pr-bump-preview.yml

name: PR bump preview

on:
  pull_request_target:
    types: [opened, reopened, synchronize, ready_for_review]

permissions:
  contents: read
  pull-requests: write

jobs:
  bump-preview:
    # Skip drafts, and skip fork PRs entirely. `pull_request_target` runs with
    # the base repo's GITHUB_TOKEN (write access to PR comments). `cz bump`
    # can render Jinja templates from the checked-out workspace whenever
    # `update_changelog_on_bump` is set in config, and the renderer is not
    # sandboxed (FileSystemLoader('.')) — running it against fork-controlled
    # files would risk RCE / token exfiltration. Same-repo PRs are written by
    # collaborators who already have push access, so the same risk doesn't
    # apply.
    if: >
      ${{
        github.event.pull_request.draft == false &&
        github.event.pull_request.head.repo.full_name ==
          github.event.pull_request.base.repo.full_name
      }}
    runs-on: ubuntu-latest
    steps:
      - name: Check out PR head
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
          fetch-tags: true
          # Defense in depth: don't write the workflow token to .git/config.
          persist-credentials: false

      - name: Set up Commitizen
        uses: commitizen-tools/setup-cz@main
        with:
          set-git-config: false

      - name: Run cz bump --dry-run
        id: dry-run
        run: |
          set +e
          output="$(cz bump --dry-run --yes 2>&1)"
          status=$?
          set -e
          {
            echo "status=${status}"
            echo "output<<__CZ_BUMP_PREVIEW__"
            printf '%s\n' "${output}"
            echo "__CZ_BUMP_PREVIEW__"
          } >> "$GITHUB_OUTPUT"

      - name: Build comment body
        env:
          STATUS: ${{ steps.dry-run.outputs.status }}
          OUTPUT: ${{ steps.dry-run.outputs.output }}
        run: |
          {
            echo "<!-- commitizen-bump-preview -->"
            echo "## 🔍 Commitizen bump preview"
            echo ""
            case "${STATUS}" in
              0)
                echo "Merging this PR will produce the following bump:"
                echo ""
                echo '```'
                printf '%s\n' "${OUTPUT}"
                echo '```'
                ;;
              21)
                echo "No commits in this PR are eligible for a version bump."
                ;;
              *)
                echo "⚠️ \`cz bump --dry-run\` exited with status \`${STATUS}\`:"
                echo ""
                echo '```'
                printf '%s\n' "${OUTPUT}"
                echo '```'
                ;;
            esac
          } > comment.md

      # Look up an existing preview comment so the next step edits it in
      # place instead of appending a new one on every run.
      # `peter-evans/create-or-update-comment` does not search by body
      # itself -- it only creates new comments, or updates a specific
      # `comment-id`.
      - name: Find existing preview comment
        id: find-comment
        uses: peter-evans/find-comment@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          issue-number: ${{ github.event.pull_request.number }}
          comment-author: "github-actions[bot]"
          body-includes: "<!-- commitizen-bump-preview -->"

      - name: Post or update PR comment
        uses: peter-evans/create-or-update-comment@v5
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # When empty (no prior comment found) a new one is created;
          # otherwise the existing comment is edited in place.
          comment-id: ${{ steps.find-comment.outputs.comment-id }}
          issue-number: ${{ github.event.pull_request.number }}
          body-path: comment.md
          edit-mode: replace