You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: llms-full.txt
+101Lines changed: 101 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -3970,6 +3970,107 @@ jobs:
3970
3970
3971
3971
You can find the complete workflow in our repository at [bumpversion.yml](https://github.com/commitizen-tools/commitizen/blob/master/.github/workflows/bumpversion.yml).
3972
3972
3973
+
### Previewing the version bump on pull requests
3974
+
3975
+
To help reviewers spot unexpected version bumps before merging, you can run `cz bump --dry-run` on every pull request and post (or update) a sticky comment summarizing the would-be version bump.
- **Trigger**: `pull_request_target` runs in the context of the base repository, which gives the workflow `pull-requests: write` permission even for PRs from forks. We deliberately gate the job to **same-repo PRs only** (`head.repo == base.repo`); fork PRs are skipped. This is because `cz bump` renders [Jinja templates from the working directory](https://github.com/commitizen-tools/commitizen/blob/master/commitizen/changelog.py) whenever [`update_changelog_on_bump`](https://commitizen-tools.github.io/commitizen/config/configuration_file/index.md) is enabled, and the renderer is not sandboxed — running it against fork-controlled files under a write token would risk arbitrary code execution and token exfiltration. Same-repo PRs are written by collaborators who already have push access, so the same risk doesn't apply.
4067
+
- **Setup**: [`commitizen-tools/setup-cz`](https://github.com/commitizen-tools/setup-cz) installs the Commitizen CLI; no language-specific build tooling is required.
4068
+
- **Defense in depth**: `persist-credentials: false` on `actions/checkout` keeps the workflow token out of the local git config.
4069
+
- **Dry-run**: `cz bump --dry-run --yes` computes the next version (and, if `update_changelog_on_bump` is set in your config, also the changelog entries that would be produced). Exit code `21` (`NoneIncrementExit`) is treated as "no eligible bump" rather than a failure.
4070
+
- **Sticky comment**: The hidden HTML marker `<!-- commitizen-bump-preview -->` lets [`peter-evans/create-or-update-comment`](https://github.com/peter-evans/create-or-update-comment) find and replace the previous preview on every push, instead of leaving a growing trail of comments.
4071
+
4072
+
You can find the complete workflow in our repository at [pr-bump-preview.yml](https://github.com/commitizen-tools/commitizen/blob/master/.github/workflows/pr-bump-preview.yml).
4073
+
3973
4074
### Publishing a Python package
3974
4075
3975
4076
After a new version tag is created by the bump workflow, you can automatically publish your package to PyPI.
0 commit comments