Skip to content

v2.0.0

Latest
Marketplace
Latest
Marketplace

Choose a tag to compare

View all tags
@wktk wktk released this 10 Jun 18:04
· 37 commits to master since this release
v2.0.0
This tag was signed with the committer’s verified signature.
wktk
SSH Key Fingerprint: Jtj/95g5mRKO+ivMcH+04CeArUn2PoSloe5O38kyY0E
Verified
Learn about vigilant mode.
401bde0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

conflibot v2.0.0

Major release: more accurate conflict detection, fork PR support, a security fix, and new configuration options.

Breaking changes

  • Runner requirements: a runner with node24 support and git 2.38+ (all current GitHub-hosted runners qualify; only older self-hosted runners may need an upgrade).
  • Detection engine: conflicts are found with an in-memory git merge-tree against the test merge commit GitHub already computed, instead of testing patch application. Edits that merely touch nearby lines are no longer reported as false conflicts, renames and already-merged changes behave like a real merge, and the working tree is never modified — follow-up steps see the checkout exactly as actions/checkout left it.
  • Report format: conflicts are reported per file and link to the file in the other PR (v1 linked to line numbers produced by the patch-based detection).

Security

  • git commands no longer pass through a shell. Branch names are attacker-controlled under pull_request_target, which previously allowed command injection in a job holding a write token. All git invocations now use argument arrays, and PRs are referenced by number via refs/pull/<n>/head.
  • The pull-ref change also makes PRs from forks work correctly (v1 silently skipped or failed on them).

New features

  • fail-on-conflict input: report the check as failure and fail the step when conflicts are found.
  • max-retries / retry-interval inputs: control polling for GitHub's test merge commit.
  • conflicts output: detected conflicts as JSON for follow-up steps (comments, chat notifications).
  • Pagination: repositories with more than 30 open PRs are now fully checked.

Fixes

  • Conflict links past line 9 no longer lose their anchor (single-digit regex bug).
  • Check-run updates are awaited; errors are reported with their message and stack instead of {}.
  • A PR with no commits beyond the base no longer fails the whole run.

Upgrading from v1

Point your workflow at wktk/conflibot@v2. Existing configurations keep working; see the Upgrading from v1 section of the README for details.

🤖 Generated with Claude Code

Assets 2
Loading