feat(ci): add PR bump preview workflow by bearomorphism · Pull Request #1957 · commitizen-tools/commitizen

bearomorphism · 2026-05-09T07:13:45Z

Description

Adds a GitHub Actions workflow that runs cz bump --dry-run against every incoming pull request and posts (or updates) a sticky comment summarising the would-be version bump and changelog entries. Reviewers can spot unexpected version bumps before merging.

The pattern is also documented in docs/tutorials/github_actions.md so other projects can copy/paste the same workflow.

How it works

Trigger: pull_request_target (matches label_pr.yml) so the workflow has pull-requests: write even for fork PRs. The job only runs cz bump --dry-run, a read-only command, so PR-controlled scripts are not executed.
Setup: Uses commitizen-tools/setup-cz — no language-specific toolchain required.
Dry-run: Captures cz bump --dry-run --yes output and exit status. Exit code 21 (NoneIncrementExit) is treated as "no eligible bump" instead of an error; other non-zero codes are surfaced in the comment.
Sticky comment: A hidden  marker lets peter-evans/create-or-update-comment edit the previous preview in place on every push instead of stacking comments.

Companion changes are being prepared for commitizen-tools/commitizen-action (replaces the draft #102 attempt) and commitizen-tools/setup-cz (examples/) so the same pattern is available to consumers of either action.

Closes #1510

Type of changes

CI/CD related
Documentation update

Steps to Test This Pull Request

The workflow self-tests once it lands on master: open a follow-up PR and confirm a 🔍 Commitizen bump preview comment appears and updates as you push commits.

Expected output

The workflow posts (and replaces on every push) a single sticky comment whose body depends on the dry-run exit code.

cz bump --dry-run --yes succeeds (status 0) — eligible bump:

Rendered comment

🔍 Commitizen bump preview

Merging this PR will produce the following bump:
bump: version 4.15.1 → 4.16.0
tag to create: v4.16.0
increment detected: MINOR

<!-- commitizen-bump-preview -->
## 🔍 Commitizen bump preview

Merging this PR will produce the following bump:

```
bump: version 4.15.1 → 4.16.0
tag to create: v4.16.0
increment detected: MINOR
```

NoneIncrementExit (status 21) — no eligible commits:

🔍 Commitizen bump preview

No commits in this PR are eligible for a version bump.

Any other non-zero status — error surfaced inside the comment:

🔍 Commitizen bump preview

⚠️ cz bump --dry-run exited with status 3:
NoCommitsFoundError

The status-0 example above is the literal output of cz bump --dry-run --yes against the current master of this repository (verified locally).

Checklist

My PR title follows conventional commit style
Documentation updated

Adds a workflow that runs cz bump --dry-run on incoming pull requests and posts (or updates) a sticky comment summarising the would-be version bump and changelog entries. This makes unexpected version bumps visible to reviewers before merging, addressing commitizen-tools#1510. The pattern is documented in docs/tutorials/github_actions.md so other projects can copy/paste the same workflow. Closes commitizen-tools#1510 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

codecov · 2026-05-09T07:14:59Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.23%. Comparing base (4b93a50) to head (52530b0).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1957   +/-   ##
=======================================
  Coverage   98.23%   98.23%           
=======================================
  Files          61       61           
  Lines        2779     2779           
=======================================
  Hits         2730     2730           
  Misses         49       49

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copilot

Pull request overview

Adds a GitHub Actions workflow to comment a “bump preview” on pull requests, and documents the pattern so downstream users can reuse it.

Changes:

Add .github/workflows/pr-bump-preview.yml to run cz bump --dry-run on PRs and post/update a sticky comment.
Document the new PR bump preview workflow in docs/tutorials/github_actions.md.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
docs/tutorials/github_actions.md	Documents a reusable “PR bump preview” workflow and explains how it works.
.github/workflows/pr-bump-preview.yml	New workflow that runs Commitizen in CI for PRs and posts/updates a sticky PR comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

bearomorphism · 2026-05-09T08:50:16Z

+    if: ${{ github.event.pull_request.draft == false }}
+    runs-on: ubuntu-latest
+    steps:
+      # Using pull_request_target means GITHUB_TOKEN has write access to PR
+      # comments even for fork PRs. We deliberately only run `cz bump --dry-run`
+      # against the checked-out PR commits — no PR-controlled scripts are
+      # executed, so this is safe.


Addressed in 52530b0: gated the job to same-repo PRs by comparing head.repo.full_name to base.repo.full_name. Fork PRs are now skipped entirely, so cz bump is never run against fork-controlled files. Same-repo PRs are written by collaborators who already have push access, so the Jinja-template execution path doesn't cross a trust boundary.

bearomorphism · 2026-05-09T08:50:28Z

+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          fetch-tags: true


Addressed in 52530b0: added persist-credentials: false on actions/checkout.

bearomorphism · 2026-05-09T08:50:28Z

+
+To help reviewers spot unexpected version bumps before merging, you can run
+`cz bump --dry-run` on every pull request and post (or update) a sticky
+comment summarizing the would-be version bump and changelog entries.


Addressed in 52530b0: dropped the and changelog entries wording from the docs intro, and clarified in the How it works section that changelog entries only appear when update_changelog_on_bump is set in the project's commitizen config.

bearomorphism · 2026-05-09T08:50:28Z

+- **Trigger**: `pull_request_target` runs in the context of the base
+  repository, which gives the workflow `pull-requests: write` permission
+  even for PRs from forks. The job only runs `cz bump --dry-run`, a
+  read-only command, so it does not execute any PR-controlled scripts.
+- **Setup**: [`commitizen-tools/setup-cz`](https://github.com/commitizen-tools/setup-cz)


Addressed in 52530b0: rewrote the safety explanation in the How it works section. The job now gates to same-repo PRs only, and the docs spell out why (cz bump's non-sandboxed Jinja renderer + update_changelog_on_bump would otherwise let a fork PR run arbitrary code under the write token). Also added persist-credentials: false as defense in depth.

Address Copilot review feedback on commitizen-tools#1957: * `cz bump` renders Jinja templates from the working directory whenever `update_changelog_on_bump` is set in config, using a non-sandboxed `FileSystemLoader('.')`. Under `pull_request_target` with a write token, executing those templates against fork-controlled files would risk RCE / token exfiltration. Gate the job to same-repo PRs by comparing `head.repo.full_name` to `base.repo.full_name`. * Set `persist-credentials: false` on `actions/checkout` as defense in depth, so the workflow token is not written to `.git/config`. * Adjust docs to drop the misleading `and changelog entries` claim (the dry-run only shows changelog entries when `update_changelog_on_bump` is enabled), and rewrite the safety explanation to reflect the real threat model. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Mirrors the security fix on commitizen-tools/commitizen#1957: * `cz bump` can render Jinja templates from the working directory when `update_changelog_on_bump` is set in config, using a non-sandboxed loader. Under `pull_request_target` this would let a fork PR execute arbitrary code with a write token, so gate the job to same-repo PRs only (`head.repo == base.repo`). * Add `persist-credentials: false` on `actions/checkout` as defense in depth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

bearomorphism · 2026-05-09T08:55:27Z

Note for reviewers: the duplication across this repo, commitizen-action, and setup-cz is intentional for now. Tracked as a follow-up in #1959 (mirrored at commitizen-tools/setup-cz#20) — once these PRs are merged and we have one or two real bump-preview comments in production, we plan to promote the example into a reusable workflow in setup-cz and shrink the workflows in commitizen + commitizen-action to ~8-line wrappers pinned to a tagged setup-cz release.

bearomorphism requested review from Lee-W, noirbizarre and woile as code owners May 9, 2026 07:13

github-actions Bot added pr-status: wait-for-review type: feature A new enhacement proposal labels May 9, 2026

This was referenced May 9, 2026

feat: rework PR bump preview workflow commitizen-tools/commitizen-action#102

Open

feat(examples): add PR bump preview example commitizen-tools/setup-cz#19

Open

Generate expected bump version comment when receiving a new pull request #1510

Open

bearomorphism requested a review from Copilot May 9, 2026 08:29

Copilot started reviewing on behalf of bearomorphism May 9, 2026 08:29 View session

bearomorphism marked this pull request as draft May 9, 2026 08:33

Copilot AI reviewed May 9, 2026

View reviewed changes

bearomorphism marked this pull request as ready for review May 9, 2026 08:36

This was referenced May 9, 2026

Promote PR bump preview to a reusable workflow in setup-cz #1959

Open

Triage audit: 30 open untriaged non-bug issues (May 2026, follow-up to #1964) #1965

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(ci): add PR bump preview workflow#1957

feat(ci): add PR bump preview workflow#1957
bearomorphism wants to merge 2 commits intocommitizen-tools:masterfrom
bearomorphism:feat/pr-bump-preview

bearomorphism commented May 9, 2026 •

edited

Loading

Uh oh!

codecov Bot commented May 9, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

bearomorphism May 9, 2026

Uh oh!

bearomorphism May 9, 2026

Uh oh!

bearomorphism May 9, 2026

Uh oh!

bearomorphism May 9, 2026

Uh oh!

bearomorphism commented May 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

bearomorphism commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

How it works

Type of changes

Steps to Test This Pull Request

Expected output

🔍 Commitizen bump preview

🔍 Commitizen bump preview

🔍 Commitizen bump preview

Checklist

Uh oh!

codecov Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

bearomorphism May 9, 2026

Choose a reason for hiding this comment

Uh oh!

bearomorphism May 9, 2026

Choose a reason for hiding this comment

Uh oh!

bearomorphism May 9, 2026

Choose a reason for hiding this comment

Uh oh!

bearomorphism May 9, 2026

Choose a reason for hiding this comment

Uh oh!

bearomorphism commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bearomorphism commented May 9, 2026 •

edited

Loading

codecov Bot commented May 9, 2026 •

edited

Loading

bearomorphism commented May 9, 2026 •

edited

Loading