fix: address PR review feedback for version bumping#3
fix: address PR review feedback for version bumping#3github-actions[bot] merged 1 commit intomainfrom
Conversation
- Require same-repo origin for auto-merge to prevent fork abuse - Tighten version regex to require at least one digit per component - Scan full commit history when no tag exists (root..HEAD) - Recognize BREAKING-CHANGE token alongside BREAKING CHANGE - Guard against empty commits in release workflow - Rebase before push to handle concurrent pushes to main Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR addresses several security and robustness improvements to the automated version bumping and release workflows. The changes include same-repo validation for auto-merge, tighter version parsing, full commit history scanning, expanded breaking change detection, empty commit guards, and concurrent commit handling.
Changes:
- Enhanced security for auto-merge by requiring PRs to originate from the same repository
- Improved version regex to require at least one digit per semantic version component
- Extended commit scanning to include full repository history when no tags exist
- Expanded breaking change detection to recognize both
BREAKING CHANGEandBREAKING-CHANGEformats - Added safeguards against empty commits and concurrent modifications in release workflow
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.github/workflows/auto-merge.yml |
Added same-repository check to prevent auto-merge of forked PRs |
scripts/bump-version.sh |
Tightened version regex, improved commit range scanning, and expanded BREAKING CHANGE detection |
.github/workflows/release.yml |
Added empty commit guard and git rebase to handle concurrent commits |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| git tag "$TAG" | ||
| git pull --rebase origin main |
There was a problem hiding this comment.
The tag is created before the rebase, which means it will point to the pre-rebase commit hash. After rebasing, the commit hash changes, so the tag will point to a commit that is no longer in the main branch's history. The tag should be created after the rebase, not before. Move line 43 to after line 44.
| git tag "$TAG" | |
| git pull --rebase origin main | |
| git pull --rebase origin main | |
| git tag "$TAG" |
Summary
root..HEAD) when no tag exists instead of only HEADBREAKING-CHANGEtoken alongsideBREAKING CHANGEgit pull --rebasebefore push to handle concurrent commits to mainTest plan
🤖 Generated with Claude Code