Repository navigation
Revert "semantic release can't push to master" - #2364
Conversation
This reverts commit 3e112b0.
Reviewer's guide (collapsed on small PRs)Reviewer's GuideReverts the branch-and-automated-PR release flow, returning semantic releases to direct commits and tag pushes on master with reduced workflow configuration. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/semantic-release.yml" line_range="23-24" />
<code_context>
with:
client-id: ${{ secrets.SEMANTIC_RELEASE_APP_ID }}
private-key: ${{ secrets.SEMANTIC_RELEASE_PK }}
- permission-contents: write
- permission-pull-requests: write
- uses: actions/checkout@v7
with:
</code_context>
<issue_to_address>
**Release token has excess permissions**
When the GitHub App installation has permissions beyond those required by this workflow, the token action issues a token with all installation permissions, and checkout persists it for Git operations. A compromised workflow step can use those unrelated permissions.
Explicitly limit the token to the contents and pull-request permissions this workflow requires.
</issue_to_address>
### Comment 2
<location path=".github/workflows/semantic-release.yml" line_range="45" />
<code_context>
+ sed -i 's|\("version": "\)[^"]*\("\)$|'"\1$VERSION_NEXT\2|;" $DOC_FILE
+ echo $VERSION_NEXT >VERSION
+ git commit -am "${VERSION_NEXT}"
+ git push
+ git tag "${VERSION_NEXT}" -m "${VERSION_NEXT}"
+ git push origin "${VERSION_NEXT}"
</code_context>
<issue_to_address>
**Release commits are rejected**
When master rules require pull requests or prevent the app from bypassing them, `git push` updates `master` directly, so branch protection rejects the version commit and the workflow stops before creating the tag or completing the release.
Restore a PR-based release path or configure the app to push directly under the branch rules.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 2 findings to address first, and the workflow now pushes version commits and tags directly to master, so a bad version can remain in repository history or trigger downstream release automation even after the workflow is reverted. Removing the token’s explicit permission limits also changes the authority available to the release job; reverting does not undo commits or tags already pushed.
Blocking findings: .github/workflows/semantic-release.yml:24, .github/workflows/semantic-release.yml:45
| permission-contents: write | ||
| permission-pull-requests: write |
There was a problem hiding this comment.
🟡 Medium · Release token has excess permissions
When the GitHub App installation has permissions beyond those required by this workflow, the token action issues a token with all installation permissions, and checkout persists it for Git operations. A compromised workflow step can use those unrelated permissions.
Explicitly limit the token to the contents and pull-request permissions this workflow requires.
Prompt for AI agents
In `.github/workflows/semantic-release.yml` at lines 23-24:
**Release token has excess permissions**
When the GitHub App installation has permissions beyond those required by this workflow, the token action issues a token with all installation permissions, and checkout persists it for Git operations. A compromised workflow step can use those unrelated permissions.
Explicitly limit the token to the contents and pull-request permissions this workflow requires.| sed -i 's|\("version": "\)[^"]*\("\)$|'"\1$VERSION_NEXT\2|;" $DOC_FILE | ||
| echo $VERSION_NEXT >VERSION | ||
| git commit -am "${VERSION_NEXT}" | ||
| git push |
There was a problem hiding this comment.
🟠 High · Release commits are rejected
When master rules require pull requests or prevent the app from bypassing them, git push updates master directly, so branch protection rejects the version commit and the workflow stops before creating the tag or completing the release.
Restore a PR-based release path or configure the app to push directly under the branch rules.
Prompt for AI agents
In `.github/workflows/semantic-release.yml` at line 45:
**Release commits are rejected**
When master rules require pull requests or prevent the app from bypassing them, `git push` updates `master` directly, so branch protection rejects the version commit and the workflow stops before creating the tag or completing the release.
Restore a PR-based release path or configure the app to push directly under the branch rules.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2364 +/- ##
==========================================
- Coverage 58.95% 58.89% -0.07%
==========================================
Files 151 151
Lines 9690 9706 +16
==========================================
+ Hits 5713 5716 +3
- Misses 3375 3386 +11
- Partials 602 604 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This reverts commit 3e112b0.
Secure Coding Practices Checklist GitHub Link
Secure Coding Checklist
Summary by Sourcery
Restore the previous semantic-release workflow for direct version commits and tagging on master.
Bug Fixes:
Enhancements:
CI: