressing commitizen-tools#1510. The pattern is documented in docs/tutorials/github_actions.md so other projects can copy/paste the same workflow. Closes commitizen-tools#1510 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
pr-status: wait-for-review
type: feature
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow to comment a “bump preview” on pull requests, and documents the pattern so downstream users can reuse it.
Changes:
- Add
.github/workflows/pr-bump-preview.ymlto runcz bump --dry-runon PRs and post/update a sticky comment. - Document the new PR bump preview workflow in
docs/tutorials/github_actions.md.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| docs/tutorials/github_actions.md | Documents a reusable “PR bump preview” workflow and explains how it works. |
| .github/workflows/pr-bump-preview.yml | New workflow that runs Commitizen in CI for PRs and posts/updates a sticky PR comment. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
bearomorphism
marked this pull request as ready for review
May 9, 2026 08:36
Address Copilot review feedback on commitizen-tools#1957: * `cz bump` renders Jinja templates from the working directory whenever `update_changelog_on_bump` is set in config, using a non-sandboxed `FileSystemLoader('.')`. Under `pull_request_target` with a write token, executing those templates against fork-controlled files would risk RCE / token exfiltration. Gate the job to same-repo PRs by comparing `head.repo.full_name` to `base.repo.full_name`. * Set `persist-credentials: false` on `actions/checkout` as defense in depth, so the workflow token is not written to `.git/config`. * Adjust docs to drop the misleading `and changelog entries` claim (the dry-run only shows changelog entries when `update_changelog_on_bump` is enabled), and rewrite the safety explanation to reflect the real threat model. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bearomorphism
added a commit
to bearomorphism/setup-cz
that referenced
this pull request
May 9, 2026
Mirrors the security fix on commitizen-tools/commitizen#1957: * `cz bump` can render Jinja templates from the working directory when `update_changelog_on_bump` is set in config, using a non-sandboxed loader. Under `pull_request_target` this would let a fork PR execute arbitrary code with a write token, so gate the job to same-repo PRs only (`head.repo == base.repo`). * Add `persist-credentials: false` on `actions/checkout` as defense in depth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bearomorphism
added a commit
to bearomorphism/commitizen-action
that referenced
this pull request
May 9, 2026
Mirrors the security fix on commitizen-tools/commitizen#1957: * `cz bump` can render Jinja templates from the working directory when `update_changelog_on_bump` is set in config, using a non-sandboxed loader. Under `pull_request_target` this would let a fork PR execute arbitrary code with a write token, so gate the job to same-repo PRs only (`head.repo == base.repo`). * Add `persist-credentials: false` on `actions/checkout` as defense in depth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Collaborator
Author
This was referenced May 9, 2026
Lee-W
approved these changes
May 12, 2026
Lee-W
reviewed
May 12, 2026
Lee-W
left a comment
Lee-W
left a comment
Member
There was a problem hiding this comment.
love this! adding changelogs might also be a good idea
bearomorphism
changed the title
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds a GitHub Actions workflow that runs
cz bump --dry-runagainst every incoming pull request and posts (or updates) a sticky comment summarising the would-be version bump and changelog entries. Reviewers can spot unexpected version bumps before merging.The pattern is also documented in
docs/tutorials/github_actions.mdso other projects can copy/paste the same workflow.How it works
pull_request_target(matcheslabel_pr.yml) so the workflow haspull-requests: writeeven for fork PRs. The job only runscz bump --dry-run, a read-only command, so PR-controlled scripts are not executed.commitizen-tools/setup-cz— no language-specific toolchain required.cz bump --dry-run --yesoutput and exit status. Exit code21(NoneIncrementExit) is treated as "no eligible bump" instead of an error; other non-zero codes are surfaced in the comment.<!-- commitizen-bump-preview -->marker letspeter-evans/create-or-update-commentedit the previous preview in place on every push instead of stacking comments.Companion changes are being prepared for
commitizen-tools/commitizen-action(replaces the draft #102 attempt) andcommitizen-tools/setup-cz(examples/) so the same pattern is available to consumers of either action.Closes #1510
Type of changes
Steps to Test This Pull Request
The workflow self-tests once it lands on
master: open a follow-up PR and confirm a🔍 Commitizen bump previewcomment appears and updates as you push commits.Expected output
The workflow posts (and replaces on every push) a single sticky comment whose body depends on the dry-run exit code.
cz bump --dry-run --yessucceeds (status 0) — eligible bump:Rendered comment
NoneIncrementExit(status 21) — no eligible commits:Any other non-zero status — error surfaced inside the comment:
The status-0 example above is the literal output of
cz bump --dry-run --yesagainst the currentmasterof this repository (verified locally).Checklist