chore: releases and versioning #62
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| name: Release | ||
|
|
||
| on: | ||
| push: | ||
| tags: | ||
| - "v*.*.*" | ||
|
|
||
| permissions: | ||
| contents: write | ||
|
|
||
| jobs: | ||
| test: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6 | ||
| - run: uv python install 3.12 | ||
| - run: uv sync --extra dev | ||
| - run: uv run ruff check src/ tests/ | ||
| - run: uv run ruff format --check src/ tests/ | ||
| - run: uv run pytest -v --cov=src --cov-report=term-missing --cov-fail-under=60 | ||
|
|
||
| release: | ||
| needs: test | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
|
|
||
| - name: Extract version from tag | ||
| id: version | ||
| run: echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Extract changelog section | ||
| id: changelog | ||
| env: | ||
| TAG: ${{ steps.version.outputs.tag }} | ||
| run: | | ||
| version="${TAG#v}" | ||
| # Escape dots for awk regex | ||
| escaped=$(echo "$version" | sed 's/\./\\./g') | ||
| # Extract the section for this version from CHANGELOG.md | ||
| section=$(awk "/^## \[${escaped}\]/{found=1; next} /^## \[/{if(found) exit} found{print}" CHANGELOG.md) | ||
| if [ -z "$section" ]; then | ||
|
There was a problem hiding this comment. [low] regex-correctness The awk command interpolates the version string into a regex without escaping dots (. matches any character in awk regex). Unlikely to cause problems with standard semver headings, but technically incorrect. |
||
| section="Release ${version}" | ||
| fi | ||
| # Use a delimiter for multiline output | ||
| echo "body<<CHANGELOG_EOF" >> "$GITHUB_OUTPUT" | ||
|
There was a problem hiding this comment. [low] edge-case The static heredoc delimiter Suggested fix: Use a dynamic delimiter: |
||
| echo "$section" >> "$GITHUB_OUTPUT" | ||
| echo "CHANGELOG_EOF" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Create GitHub Release | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| TAG: ${{ steps.version.outputs.tag }} | ||
| NOTES: ${{ steps.changelog.outputs.body }} | ||
| run: | | ||
|
There was a problem hiding this comment. [medium] GitHub Actions script injection The gh release create step interpolates steps.version.outputs.tag directly into shell arguments via ${{ }} expression syntax (lines 51-52 and 57). The Actions runner expands ${{ }} before bash parses the command, so a tag containing shell metacharacters would be interpreted as code. While only users with push access can create tags, defense-in-depth requires passing values through environment variables. The same pattern appears in the Update major version tag step (line 57). Suggested fix: Use env: TAG: ${{ steps.version.outputs.tag }} and reference as "$TAG" in the run script. Apply the same pattern to all steps that interpolate step outputs. |
||
| gh release create "$TAG" \ | ||
| --title "$TAG" \ | ||
| --notes "$NOTES" | ||
|
|
||
| - name: Update major version tag | ||
| env: | ||
| TAG: ${{ steps.version.outputs.tag }} | ||
| run: | | ||
| major=$(echo "$TAG" | grep -oP '^v\d+') | ||
| git tag -f "$major" | ||
| git push -f origin "$major" | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| # Changelog | ||
|
|
||
| All notable changes to this project will be documented in this file. | ||
|
|
||
| The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), | ||
| and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). | ||
|
|
||
| ## [Unreleased] | ||
|
|
||
| ## [0.1.0] - 2026-08-16 | ||
|
|
||
| Initial tagged release. The action has been in use since September 2025; | ||
| this release captures the current feature set for stable pinning. | ||
|
|
||
| ### Added | ||
|
|
||
| - AI-powered documentation review and update via PR comments | ||
| (`[review-docs]`, `[update-docs]`) | ||
| - Spec-vs-code gap analysis via Jira integration (`[review-feature]`) | ||
| - Support for Markdown, AsciiDoc, and reStructuredText doc formats | ||
| - Same-repo and separate-docs-repo configurations | ||
| - Semantic folder indexes for faster file discovery | ||
| - Persistent style guidelines via `.code-to-docs/style.md` | ||
| - Repository configuration via `.code-to-docs/config.json` | ||
| - Interactive review with checkboxes for accepting/rejecting file suggestions | ||
| - Fork PR detection with suggested-changes fallback | ||
| - Per-file and global reviewer instructions in `[update-docs]` comments | ||
| - CI pipeline with ruff linting, formatting, and 60% coverage threshold |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[low] workflow-duplication
The release workflow's test job duplicates the exact same steps as ci.yaml. If test commands change, both workflows must be updated independently.
Suggested fix: Consider creating a reusable workflow that both ci.yaml and release.yml call, or rely on branch protection requiring CI to pass before tagging.