Skip to content

Conversation

@chriswk
Copy link
Member

@chriswk chriswk commented Nov 5, 2025

We've loved release-plz, but it doesn't work very well with multiple crates due to how cargo has rate limits on publishing and there are some crates in this we don't want to release.

This PR attempts to reproduce some of release-plz's functionality (check for changes since last tag, make PR with a new release, create tag on main if version has been bumped and there are no other changes)

Copilot AI review requested due to automatic review settings November 5, 2025 15:03
@chriswk chriswk self-assigned this Nov 5, 2025
@github-actions
Copy link

github-actions bot commented Nov 5, 2025

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
actions/actions/checkout 5.*.* 🟢 6.4
Details
CheckScoreReason
Maintained🟢 34 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 8SAST tool detected but not run on all commits
actions/actions/create-github-app-token 2.*.* 🟢 6.5
Details
CheckScoreReason
Maintained🟢 1021 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 1Found 2/11 approved changesets -- score normalized to 1
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Vulnerabilities🟢 91 existing vulnerabilities detected
Packaging🟢 10packaging workflow detected
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
actions/peter-evans/create-pull-request 7.*.* 🟢 4.9
Details
CheckScoreReason
Code-Review🟢 7Found 3/4 approved changesets -- score normalized to 7
Maintained🟢 1014 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
Vulnerabilities🟢 37 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
actions/taiki-e/install-action 2.*.* 🟢 7.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 7Found 17/24 approved changesets -- score normalized to 7
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
License🟢 10license file detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • .github/workflows/prepare_release_without_release_plz.yaml

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR introduces a new git-cliff configuration file and a manual release workflow as an alternative to the existing release-plz automated release system. The changes enable the team to prepare releases using git-cliff for changelog generation and manual version bumping.

  • Added cliff.toml configuration file with git-cliff settings for changelog generation
  • Created a new GitHub Actions workflow for manual release preparation without release-plz
  • Workflow includes smart fast-path tagging for metadata-only changes and semver-based version bumping

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File Description
cliff.toml Adds git-cliff configuration with commit parsers, preprocessors, and changelog template compatible with the existing release-plz setup
.github/workflows/prepare_release_without_release_plz.yaml Implements a manual release preparation workflow with automatic version detection, changelog generation, and PR creation

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.


body = """

## [{{ version }}]\
Copy link

Copilot AI Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The timestamp format differs from release-plz.toml which uses {{ timestamp | date(format=\"%Y-%m-%d\") }} (line 73 in release-plz.toml). This inconsistency could lead to different timestamp formats in changelogs. Consider using the same format for consistency.

Copilot uses AI. Check for mistakes.
{%- if release_link -%}\
({{ release_link }})\
{% endif %} \
- {{ timestamp }}
Copy link

Copilot AI Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The timestamp format differs from release-plz.toml which uses {{ timestamp | date(format=\"%Y-%m-%d\") }} (line 73 in release-plz.toml). This inconsistency could lead to different timestamp formats in changelogs. Consider using the same format for consistency.

Suggested change
- {{ timestamp }}
- {{ timestamp | date(format="%Y-%m-%d") }}

Copilot uses AI. Check for mistakes.
Comment on lines +71 to +82
- {{ statistics.commit_count }} commit(s) contributed to the release.
- {{ statistics.commits_timespan | default(value=0) }} day(s) passed between the first and last commit.
- {{ statistics.conventional_commit_count }} commit(s) parsed as conventional.
- {{ statistics.links | length }} linked issue(s) detected in commits.
{%- if statistics.links | length > 0 %}
{%- for link in statistics.links %}
{{ " " }}- [{{ link.text }}]({{ link.href }}) (referenced {{ link.count }} time(s))
{%- endfor %}
{%- endif %}
{%- if statistics.days_passed_since_last_release %}
- {{ statistics.days_passed_since_last_release }} day(s) passed between releases.
{%- endif %}
Copy link

Copilot AI Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The git-cliff template includes statistics (lines 71-82) that are not present in the release-plz.toml template (lines 67-100). This will cause changelogs generated by git-cliff to have a different format than those generated by release-plz, which could be confusing for users. Consider removing these statistics or adding them to release-plz.toml for consistency.

Suggested change
- {{ statistics.commit_count }} commit(s) contributed to the release.
- {{ statistics.commits_timespan | default(value=0) }} day(s) passed between the first and last commit.
- {{ statistics.conventional_commit_count }} commit(s) parsed as conventional.
- {{ statistics.links | length }} linked issue(s) detected in commits.
{%- if statistics.links | length > 0 %}
{%- for link in statistics.links %}
{{ " " }}- [{{ link.text }}]({{ link.href }}) (referenced {{ link.count }} time(s))
{%- endfor %}
{%- endif %}
{%- if statistics.days_passed_since_last_release %}
- {{ statistics.days_passed_since_last_release }} day(s) passed between releases.
{%- endif %}

Copilot uses AI. Check for mistakes.
mapfile -t crates < <(git ls-files '**/Cargo.toml' ':!target/**' ':!.github/**')
for cargo_toml in "${crates[@]}"; do
dir="$(dirname "${cargo_toml}")"
( cd "${dir}" && git-cliff "${since_flag[@]}" --output CHANGELOG.md )
Copy link

Copilot AI Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The git-cliff command runs without specifying a configuration file, so it will use the default cliff.toml. However, if git-cliff is run from a subdirectory, it may not find the cliff.toml in the repository root. Consider adding --config ../../cliff.toml or similar path resolution to ensure the configuration is found.

Suggested change
( cd "${dir}" && git-cliff "${since_flag[@]}" --output CHANGELOG.md )
( cd "${dir}" && git-cliff "${since_flag[@]}" --config "$(git rev-parse --show-toplevel)/cliff.toml" --output CHANGELOG.md )

Copilot uses AI. Check for mistakes.
done

git-cliff "${since_flag[@]}" --output CHANGELOG_PR.md
git add CHANGELOG_PR.md
Copy link

Copilot AI Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow generates CHANGELOG_PR.md for the PR body but doesn't clean up this file after the PR is created. Consider adding a cleanup step or documenting whether this file should be committed or is temporary.

Suggested change
git add CHANGELOG_PR.md
# Do not add CHANGELOG_PR.md to the commit; it is only used for the PR body

Copilot uses AI. Check for mistakes.
@chriswk chriswk moved this from New to Todo in Issues and PRs Nov 6, 2025
Copilot AI review requested due to automatic review settings November 6, 2025 10:51
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI review requested due to automatic review settings November 6, 2025 12:15
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI review requested due to automatic review settings November 7, 2025 03:16
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI review requested due to automatic review settings November 13, 2025 07:34
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI review requested due to automatic review settings November 14, 2025 07:53
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI review requested due to automatic review settings November 19, 2025 03:15
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI review requested due to automatic review settings November 20, 2025 03:28
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copy link
Member

@sighphyre sighphyre left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Chaos. Love it. I'm here for it. Let's see if it works

@github-project-automation github-project-automation bot moved this from Todo to Approved PRs in Issues and PRs Nov 20, 2025
Copilot AI review requested due to automatic review settings November 20, 2025 12:16
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI review requested due to automatic review settings November 24, 2025 03:24
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI review requested due to automatic review settings November 25, 2025 03:27
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI review requested due to automatic review settings November 25, 2025 15:59
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI review requested due to automatic review settings November 27, 2025 15:33
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Approved PRs

Development

Successfully merging this pull request may close these issues.

2 participants