github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-22 16:42:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #8959] [MERGED] ci: add auto-changeset generation on PR approval #25227

New Issue
Closed
opened 2026-04-15 22:46:33 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:46:33 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/8959
Author: @gustavovalverde
Created: 4/4/2026
Status: ✅ Merged
Merged: 4/5/2026
Merged by: @gustavovalverde

Base: main ← Head: ci/auto-changeset

📝 Commits (10+)

  • 74fb5bc ci: add auto-changeset generation on PR approval
  • 6223432 fix(ci): address PR review feedback for auto-changeset
  • e1f6ec0 fix(ci): address P1 label bypass and fork security concerns
  • 4077b2b feat(ci): add /changeset slash command for fork PRs and manual override
  • 0835f8c style: fix biome formatting in auto-changeset script
  • 2a8fe29 fix(ci): fail loudly on changeset check errors, add xargs -r
  • 60eee54 fix(ci): checkout PR base ref for /changeset, paginate comment cleanup
  • b8f0259 fix(ci): checkout base branch in auto path, enforce branch bump policy
  • 220824b refactor(ci): simplify auto-changeset from review agent findings
  • 136118b refactor(ci): remove DIR_TO_PACKAGE mapping, use fixed group

📊 Changes

4 files changed (+441 additions, -1 deletions)

View changed files

📝 .cspell/tech-terms.txt (+1 -0)
➕ .github/scripts/auto-changeset.ts (+241 -0)
➕ .github/workflows/auto-changeset.yml (+198 -0)
📝 knip.jsonc (+1 -1)

📄 Description

/changeset slash command for PR changeset generation

Contributors should not need to think about changesets. This PR adds a /changeset command that maintainers comment on any PR to generate a ready-to-copy changeset file with an AI-written, user-focused description.

Trust model

The command triggers via issue_comment, which always runs base-branch YAML with full secrets. This makes it safe for both team and fork PRs without executing PR code in a privileged context. Only MEMBER, OWNER, and COLLABORATOR can invoke it.

The AI prompt receives the PR title, computed fields (bump type, domain), the file list from the GitHub API, the cubic bot summary, and the truncated diff. The diff is attacker-controlled content, but maintainers are expected to have reviewed the PR before running the command, and the output is a comment (not a commit) that the maintainer decides whether to use.

How it works

The workflow has 2 phases sharing a single job:

Deterministic analysis (.github/scripts/auto-changeset.ts) parses the PR title as a conventional commit, maps the type to a bump level, checks whether any files under packages/ changed, and extracts the cubic bot summary. It outputs everything via GITHUB_OUTPUT for the next phase. Skip gates fire when no packages are touched, the PR is a promote merge (next to main), or a manual changeset already exists. On patch-only branches (main, release/*), FORCE mode caps the bump to patch instead of blocking, so the command always produces a usable recommendation.

AI description (claude-code-action in agent mode with --max-turns 1) receives the analysis context plus the PR diff and generates a structured JSON response containing a single description string. The output is validated against a JSON schema. If the AI step fails or is unavailable, the fallback is the cubic summary or the PR title.

The workflow then posts the recommendation as a comment (replacing any previous one from the bot) or, if the analysis skipped, posts an explanation of why.

Known limitations

When dismiss_stale_reviews is enabled and a maintainer later commits the generated changeset to the PR branch, that commit stales the approval. Not blocking today (required approvals are 0), but will clear the approved badge on protected-branch PRs.

Summary by cubic

Adds a /changeset maintainer command that analyzes a PR and posts a ready-to-copy changeset for .changeset/pr-{N}.md. Runs from base-branch YAML for security, works for team and fork PRs, and now includes the PR diff and Cubic summary to improve descriptions.

  • New Features

    • Slash command /changeset: maps conventional commits to a bump, uses fixed-group frontmatter ("better-auth": <bump>), generates a user-focused description via anthropics/claude-code-action (with PR diff + Cubic summary), and posts a Markdown block to copy.
    • Notes when a changeset already exists and still returns a recommendation for comparison.

  • Refactors

    • Security: remove auto-on-approval; run from the base branch and never execute PR code with secrets (fork-safe). Use a random heredoc delimiter.
    • Policy/robustness: PR-scoped concurrency; exact .changeset/pr-{N}.md detection; paginated file listing; deterministic frontmatter; allow regeneration; require package changes even in FORCE; cap bumps to patch on main/release/* in FORCE; skip promote PRs (next→main).
    • Reliability: capture the full diff before truncating to avoid SIGPIPE errors; clean up previous bot comments from both better-auth-releases[bot] and github-actions[bot].
    • Tooling/permissions: use pnpm install --frozen-lockfile; add tsx to knip.jsonc ignore; reduce workflow contents permission to read-only; remove unused outputs and dead code.

Written for commit d4ad86c43d. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/8959 **Author:** [@gustavovalverde](https://github.com/gustavovalverde) **Created:** 4/4/2026 **Status:** ✅ Merged **Merged:** 4/5/2026 **Merged by:** [@gustavovalverde](https://github.com/gustavovalverde) **Base:** `main` ← **Head:** `ci/auto-changeset` --- ### 📝 Commits (10+) - [`74fb5bc`](https://github.com/better-auth/better-auth/commit/74fb5bcb4512cd61576e6b36263ae2835ef9d404) ci: add auto-changeset generation on PR approval - [`6223432`](https://github.com/better-auth/better-auth/commit/62234321796e7a59d14036fbecd7e14f16ffe7da) fix(ci): address PR review feedback for auto-changeset - [`e1f6ec0`](https://github.com/better-auth/better-auth/commit/e1f6ec0354db937eb5bf6bd567d9d640d9aacaec) fix(ci): address P1 label bypass and fork security concerns - [`4077b2b`](https://github.com/better-auth/better-auth/commit/4077b2b395b0d2a3476345b4827bdb9ad70ab9c4) feat(ci): add /changeset slash command for fork PRs and manual override - [`0835f8c`](https://github.com/better-auth/better-auth/commit/0835f8c222cce2dc1638b1baec4da44ca0815b77) style: fix biome formatting in auto-changeset script - [`2a8fe29`](https://github.com/better-auth/better-auth/commit/2a8fe29976e9c9e5824f31063c9bb43121888aff) fix(ci): fail loudly on changeset check errors, add xargs -r - [`60eee54`](https://github.com/better-auth/better-auth/commit/60eee545f3a00dbdfa86f849c321cbf5262294e1) fix(ci): checkout PR base ref for /changeset, paginate comment cleanup - [`b8f0259`](https://github.com/better-auth/better-auth/commit/b8f02596604f86237c9592e72e1c874d9486f8d6) fix(ci): checkout base branch in auto path, enforce branch bump policy - [`220824b`](https://github.com/better-auth/better-auth/commit/220824be5d3c8548ccc879eb5e0f2533f8aedcc1) refactor(ci): simplify auto-changeset from review agent findings - [`136118b`](https://github.com/better-auth/better-auth/commit/136118bb0da095a9f00b16676ab3e1c29bb5c911) refactor(ci): remove DIR_TO_PACKAGE mapping, use fixed group ### 📊 Changes **4 files changed** (+441 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `.cspell/tech-terms.txt` (+1 -0) ➕ `.github/scripts/auto-changeset.ts` (+241 -0) ➕ `.github/workflows/auto-changeset.yml` (+198 -0) 📝 `knip.jsonc` (+1 -1) </details> ### 📄 Description ## `/changeset` slash command for PR changeset generation Contributors should not need to think about changesets. This PR adds a `/changeset` command that maintainers comment on any PR to generate a ready-to-copy changeset file with an AI-written, user-focused description. ## Trust model The command triggers via `issue_comment`, which always runs base-branch YAML with full secrets. This makes it safe for both team and fork PRs without executing PR code in a privileged context. Only `MEMBER`, `OWNER`, and `COLLABORATOR` can invoke it. The AI prompt receives the PR title, computed fields (bump type, domain), the file list from the GitHub API, the cubic bot summary, and the truncated diff. The diff is attacker-controlled content, but maintainers are expected to have reviewed the PR before running the command, and the output is a comment (not a commit) that the maintainer decides whether to use. ## How it works The workflow has 2 phases sharing a single job: **Deterministic analysis** (`.github/scripts/auto-changeset.ts`) parses the PR title as a conventional commit, maps the type to a bump level, checks whether any files under `packages/` changed, and extracts the cubic bot summary. It outputs everything via `GITHUB_OUTPUT` for the next phase. Skip gates fire when no packages are touched, the PR is a promote merge (`next` to `main`), or a manual changeset already exists. On patch-only branches (`main`, `release/*`), FORCE mode caps the bump to `patch` instead of blocking, so the command always produces a usable recommendation. **AI description** (`claude-code-action` in agent mode with `--max-turns 1`) receives the analysis context plus the PR diff and generates a structured JSON response containing a single `description` string. The output is validated against a JSON schema. If the AI step fails or is unavailable, the fallback is the cubic summary or the PR title. The workflow then posts the recommendation as a comment (replacing any previous one from the bot) or, if the analysis skipped, posts an explanation of why. ## Known limitations When `dismiss_stale_reviews` is enabled and a maintainer later commits the generated changeset to the PR branch, that commit stales the approval. Not blocking today (required approvals are 0), but will clear the approved badge on protected-branch PRs. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds a `/changeset` maintainer command that analyzes a PR and posts a ready-to-copy changeset for `.changeset/pr-{N}.md`. Runs from base-branch YAML for security, works for team and fork PRs, and now includes the PR diff and Cubic summary to improve descriptions. - **New Features** - Slash command `/changeset`: maps conventional commits to a bump, uses fixed-group frontmatter (`"better-auth": <bump>`), generates a user-focused description via `anthropics/claude-code-action` (with PR diff + Cubic summary), and posts a Markdown block to copy. - Notes when a changeset already exists and still returns a recommendation for comparison. - **Refactors** - Security: remove auto-on-approval; run from the base branch and never execute PR code with secrets (fork-safe). Use a random heredoc delimiter. - Policy/robustness: PR-scoped concurrency; exact `.changeset/pr-{N}.md` detection; paginated file listing; deterministic frontmatter; allow regeneration; require package changes even in FORCE; cap bumps to patch on `main`/`release/*` in FORCE; skip promote PRs (`next`→`main`). - Reliability: capture the full diff before truncating to avoid SIGPIPE errors; clean up previous bot comments from both `better-auth-releases[bot]` and `github-actions[bot]`. - Tooling/permissions: use `pnpm install --frozen-lockfile`; add `tsx` to `knip.jsonc` ignore; reduce workflow contents permission to read-only; remove unused outputs and dead code. <sup>Written for commit d4ad86c43dafe135fb53b0e7489343ccf4681613. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:46:33 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25227