mirror of
https://github.com/better-auth/better-auth.git
synced 2026-10-19 11:24:57 -05:00
335 lines
15 KiB
YAML
335 lines
15 KiB
YAML
name: Auto Changeset
|
|
|
|
on:
|
|
issue_comment:
|
|
types: [created, edited]
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: auto-changeset-${{ github.event.issue.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
# /changeset slash command — maintainers only.
|
|
# Uses issue_comment which runs base-branch YAML with full secrets,
|
|
# making it safe for both team and fork PRs.
|
|
changeset:
|
|
if: >
|
|
github.event.action == 'created' &&
|
|
github.event.issue.pull_request &&
|
|
startsWith(github.event.comment.body, '/changeset') &&
|
|
github.repository_owner == 'better-auth' &&
|
|
contains(fromJSON('["MEMBER", "OWNER", "COLLABORATOR"]'), github.event.comment.author_association)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
pull-requests: read
|
|
steps:
|
|
- name: Generate App Token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
if: vars.RELEASE_APP_ID != ''
|
|
with:
|
|
app-id: ${{ vars.RELEASE_APP_ID }}
|
|
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
|
|
permission-contents: read
|
|
permission-issues: write
|
|
permission-pull-requests: read
|
|
|
|
- name: React to comment
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
|
|
COMMENT_ID: ${{ github.event.comment.id }}
|
|
run: |
|
|
gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${COMMENT_ID}/reactions" \
|
|
-f content='+1' --silent || true
|
|
|
|
# issue_comment resolves to the default branch SHA. Never execute PR or
|
|
# fork code with secrets.
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
|
|
|
|
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
|
|
|
|
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version-file: '.nvmrc'
|
|
cache: pnpm
|
|
|
|
- name: Install release tooling
|
|
run: pnpm install --frozen-lockfile --filter @better-auth/release-tooling
|
|
|
|
- name: Analyze PR
|
|
id: analyze
|
|
env:
|
|
GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
|
|
AI_GATEWAY_API_KEY: ${{ secrets.AI_GATEWAY_API_KEY }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
FORCE: 'true'
|
|
run: pnpm --filter @better-auth/release-tooling auto-changeset
|
|
|
|
- name: Clean up previous bot comments
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
run: |
|
|
MARKER="<!-- auto-changeset -->"
|
|
gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" --paginate \
|
|
--jq ".[] | select((.body | startswith(\"${MARKER}\")) and (.user.login == \"better-release[bot]\" or .user.login == \"github-actions[bot]\")) | .id" \
|
|
| xargs -r -I{} gh api -X DELETE "repos/${GITHUB_REPOSITORY}/issues/comments/{}" 2>/dev/null || true
|
|
|
|
- name: Post skip explanation
|
|
if: steps.analyze.outputs.skip == 'true'
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
SKIP_REASON: ${{ steps.analyze.outputs.skip_reason }}
|
|
run: |
|
|
gh api --method POST "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
|
|
-f body="<!-- auto-changeset -->
|
|
**No changeset generated:** ${SKIP_REASON}" >/dev/null
|
|
|
|
- name: Post changeset comment
|
|
if: steps.analyze.outputs.skip != 'true'
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
FRONTMATTER: ${{ steps.analyze.outputs.frontmatter }}
|
|
DESCRIPTION: ${{ steps.analyze.outputs.description }}
|
|
HAS_EXISTING: ${{ steps.analyze.outputs.has_existing }}
|
|
run: |
|
|
CHANGESET=$(printf '%s\n' "---" "$FRONTMATTER" "---" "" "$DESCRIPTION")
|
|
|
|
EXISTING_NOTE=""
|
|
if [ "$HAS_EXISTING" = "true" ]; then
|
|
EXISTING_NOTE="
|
|
> **Note:** This PR already has a changeset. The recommendation below is an alternative you can use to replace it.
|
|
"
|
|
fi
|
|
|
|
TMPFILE=$(mktemp)
|
|
printf '%s\n' "<!-- auto-changeset -->" \
|
|
"### Changeset recommendation" "" \
|
|
"${EXISTING_NOTE}" \
|
|
"Copy into \`.changeset/pr-${PR_NUMBER}.md\`:" "" \
|
|
'```md' "$CHANGESET" '```' "" \
|
|
"---" "" \
|
|
"- [ ] **Commit this changeset** to the PR" > "$TMPFILE"
|
|
|
|
gh api --method POST "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
|
|
-f body="$(cat "$TMPFILE")" >/dev/null
|
|
rm -f "$TMPFILE"
|
|
echo "Posted changeset recommendation on PR #${PR_NUMBER}"
|
|
|
|
# Apply changeset — triggered when someone checks the commit checkbox
|
|
# on a bot-posted changeset recommendation comment.
|
|
apply:
|
|
if: >
|
|
github.event.action == 'edited' &&
|
|
github.event.issue.pull_request &&
|
|
contains(github.event.comment.body, '<!-- auto-changeset -->') &&
|
|
contains(github.event.comment.body, '- [x] **Commit this changeset**') &&
|
|
(github.event.comment.user.login == 'better-release[bot]' || github.event.comment.user.login == 'github-actions[bot]') &&
|
|
github.repository_owner == 'better-auth'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: write
|
|
issues: write
|
|
pull-requests: read
|
|
steps:
|
|
- name: Generate App Token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
if: vars.RELEASE_APP_ID != ''
|
|
with:
|
|
app-id: ${{ vars.RELEASE_APP_ID }}
|
|
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
|
|
permission-contents: write
|
|
permission-issues: write
|
|
permission-pull-requests: read
|
|
|
|
- name: Verify sender authorization
|
|
id: auth
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
|
|
SENDER: ${{ github.event.sender.login }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
run: |
|
|
# Match the /changeset command's MEMBER/OWNER/COLLABORATOR gate.
|
|
# author_association is role-based (not permission-based), so we
|
|
# check repo collaborator status and org membership separately.
|
|
if gh api "repos/${GITHUB_REPOSITORY}/collaborators/${SENDER}" --silent 2>/dev/null; then
|
|
echo "authorized=true" >> "$GITHUB_OUTPUT"
|
|
elif gh api "orgs/${GITHUB_REPOSITORY_OWNER}/members/${SENDER}" --silent 2>/dev/null; then
|
|
echo "authorized=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
PR_AUTHOR=$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \
|
|
--json author --jq '.author.login' 2>/dev/null || echo "")
|
|
if [[ -n "$PR_AUTHOR" && "$SENDER" == "$PR_AUTHOR" ]]; then
|
|
echo "authorized=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "::warning::${SENDER} is not authorized"
|
|
echo "authorized=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
fi
|
|
|
|
- name: Get PR details
|
|
if: steps.auth.outputs.authorized == 'true'
|
|
id: pr
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
run: |
|
|
PR_JSON=$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \
|
|
--json headRefName,isCrossRepository)
|
|
HEAD_REF=$(echo "$PR_JSON" | jq -r '.headRefName')
|
|
IS_FORK=$(echo "$PR_JSON" | jq -r '.isCrossRepository')
|
|
echo "head_ref=$HEAD_REF" >> "$GITHUB_OUTPUT"
|
|
|
|
# The ref is later interpolated into REST API paths
|
|
# (git/ref/heads/${HEAD_REF}). URI-reserved characters such as '#' or
|
|
# '%' can pass the protected-branch string checks below but resolve to
|
|
# a DIFFERENT ref once placed in a URL ('#' truncates as a fragment,
|
|
# '%2F' decodes to '/'). Reject anything outside a conservative
|
|
# branch-name allowlist so the guards operate on the literal ref.
|
|
if [[ ! "$HEAD_REF" =~ ^[A-Za-z0-9._/-]+$ ]]; then
|
|
echo "blocked=true" >> "$GITHUB_OUTPUT"
|
|
echo "blocked_reason=Refusing to commit to branch with unsupported characters (${HEAD_REF}) — only letters, digits, '.', '_', '/', and '-' are allowed." >> "$GITHUB_OUTPUT"
|
|
elif [[ "$HEAD_REF" == "main" || "$HEAD_REF" == "next" || "$HEAD_REF" == v*.*.x ]]; then
|
|
echo "blocked=true" >> "$GITHUB_OUTPUT"
|
|
echo "blocked_reason=Cannot commit to protected branch (${HEAD_REF}) — this would trigger release automation." >> "$GITHUB_OUTPUT"
|
|
elif [[ "$IS_FORK" == "true" ]]; then
|
|
echo "blocked=true" >> "$GITHUB_OUTPUT"
|
|
echo "blocked_reason=Cannot auto-commit to fork PRs — please copy the changeset manually." >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "blocked=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Abort if blocked
|
|
if: steps.auth.outputs.authorized == 'true' && steps.pr.outputs.blocked == 'true'
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
|
|
COMMENT_ID: ${{ github.event.comment.id }}
|
|
BLOCKED_REASON: ${{ steps.pr.outputs.blocked_reason }}
|
|
run: |
|
|
BODY=$(gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${COMMENT_ID}" --jq '.body')
|
|
TMPFILE=$(mktemp)
|
|
awk -v reason="$BLOCKED_REASON" '{
|
|
sub(/- \[x\] \*\*Commit this changeset\*\* to the PR/,
|
|
"- [ ] **Commit this changeset** to the PR\n\n> ⚠️ " reason)
|
|
print
|
|
}' <<< "$BODY" > "$TMPFILE"
|
|
gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${COMMENT_ID}" \
|
|
-X PATCH --input <(jq -n --rawfile body "$TMPFILE" '{body: $body}')
|
|
rm -f "$TMPFILE"
|
|
echo "::warning::${BLOCKED_REASON}"
|
|
|
|
- name: Commit changeset
|
|
if: steps.auth.outputs.authorized == 'true' && steps.pr.outputs.blocked != 'true'
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
|
|
PR_NUMBER: ${{ github.event.issue.number }}
|
|
COMMENT_ID: ${{ github.event.comment.id }}
|
|
HEAD_REF: ${{ steps.pr.outputs.head_ref }}
|
|
SENDER: ${{ github.event.sender.login }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# Fetch comment body via API (safer than env var for special characters)
|
|
BODY=$(gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${COMMENT_ID}" --jq '.body')
|
|
|
|
# Extract changeset from the ```md code block
|
|
CHANGESET=$(awk '/^```md$/{found=1;next} found && /^```$/{exit} found{print}' <<< "$BODY")
|
|
|
|
if [ -z "$CHANGESET" ]; then
|
|
echo "::error::Could not extract changeset content from comment"
|
|
exit 1
|
|
fi
|
|
|
|
FILE_PATH=".changeset/pr-${PR_NUMBER}.md"
|
|
|
|
# ── Use Git Data API for an atomic single commit ──
|
|
# This adds pr-N.md and deletes any superseded changeset files
|
|
# in one commit, preventing duplicate changesets on the branch.
|
|
|
|
# Get branch head. Verify the API resolved the EXACT ref we asked for:
|
|
# if URL semantics caused the path to resolve to a different branch
|
|
# (e.g. a fragment or decoded slash), `.ref` won't match and we abort
|
|
# before mutating anything. This is an additional check on top of the
|
|
# branch-name allowlist enforced in the "Get PR details" step.
|
|
REF_JSON=$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/${HEAD_REF}")
|
|
RESOLVED_REF=$(echo "$REF_JSON" | jq -r '.ref')
|
|
if [ "$RESOLVED_REF" != "refs/heads/${HEAD_REF}" ]; then
|
|
echo "::error::Ref mismatch: requested 'refs/heads/${HEAD_REF}' but API resolved '${RESOLVED_REF}'. Aborting."
|
|
exit 1
|
|
fi
|
|
COMMIT_SHA=$(echo "$REF_JSON" | jq -r '.object.sha')
|
|
TREE_SHA=$(gh api "repos/${GITHUB_REPOSITORY}/git/commits/${COMMIT_SHA}" --jq '.tree.sha')
|
|
|
|
# Create blob for the new changeset
|
|
BLOB_SHA=$(jq -n --arg content "$(printf '%s\n' "$CHANGESET" | base64 -w 0)" \
|
|
'{content: $content, encoding: "base64"}' | \
|
|
gh api "repos/${GITHUB_REPOSITORY}/git/blobs" --input - --jq '.sha')
|
|
|
|
# Start tree with the new changeset entry
|
|
TREE_FILE=$(mktemp)
|
|
jq -n --arg path "$FILE_PATH" --arg sha "$BLOB_SHA" \
|
|
'[{path: $path, mode: "100644", type: "blob", sha: $sha}]' > "$TREE_FILE"
|
|
|
|
# Only supersede changeset files that THIS PR introduced —
|
|
# never touch files inherited from parent branches (stacked PRs).
|
|
SUPERSEDED=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/files" \
|
|
--paginate --jq '.[] | select(.filename | startswith(".changeset/")) |
|
|
select(.filename | endswith(".md")) |
|
|
select(.filename | endswith("README.md") | not) |
|
|
.filename' 2>/dev/null \
|
|
| grep -v "^${FILE_PATH}$" || true)
|
|
|
|
if [ -n "$SUPERSEDED" ]; then
|
|
while IFS= read -r old_path; do
|
|
[ -z "$old_path" ] && continue
|
|
# Setting sha to null tells the Git tree API to delete the file
|
|
jq --arg path "$old_path" \
|
|
'. + [{path: $path, mode: "100644", type: "blob", sha: null}]' \
|
|
"$TREE_FILE" > "${TREE_FILE}.tmp" && mv "${TREE_FILE}.tmp" "$TREE_FILE"
|
|
echo "Superseding: ${old_path}"
|
|
done <<< "$SUPERSEDED"
|
|
fi
|
|
|
|
# Create tree, commit, and update ref
|
|
NEW_TREE_SHA=$(jq -n --arg base "$TREE_SHA" --argjson tree "$(cat "$TREE_FILE")" \
|
|
'{base_tree: $base, tree: $tree}' | \
|
|
gh api "repos/${GITHUB_REPOSITORY}/git/trees" --input - --jq '.sha')
|
|
rm -f "$TREE_FILE"
|
|
|
|
NEW_COMMIT_SHA=$(jq -n \
|
|
--arg message "chore: add changeset for PR #${PR_NUMBER}" \
|
|
--arg tree "$NEW_TREE_SHA" \
|
|
--arg parent "$COMMIT_SHA" \
|
|
'{message: $message, tree: $tree, parents: [$parent]}' | \
|
|
gh api "repos/${GITHUB_REPOSITORY}/git/commits" --input - --jq '.sha')
|
|
|
|
gh api "repos/${GITHUB_REPOSITORY}/git/refs/heads/${HEAD_REF}" \
|
|
-X PATCH -f sha="$NEW_COMMIT_SHA"
|
|
|
|
# Update comment: replace checkbox with committed confirmation
|
|
TMPFILE=$(mktemp)
|
|
awk -v sender="$SENDER" '{
|
|
sub(/- \[x\] \*\*Commit this changeset\*\* to the PR/,
|
|
"✅ Committed by @" sender)
|
|
print
|
|
}' <<< "$BODY" > "$TMPFILE"
|
|
gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${COMMENT_ID}" \
|
|
-X PATCH --input <(jq -n --rawfile body "$TMPFILE" '{body: $body}')
|
|
rm -f "$TMPFILE"
|
|
|
|
echo "Committed ${FILE_PATH} to ${HEAD_REF}"
|