ci: add release-please and conventional commit enforcement#333
Open
gjtorikian wants to merge 4 commits intomainfrom
Open
ci: add release-please and conventional commit enforcement#333gjtorikian wants to merge 4 commits intomainfrom
gjtorikian wants to merge 4 commits intomainfrom
Conversation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
Greptile SummaryThis PR replaces the manual version-bump and release workflows with a fully automated release-please pipeline, and adds a PR title linter to enforce conventional commits — a clean, well-structured modernisation of the release process. Key observations:
Confidence Score: 4/5
Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Developer opens PR] --> B[lint-pr-title.yml\npull_request_target]
B --> C{PR title follows\nConventional Commits?}
C -- No --> D[Check fails\nPR blocked]
C -- Yes --> E[PR merged to main\nvia squash merge]
E --> F[release-please.yml\npush to main]
F --> G[googleapis/release-please-action\nopens or updates Release PR]
G --> H{Release PR\nmerged?}
H -- No --> G
H -- Yes --> I[GitHub Release + tag created\nby release-please]
I --> J[Packagist detects new tag\nvia webhook]
Last reviewed commit: 3c7397c |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+18
to
+23
| uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 | ||
| with: | ||
| app-id: ${{ vars.SDK_BOT_APP_ID }} | ||
| private-key: ${{ secrets.SDK_BOT_PRIVATE_KEY }} | ||
|
|
||
| - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0 |
Contributor
There was a problem hiding this comment.
Mutable action tags replace SHA-pinned references
The removed workflows (release.yml, version-bump.yml) consistently pinned every third-party action to an immutable commit SHA (e.g., actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf). The new workflows switch to mutable tag references (@v2, @v4), which means a compromised or accidentally-overwritten tag could silently run malicious code with contents: write and pull-requests: write permissions during a push to main.
Pin both actions to their current SHAs to maintain the same security posture as the removed workflows:
Suggested change
| uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 | |
| with: | |
| app-id: ${{ vars.SDK_BOT_APP_ID }} | |
| private-key: ${{ secrets.SDK_BOT_PRIVATE_KEY }} | |
| - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0 | |
| - name: Generate token | |
| id: generate-token | |
| uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2 | |
| with: | |
| app-id: ${{ vars.SDK_BOT_APP_ID }} | |
| private-key: ${{ secrets.SDK_BOT_PRIVATE_KEY }} | |
| - uses: googleapis/release-please-action@a02a34c4d625b9a4a4de9c2a2a6c5fb5b41b9c0d # v4 | |
| with: | |
| token: ${{ steps.generate-token.outputs.token }} |
(Replace the example SHAs above with the actual current HEAD SHAs from each action's repository before merging.)
| lint: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5 |
Contributor
There was a problem hiding this comment.
Unpinned action tag
amannn/action-semantic-pull-request@v5 uses a mutable tag, consistent with the regression noted in release-please.yml. Because this workflow runs on pull_request_target (which has access to repository secrets), an attacker who can push to the action's v5 tag could exfiltrate the GITHUB_TOKEN.
Pin to the SHA corresponding to the v5 release:
Suggested change
| - uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5 | |
| - uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5 |
(Replace the example SHA with the actual SHA from the action's repository.)
The `version-file` option is only supported by `ruby` and `simple` strategies — it's silently ignored for `release-type: php`. Use `extra-files` with the `generic` updater instead, which matches the `x-release-please-version` annotation comment to find and replace the semver string. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
version-bumpworkflow with release-please's automated release PR flowrelease.ymlworkflow (release-please now creates GitHub releases, and Packagist auto-syncs via webhook)lint-pr-title.yml) to enforce Conventional Commits, which release-please uses to determine version bumpsFollows the same pattern as workos-ruby#435 and workos-node#1467.
How it works
feat:,fix:,chore:, etc.) are enforced on PR titles viaamannn/action-semantic-pull-requestmainrelease-please-actionopens (or updates) a release PR with a version bump andCHANGELOG.mdentryPHP-specific: keeping
lib/Version.phpin syncWe use
release-type: "php"which handlescomposer.jsonandCHANGELOG.mdout of the box. However, this SDK also has alib/Version.phpfile with a hardcodedSDK_VERSIONconstant (used for the User-Agent header). Thephpstrategy doesn't know about this file.The Ruby and Node SDKs use
version-fileto point release-please at their version files, but that option is only supported by therubyandsimplestrategies — it's silently ignored forphp.Instead, we use
extra-fileswith thegenericupdater. This requires anx-release-please-versionannotation comment on the version line inlib/Version.php:The generic updater matches the semver string on annotated lines and replaces it with the new version, leaving the rest of the file untouched.
Changes
.github/workflows/lint-pr-title.yml.github/workflows/release-please.ymlmain, creates release PRs automatically.release-please-manifest.json4.30.1)release-please-config.jsonextra-filesgeneric updater forlib/Version.phplib/Version.phpx-release-please-versionannotation so release-please can bumpSDK_VERSION.github/workflows/release.yml.github/workflows/version-bump.ymlTest plan
lint-pr-titlecheck runs on this PR (title uses conventional commit format)lint-pr-titleas a required status check in branch protection formain🤖 Generated with Claude Code