From 21767d1ba75c2712053faeafdd1dac024c2fa897 Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Mon, 21 Sep 2026 14:10:49 -0300 Subject: [PATCH 1/7] refactor: centralize release-tool version pin Signed-off-by: Vitor Mattos --- actions/setup-release-tool/release-tool-version | 1 + 1 file changed, 1 insertion(+) create mode 100644 actions/setup-release-tool/release-tool-version diff --git a/actions/setup-release-tool/release-tool-version b/actions/setup-release-tool/release-tool-version new file mode 100644 index 0000000..8f0916f --- /dev/null +++ b/actions/setup-release-tool/release-tool-version @@ -0,0 +1 @@ +0.5.0 From cff4b2ec73f895ea6f997f41fef53efb8164742f Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Mon, 21 Sep 2026 14:11:12 -0300 Subject: [PATCH 2/7] refactor: centralize release-tool version pin Signed-off-by: Vitor Mattos --- actions/setup-release-tool/action.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/actions/setup-release-tool/action.yml b/actions/setup-release-tool/action.yml index f647ce1..3deaeab 100644 --- a/actions/setup-release-tool/action.yml +++ b/actions/setup-release-tool/action.yml @@ -5,8 +5,9 @@ name: Setup release-tool description: Install an exact LibreCode release-tool PHAR release and verify its published SHA-256. inputs: version: - description: Exact release-tool semantic version, without a leading v. - required: true + description: Optional exact release-tool semantic version override, without a leading v. + required: false + default: '' outputs: path: description: Absolute path to the verified release-tool PHAR. From d3029de638951630e59d3bae92a8815cd354e17a Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Mon, 21 Sep 2026 14:11:16 -0300 Subject: [PATCH 3/7] refactor: centralize release-tool version pin Signed-off-by: Vitor Mattos --- actions/setup-release-tool/setup.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/actions/setup-release-tool/setup.sh b/actions/setup-release-tool/setup.sh index b48c2f5..6d6d619 100644 --- a/actions/setup-release-tool/setup.sh +++ b/actions/setup-release-tool/setup.sh @@ -4,7 +4,11 @@ set -euo pipefail -version="${RELEASE_TOOL_VERSION:?release-tool version is required}" +version="${RELEASE_TOOL_VERSION:-}" +if [[ -z "${version}" ]]; then + version_file="${GITHUB_ACTION_PATH:?github action path is required}/release-tool-version" + version="$(tr -d '[:space:]' < "${version_file}")" +fi if [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then echo "::error::release-tool version must be an exact semantic version, got '${version}'" From c2f17667b7ab5f6dfea2a895b65123c934b6bebd Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Mon, 21 Sep 2026 14:11:20 -0300 Subject: [PATCH 4/7] refactor: centralize release-tool version pin Signed-off-by: Vitor Mattos --- actions/release-plan/action.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/actions/release-plan/action.yml b/actions/release-plan/action.yml index d61f518..2afa86b 100644 --- a/actions/release-plan/action.yml +++ b/actions/release-plan/action.yml @@ -61,8 +61,6 @@ runs: - id: setup name: Setup release-tool uses: $/actions/setup-release-tool - with: - version: '0.2.0' - id: plan name: Build ReleasePlan v1 From 018a5a1d6f1b8c5f8ea7cb369de1c614a50daaeb Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Mon, 21 Sep 2026 14:11:22 -0300 Subject: [PATCH 5/7] refactor: centralize release-tool version pin Signed-off-by: Vitor Mattos --- tests/test_setup_release_tool_action.py | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/tests/test_setup_release_tool_action.py b/tests/test_setup_release_tool_action.py index ba8f0cd..7caf545 100644 --- a/tests/test_setup_release_tool_action.py +++ b/tests/test_setup_release_tool_action.py @@ -10,12 +10,13 @@ ROOT = Path(__file__).resolve().parents[1] SCRIPT = ROOT / "actions" / "setup-release-tool" / "setup.sh" ACTION = ROOT / "actions" / "setup-release-tool" / "action.yml" +VERSION = ROOT / "actions" / "setup-release-tool" / "release-tool-version" class SetupReleaseToolActionTest(unittest.TestCase): def run_script( self, - version: str, + version: str | None, *, fake_download: bool = False, checksum_mismatch: bool = False, @@ -26,12 +27,15 @@ def run_script( output = root / "output" path_file = root / "path" env = os.environ | { - "RELEASE_TOOL_VERSION": version, + "GITHUB_ACTION_PATH": str(SCRIPT.parent), "RUNNER_TEMP": str(root), "GITHUB_OUTPUT": str(output), "GITHUB_PATH": str(path_file), } + if version is not None: + env["RELEASE_TOOL_VERSION"] = version + if fake_download: fake_bin = root / "bin" fake_bin.mkdir() @@ -87,13 +91,21 @@ def run_script( path_file.read_text(encoding="utf-8") if path_file.exists() else "", ) - def test_action_exposes_only_exact_version_input(self) -> None: + def test_action_exposes_optional_exact_version_override(self) -> None: content = ACTION.read_text(encoding="utf-8") self.assertIn("version:", content) - self.assertNotIn("latest", content.lower()) + self.assertIn("required: false", content) + self.assertIn("default: ''", content) self.assertIn("setup.sh", content) + def test_default_version_is_centralized_in_action_directory(self) -> None: + result, output, path_file = self.run_script(None, fake_download=True) + + self.assertEqual(0, result.returncode, result.stderr) + self.assertIn("version=0.5.0", output) + self.assertIn("librecode-release-tool/0.5.0", path_file) + def test_rejects_latest_before_network_access(self) -> None: result, _, _ = self.run_script("latest") @@ -141,6 +153,7 @@ def test_script_downloads_phar_and_published_checksum_from_same_exact_tag(self) self.assertIn("releases/download/v${version}", content) self.assertIn("release-tool.phar.sha256", content) self.assertIn("sha256sum", content) + self.assertEqual("0.5.0", VERSION.read_text(encoding="utf-8").strip()) if __name__ == "__main__": From 5915045457c462e71d01350c6b1761b619a96e9d Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Mon, 21 Sep 2026 14:11:25 -0300 Subject: [PATCH 6/7] refactor: centralize release-tool version pin Signed-off-by: Vitor Mattos --- tests/test_release_plan_action.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_release_plan_action.py b/tests/test_release_plan_action.py index 82264a8..470d53e 100644 --- a/tests/test_release_plan_action.py +++ b/tests/test_release_plan_action.py @@ -14,7 +14,7 @@ def test_action_uses_exact_verified_release_tool(self) -> None: content = ACTION.read_text(encoding="utf-8") self.assertIn("uses: $/actions/setup-release-tool", content) - self.assertIn("version: '0.2.0'", content) + self.assertNotIn("with:\n version:", content) self.assertIn("release:plan", content) self.assertIn("--release-version", content) self.assertNotIn("python3", content) From e51231738bcb0355c154a44fbe2b003eb0084497 Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Mon, 21 Sep 2026 14:13:32 -0300 Subject: [PATCH 7/7] chore: add REUSE metadata for release-tool version pin Signed-off-by: Vitor Mattos --- actions/setup-release-tool/release-tool-version.license | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 actions/setup-release-tool/release-tool-version.license diff --git a/actions/setup-release-tool/release-tool-version.license b/actions/setup-release-tool/release-tool-version.license new file mode 100644 index 0000000..1ce4e0c --- /dev/null +++ b/actions/setup-release-tool/release-tool-version.license @@ -0,0 +1,2 @@ +SPDX-FileCopyrightText: 2026 LibreCode coop and contributors +SPDX-License-Identifier: AGPL-3.0-or-later