:book: Release guide
- - Dependabot PR's:
- - We expect Dependabot PRs to be passing CI and have any changes to the `dist/` folder built for production dependencies
- - Some development dependencies may fail the `dist/` check if they modify the Typescript compilation, these should be updated manually via `npm run build`. See the [`dependabot-build`](https://github.com/dependabot/fetch-metadata/blob/main/.github/workflows/dependabot-build.yml) action for details.
- - Checkout and update `main`, then generate a patch release branch
- ```bash
- git checkout main
- git pull
- bin/bump-version -p patch
- ```
- - Generate a draft release for your new version
- ```bash
- gh release create v1.X.X --generate-notes --draft
- > https://github.com/dependabot/fetch-metadata/releases/tag/untagged-XXXXXX
- ```
- - Create a PR linking to the release notes for review
- ```bash
- gh pr create --title "v1.X.X Release Notes" --body "https://github.com/dependabot/fetch-metadata/releases/tag/untagged-XXXXXX"
- ```
- - Copy the release notes from the draft release to the PR description. This is optional, but looks much nicer than a bare URL.
- - Merge the PR after getting it reviewed
- - Publish the draft release found at https://github.com/dependabot/fetch-metadata/releases/tag/untagged-XXXXXX
- - Update the `v1` tracking tag to point to the new version
- ```bash
- git fetch --all --tags
- git checkout v1.x.x # Check out the release tag
- git tag -f v1 # Force update the tracking tag
- git push -f --tags
- ```
+ ## Dependabot PR's
+
+ - We expect Dependabot PRs to be passing CI and have any changes to the `dist/` folder built for production dependencies
+ - Some development dependencies may fail the `dist/` check if they modify the Typescript compilation, these should be updated manually via `npm run build`. See the [`dependabot-build`](https://github.com/dependabot/fetch-metadata/blob/main/.github/workflows/dependabot-build.yml) action for details.
+
+ ## Tagging a new release
+
+ Publish a new release by running the [`Release - Bump Version`](https://github.com/dependabot/fetch-metadata/actions/workflows/release-bump-version.yml) workflow and following the instructions on the job summary.
+
+ In a nutshell the process will be:
+
+ 1. Run the action to generate a version bump PR.
+ 2. Merge the PR.
+ 3. Tag that merge commit as a new release using the format `v1.2.3`. The job summary contains a URL pre-populated with the correct version for the title and tag.
+ 4. Once the release is tagged, another GitHub Action workflow automatically moves the `v1` tracking tag to point to the new version.
+
diff --git a/action.yml b/action.yml
index 19bde717d..d1cf2a792 100644
--- a/action.yml
+++ b/action.yml
@@ -48,6 +48,8 @@ outputs:
description: 'If this PR is associated with a security alert and `alert-lookup` is `true`, this contains the CVSS value of that alert (otherwise it contains 0).'
compatibility-score:
description: 'If this PR has a known compatibility score and `compat-lookup` is `true`, this contains the compatibility score (otherwise it contains 0).'
+ maintainer-changes:
+ description: 'Whether or not the the body of this PR contains the phrase "Maintainer changes" which is an indicator of whether or not any maintainers have changed.'
runs:
using: 'node16'
main: 'dist/index.js'
diff --git a/bin/bump-version b/bin/bump-version
index e1521fee6..4ca17802d 100755
--- a/bin/bump-version
+++ b/bin/bump-version
@@ -1,28 +1,11 @@
#!/bin/bash
-usage() { echo "Usage: $0 -p [major | minor | patch]" 1>&2; exit 1; }
+usage() { echo "Usage: $0 [ major | minor | patch ]" 1>&2; exit 1; }
-while getopts "p:" o; do
- case "${o}" in
- p)
- patch_level=${OPTARG}
- (( patch_level == 'major' || patch_level == 'minor' || patch_level == 'patch'))
- ;;
- *)
- usage
- ;;
- esac
-done
-
-echo "$patch_level"
-
-if [[ -z "${patch_level}" ]]; then
+version_type=$1
+if [ "$version_type" == "major" ] || [ "$version_type" == "minor" ] || [ "$version_type" == "patch" ]; then
+ new_version=$(npm version "$version_type" --no-git-tag-version) || exit
+ echo "$new_version"
+else
usage
fi
-
-new_version=$(npm version "${patch_level}" --no-git-tag-version)
-git checkout -b "${new_version}"-release-notes
-git add package.json package-lock.json
-git commit -m "${new_version}"
-
-echo "Branch prepared for ${new_version}"
diff --git a/bin/check-build-output-in-dist-directory b/bin/check-build-output-in-dist-directory
new file mode 100755
index 000000000..833d62b88
--- /dev/null
+++ b/bin/check-build-output-in-dist-directory
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# Make sure we notice any untracked files generated by the build in the dist/ directory
+git add --intent-to-add .
+git diff --quiet dist/
+retVal=$?
+if [ $retVal -ne 0 ]; then
+ echo "Detected uncommitted changes after build:"
+ # The contents of the diff/ folder are marked as generated:
+ # https://github.com/dependabot/fetch-metadata/blob/6c2bf2fe33cc133b474165107a8b29ccc265dc96/.gitattributes#L1
+ # so this ensures we spit out the actual change in the obfuscated JS.
+ git --no-pager diff dist/
+ exit 1
+fi
diff --git a/bin/check-diff b/bin/check-diff
deleted file mode 100755
index c68ccf20a..000000000
--- a/bin/check-diff
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/bash
-
-# Make sure we notice any untracked files generated by the build
-git add --intent-to-add .
-git diff --quiet dist/
-retVal=$?
-if [ $retVal -ne 0 ]; then
- echo "Detected uncommitted changes after build:"
- git --no-pager diff dist/
- exit 1
-fi
diff --git a/dist/index.js b/dist/index.js
index 925dbdb44..6cd64e4ee 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -9993,6 +9993,8 @@ function set(updatedDependencies) {
const prevVersion = firstDependency === null || firstDependency === void 0 ? void 0 : firstDependency.prevVersion;
const newVersion = firstDependency === null || firstDependency === void 0 ? void 0 : firstDependency.newVersion;
const compatScore = firstDependency === null || firstDependency === void 0 ? void 0 : firstDependency.compatScore;
+ const maintainerChanges = firstDependency === null || firstDependency === void 0 ? void 0 : firstDependency.maintainerChanges;
+ const dependencyGroup = firstDependency === null || firstDependency === void 0 ? void 0 : firstDependency.dependencyGroup;
const alertState = firstDependency === null || firstDependency === void 0 ? void 0 : firstDependency.alertState;
const ghsaId = firstDependency === null || firstDependency === void 0 ? void 0 : firstDependency.ghsaId;
const cvss = firstDependency === null || firstDependency === void 0 ? void 0 : firstDependency.cvss;
@@ -10006,6 +10008,8 @@ function set(updatedDependencies) {
core.info(`outputs.previous-version: ${prevVersion}`);
core.info(`outputs.new-version: ${newVersion}`);
core.info(`outputs.compatibility-score: ${compatScore}`);
+ core.info(`outputs.maintainer-changes: ${maintainerChanges}`);
+ core.info(`outputs.dependency-group: ${dependencyGroup}`);
core.info(`outputs.alert-state: ${alertState}`);
core.info(`outputs.ghsa-id: ${ghsaId}`);
core.info(`outputs.cvss: ${cvss}`);
@@ -10020,6 +10024,8 @@ function set(updatedDependencies) {
core.setOutput('previous-version', prevVersion);
core.setOutput('new-version', newVersion);
core.setOutput('compatibility-score', compatScore);
+ core.setOutput('maintainer-changes', maintainerChanges);
+ core.setOutput('dependency-group', dependencyGroup);
core.setOutput('alert-state', alertState);
core.setOutput('ghsa-id', ghsaId);
core.setOutput('cvss', cvss);
@@ -10083,12 +10089,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.calculateUpdateType = exports.parse = void 0;
const YAML = __importStar(__nccwpck_require__(4083));
-function parse(commitMessage, branchName, mainBranch, lookup, getScore) {
- var _a, _b, _c, _d, _e, _f, _g, _h;
+function parse(commitMessage, body, branchName, mainBranch, lookup, getScore) {
+ var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
return __awaiter(this, void 0, void 0, function* () {
const bumpFragment = commitMessage.match(/^Bumps .* from (?