2GT-RichandClaude Opus 5
1ce57a25ec
The release notes were passed through a step output and interpolated straight into the gh command. Commit messages here routinely contain backticks, so the shell evaluated them as command substitution — which failed the first release outright, and would let a commit message run arbitrary code in CI. Notes are written to a file and passed with --notes-file; nothing from the commit reaches a shell as code. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
68 lines
2.5 KiB
YAML
68 lines
2.5 KiB
YAML
# Cut a GitHub Release whenever the shipped version changes.
|
|
#
|
|
# The dashboard links users to the releases page, and that page held a single
|
|
# entry from five months earlier while the product shipped daily — which tells a
|
|
# visitor the project is abandoned. Commit messages here already read as release
|
|
# notes, so the note is the commit body rather than a generated list of subjects.
|
|
name: Release
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'frontend/package.json'
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
fetch-depth: 2
|
|
|
|
- name: Read version, and stop if it did not change
|
|
id: v
|
|
run: |
|
|
VERSION=$(node -p "require('./frontend/package.json').version")
|
|
PREV=$(git show HEAD~1:frontend/package.json 2>/dev/null | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).version" || echo "")
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
if [ "$VERSION" = "$PREV" ]; then
|
|
echo "unchanged=true" >> "$GITHUB_OUTPUT"
|
|
echo "Version unchanged ($VERSION) — nothing to release."
|
|
fi
|
|
|
|
- name: Compose notes from the commit that shipped it
|
|
if: steps.v.outputs.unchanged != 'true'
|
|
env:
|
|
VERSION: ${{ steps.v.outputs.version }}
|
|
run: |
|
|
# Written to a file rather than passed through a step output. Commit
|
|
# messages here routinely contain backticks, and interpolating one into
|
|
# a shell command lets the shell evaluate it — which is both why the
|
|
# first attempt failed and a way to run arbitrary code in CI from a
|
|
# commit message.
|
|
{
|
|
git log -1 --pretty=%B
|
|
printf '\n---\n'
|
|
printf 'Container image: `ghcr.io/2gt-media-group-llc/mikrotik-manager:%s`\n\n' "$VERSION"
|
|
printf 'Documentation: https://2gt-media-group-llc.github.io/mikrotik-manager/\n'
|
|
} > /tmp/release-notes.md
|
|
|
|
- name: Publish
|
|
if: steps.v.outputs.unchanged != 'true'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
VERSION: ${{ steps.v.outputs.version }}
|
|
run: |
|
|
TAG="v$VERSION"
|
|
# Betas are marked pre-release so nobody is pointed at one by accident.
|
|
PRERELEASE=""
|
|
case "$TAG" in *beta*|*alpha*|*rc*) PRERELEASE="--prerelease" ;; esac
|
|
gh release create "$TAG" \
|
|
--title "$TAG" \
|
|
--notes-file /tmp/release-notes.md \
|
|
$PRERELEASE
|