feat(examples): add PR bump preview example - #19
Open
bearomorphism wants to merge 2 commits into
Open
Conversation
Adds an example workflow showing how to run `cz bump --dry-run` against incoming pull requests and post (or update) a sticky comment with the preview. Useful for catching unexpected version bumps before merging. Closes commitizen-tools/commitizen#1510 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bearomorphism
marked this pull request as draft
May 9, 2026 08:33
bearomorphism
marked this pull request as ready for review
May 9, 2026 08:36
Mirrors the security fix on commitizen-tools/commitizen#1957: * `cz bump` can render Jinja templates from the working directory when `update_changelog_on_bump` is set in config, using a non-sandboxed loader. Under `pull_request_target` this would let a fork PR execute arbitrary code with a write token, so gate the job to same-repo PRs only (`head.repo == base.repo`). * Add `persist-credentials: false` on `actions/checkout` as defense in depth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Collaborator
Author
|
Note for reviewers: the duplication across this repo, |
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds an example workflow
examples/pr-bump-preview.yamlshowing how to usesetup-czto post a sticky comment on every pull request previewing the version bump that would happen on merge. This addresses commitizen-tools/commitizen#1510.What it does
pull_request_targetso the workflow haspull-requests: writepermission for fork PRs too. Onlycz bump --dry-run(a read-only command) is executed against the PR commits.commitizen-tools/setup-cz@mainto install the cz CLI.cz bump --dry-run --yesoutput and exit code:0: dry-run succeeded — the comment shows the next version, tag, increment, and changelog preview.21(NoneIncrementExit): treated as "no eligible commits for a bump" instead of a workflow failure.peter-evans/create-or-update-comment@v4with a hidden<!-- commitizen-bump-preview -->marker so the comment is replaced (rather than duplicated) on every push.Companion changes
commitizen-tools/commitizenPR #1957 adds the same workflow to the commitizen repo and documents the pattern.commitizen-tools/commitizen-actionPR #102 adopts the same pattern.Closes commitizen-tools/commitizen#1510
Expected output
The workflow posts (and replaces on every push) a single sticky comment whose body depends on the dry-run exit code.
cz bump --dry-run --yessucceeds (status 0) — eligible bump:Rendered comment
NoneIncrementExit(status 21) — no eligible commits:Any other non-zero status — error surfaced inside the comment: