better-auth/.github/workflows/auto-changeset.yml

name: Auto Changeset

on:
  issue_comment:
    types: [created, edited]

permissions: {}

concurrency:
  group: auto-changeset-${{ github.event.issue.number }}
  cancel-in-progress: true

jobs:
  # /changeset slash command — maintainers only.
  # Uses issue_comment which runs base-branch YAML with full secrets,
  # making it safe for both team and fork PRs.
  changeset:
    if: >
      github.event.action == 'created' &&
      github.event.issue.pull_request &&
      startsWith(github.event.comment.body, '/changeset') &&
      github.repository_owner == 'better-auth' &&
      contains(fromJSON('["MEMBER", "OWNER", "COLLABORATOR"]'), github.event.comment.author_association)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      issues: write
      pull-requests: read
    steps:
      - name: Generate App Token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        if: vars.RELEASE_APP_ID != ''
        with:
          app-id: ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          permission-contents: read
          permission-issues: write
          permission-pull-requests: read

      - name: React to comment
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          COMMENT_ID: ${{ github.event.comment.id }}
        run: |
          gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${COMMENT_ID}/reactions" \
            -f content='+1' --silent || true

      # issue_comment resolves to the default branch SHA. Never execute PR or
      # fork code with secrets.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          persist-credentials: false
          token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}

      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: '.nvmrc'
          cache: pnpm

      - name: Install release tooling
        run: pnpm install --frozen-lockfile --filter @better-auth/release-tooling

      - name: Analyze PR
        id: analyze
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          AI_GATEWAY_API_KEY: ${{ secrets.AI_GATEWAY_API_KEY }}
          PR_NUMBER: ${{ github.event.issue.number }}
          FORCE: 'true'
        run: pnpm --filter @better-auth/release-tooling auto-changeset

      - name: Clean up previous bot comments
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.issue.number }}
        run: |
          MARKER="<!-- auto-changeset -->"
          gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" --paginate \
            --jq ".[] | select((.body | startswith(\"${MARKER}\")) and (.user.login == \"better-release[bot]\" or .user.login == \"github-actions[bot]\")) | .id" \
            | xargs -r -I{} gh api -X DELETE "repos/${GITHUB_REPOSITORY}/issues/comments/{}" 2>/dev/null || true

      - name: Post skip explanation
        if: steps.analyze.outputs.skip == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.issue.number }}
          SKIP_REASON: ${{ steps.analyze.outputs.skip_reason }}
        run: |
          gh api --method POST "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
            -f body="<!-- auto-changeset -->
          **No changeset generated:** ${SKIP_REASON}" >/dev/null

      - name: Post changeset comment
        if: steps.analyze.outputs.skip != 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.issue.number }}
          FRONTMATTER: ${{ steps.analyze.outputs.frontmatter }}
          DESCRIPTION: ${{ steps.analyze.outputs.description }}
          HAS_EXISTING: ${{ steps.analyze.outputs.has_existing }}
        run: |
          CHANGESET=$(printf '%s\n' "---" "$FRONTMATTER" "---" "" "$DESCRIPTION")

          EXISTING_NOTE=""
          if [ "$HAS_EXISTING" = "true" ]; then
            EXISTING_NOTE="
          > **Note:** This PR already has a changeset. The recommendation below is an alternative you can use to replace it.
          "
          fi

          TMPFILE=$(mktemp)
          printf '%s\n' "<!-- auto-changeset -->" \
            "### Changeset recommendation" "" \
            "${EXISTING_NOTE}" \
            "Copy into \`.changeset/pr-${PR_NUMBER}.md\`:" "" \
            '```md' "$CHANGESET" '```' "" \
            "---" "" \
            "- [ ] **Commit this changeset** to the PR" > "$TMPFILE"

          gh api --method POST "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
            -f body="$(cat "$TMPFILE")" >/dev/null
          rm -f "$TMPFILE"
          echo "Posted changeset recommendation on PR #${PR_NUMBER}"

  # Apply changeset — triggered when someone checks the commit checkbox
  # on a bot-posted changeset recommendation comment.
  apply:
    if: >
      github.event.action == 'edited' &&
      github.event.issue.pull_request &&
      contains(github.event.comment.body, '<!-- auto-changeset -->') &&
      contains(github.event.comment.body, '- [x] **Commit this changeset**') &&
      (github.event.comment.user.login == 'better-release[bot]' || github.event.comment.user.login == 'github-actions[bot]') &&
      github.repository_owner == 'better-auth'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: write
      issues: write
      pull-requests: read
    steps:
      - name: Generate App Token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        if: vars.RELEASE_APP_ID != ''
        with:
          app-id: ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          permission-contents: write
          permission-issues: write
          permission-pull-requests: read

      - name: Verify sender authorization
        id: auth
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          SENDER: ${{ github.event.sender.login }}
          PR_NUMBER: ${{ github.event.issue.number }}
        run: |
          # Match the /changeset command's MEMBER/OWNER/COLLABORATOR gate.
          # author_association is role-based (not permission-based), so we
          # check repo collaborator status and org membership separately.
          if gh api "repos/${GITHUB_REPOSITORY}/collaborators/${SENDER}" --silent 2>/dev/null; then
            echo "authorized=true" >> "$GITHUB_OUTPUT"
          elif gh api "orgs/${GITHUB_REPOSITORY_OWNER}/members/${SENDER}" --silent 2>/dev/null; then
            echo "authorized=true" >> "$GITHUB_OUTPUT"
          else
            PR_AUTHOR=$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \
              --json author --jq '.author.login' 2>/dev/null || echo "")
            if [[ -n "$PR_AUTHOR" && "$SENDER" == "$PR_AUTHOR" ]]; then
              echo "authorized=true" >> "$GITHUB_OUTPUT"
            else
              echo "::warning::${SENDER} is not authorized"
              echo "authorized=false" >> "$GITHUB_OUTPUT"
            fi
          fi

      - name: Get PR details
        if: steps.auth.outputs.authorized == 'true'
        id: pr
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.issue.number }}
        run: |
          PR_JSON=$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \
            --json headRefName,isCrossRepository)
          HEAD_REF=$(echo "$PR_JSON" | jq -r '.headRefName')
          IS_FORK=$(echo "$PR_JSON" | jq -r '.isCrossRepository')
          echo "head_ref=$HEAD_REF" >> "$GITHUB_OUTPUT"

          # The ref is later interpolated into REST API paths
          # (git/ref/heads/${HEAD_REF}). URI-reserved characters such as '#' or
          # '%' can pass the protected-branch string checks below but resolve to
          # a DIFFERENT ref once placed in a URL ('#' truncates as a fragment,
          # '%2F' decodes to '/'). Reject anything outside a conservative
          # branch-name allowlist so the guards operate on the literal ref.
          if [[ ! "$HEAD_REF" =~ ^[A-Za-z0-9._/-]+$ ]]; then
            echo "blocked=true" >> "$GITHUB_OUTPUT"
            echo "blocked_reason=Refusing to commit to branch with unsupported characters (${HEAD_REF}) — only letters, digits, '.', '_', '/', and '-' are allowed." >> "$GITHUB_OUTPUT"
          elif [[ "$HEAD_REF" == "main" || "$HEAD_REF" == "next" || "$HEAD_REF" == v*.*.x ]]; then
            echo "blocked=true" >> "$GITHUB_OUTPUT"
            echo "blocked_reason=Cannot commit to protected branch (${HEAD_REF}) — this would trigger release automation." >> "$GITHUB_OUTPUT"
          elif [[ "$IS_FORK" == "true" ]]; then
            echo "blocked=true" >> "$GITHUB_OUTPUT"
            echo "blocked_reason=Cannot auto-commit to fork PRs — please copy the changeset manually." >> "$GITHUB_OUTPUT"
          else
            echo "blocked=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Abort if blocked
        if: steps.auth.outputs.authorized == 'true' && steps.pr.outputs.blocked == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          COMMENT_ID: ${{ github.event.comment.id }}
          BLOCKED_REASON: ${{ steps.pr.outputs.blocked_reason }}
        run: |
          BODY=$(gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${COMMENT_ID}" --jq '.body')
          TMPFILE=$(mktemp)
          awk -v reason="$BLOCKED_REASON" '{
            sub(/- \[x\] \*\*Commit this changeset\*\* to the PR/,
                "- [ ] **Commit this changeset** to the PR\n\n> ⚠️ " reason)
            print
          }' <<< "$BODY" > "$TMPFILE"
          gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${COMMENT_ID}" \
            -X PATCH --input <(jq -n --rawfile body "$TMPFILE" '{body: $body}')
          rm -f "$TMPFILE"
          echo "::warning::${BLOCKED_REASON}"

      - name: Commit changeset
        if: steps.auth.outputs.authorized == 'true' && steps.pr.outputs.blocked != 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.issue.number }}
          COMMENT_ID: ${{ github.event.comment.id }}
          HEAD_REF: ${{ steps.pr.outputs.head_ref }}
          SENDER: ${{ github.event.sender.login }}
        run: |
          set -euo pipefail

          # Fetch comment body via API (safer than env var for special characters)
          BODY=$(gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${COMMENT_ID}" --jq '.body')

          # Extract changeset from the ```md code block
          CHANGESET=$(awk '/^```md$/{found=1;next} found && /^```$/{exit} found{print}' <<< "$BODY")

          if [ -z "$CHANGESET" ]; then
            echo "::error::Could not extract changeset content from comment"
            exit 1
          fi

          FILE_PATH=".changeset/pr-${PR_NUMBER}.md"

          # ── Use Git Data API for an atomic single commit ──
          # This adds pr-N.md and deletes any superseded changeset files
          # in one commit, preventing duplicate changesets on the branch.

          # Get branch head. Verify the API resolved the EXACT ref we asked for:
          # if URL semantics caused the path to resolve to a different branch
          # (e.g. a fragment or decoded slash), `.ref` won't match and we abort
          # before mutating anything. This is an additional check on top of the
          # branch-name allowlist enforced in the "Get PR details" step.
          REF_JSON=$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/${HEAD_REF}")
          RESOLVED_REF=$(echo "$REF_JSON" | jq -r '.ref')
          if [ "$RESOLVED_REF" != "refs/heads/${HEAD_REF}" ]; then
            echo "::error::Ref mismatch: requested 'refs/heads/${HEAD_REF}' but API resolved '${RESOLVED_REF}'. Aborting."
            exit 1
          fi
          COMMIT_SHA=$(echo "$REF_JSON" | jq -r '.object.sha')
          TREE_SHA=$(gh api "repos/${GITHUB_REPOSITORY}/git/commits/${COMMIT_SHA}" --jq '.tree.sha')

          # Create blob for the new changeset
          BLOB_SHA=$(jq -n --arg content "$(printf '%s\n' "$CHANGESET" | base64 -w 0)" \
            '{content: $content, encoding: "base64"}' | \
            gh api "repos/${GITHUB_REPOSITORY}/git/blobs" --input - --jq '.sha')

          # Start tree with the new changeset entry
          TREE_FILE=$(mktemp)
          jq -n --arg path "$FILE_PATH" --arg sha "$BLOB_SHA" \
            '[{path: $path, mode: "100644", type: "blob", sha: $sha}]' > "$TREE_FILE"

          # Only supersede changeset files that THIS PR introduced —
          # never touch files inherited from parent branches (stacked PRs).
          SUPERSEDED=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/files" \
            --paginate --jq '.[] | select(.filename | startswith(".changeset/")) |
              select(.filename | endswith(".md")) |
              select(.filename | endswith("README.md") | not) |
              .filename' 2>/dev/null \
            | grep -v "^${FILE_PATH}$" || true)

          if [ -n "$SUPERSEDED" ]; then
            while IFS= read -r old_path; do
              [ -z "$old_path" ] && continue
              # Setting sha to null tells the Git tree API to delete the file
              jq --arg path "$old_path" \
                '. + [{path: $path, mode: "100644", type: "blob", sha: null}]' \
                "$TREE_FILE" > "${TREE_FILE}.tmp" && mv "${TREE_FILE}.tmp" "$TREE_FILE"
              echo "Superseding: ${old_path}"
            done <<< "$SUPERSEDED"
          fi

          # Create tree, commit, and update ref
          NEW_TREE_SHA=$(jq -n --arg base "$TREE_SHA" --argjson tree "$(cat "$TREE_FILE")" \
            '{base_tree: $base, tree: $tree}' | \
            gh api "repos/${GITHUB_REPOSITORY}/git/trees" --input - --jq '.sha')
          rm -f "$TREE_FILE"

          NEW_COMMIT_SHA=$(jq -n \
            --arg message "chore: add changeset for PR #${PR_NUMBER}" \
            --arg tree "$NEW_TREE_SHA" \
            --arg parent "$COMMIT_SHA" \
            '{message: $message, tree: $tree, parents: [$parent]}' | \
            gh api "repos/${GITHUB_REPOSITORY}/git/commits" --input - --jq '.sha')

          gh api "repos/${GITHUB_REPOSITORY}/git/refs/heads/${HEAD_REF}" \
            -X PATCH -f sha="$NEW_COMMIT_SHA"

          # Update comment: replace checkbox with committed confirmation
          TMPFILE=$(mktemp)
          awk -v sender="$SENDER" '{
            sub(/- \[x\] \*\*Commit this changeset\*\* to the PR/,
                "✅ Committed by @" sender)
            print
          }' <<< "$BODY" > "$TMPFILE"
          gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${COMMENT_ID}" \
            -X PATCH --input <(jq -n --rawfile body "$TMPFILE" '{body: $body}')
          rm -f "$TMPFILE"

          echo "Committed ${FILE_PATH} to ${HEAD_REF}"