Repository navigation
chore(deps): update dependency chrome-for-testing to v157 #4205
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Changeset check | |
| # Advisory, NON-BLOCKING safety net for the changesets-only release model. clauster | |
| # releases are driven entirely by `.changeset/*.md` fragments (knope.toml, | |
| # ignore_conventional_commits) — a user-facing change with no fragment ships with | |
| # no changelog entry AND no version bump. This check nudges (a sticky PR comment + | |
| # a warning annotation) when a PR touches src/ without a changeset. It is NOT a | |
| # required check and never fails the job, so it can't block a merge; it only | |
| # reminds. Opt out per-PR with the `no-changelog` label (CI / refactor / tests). | |
| on: | |
| pull_request: | |
| # `labeled`/`unlabeled` so toggling `no-changelog` re-evaluates the advisory | |
| # immediately; `ready_for_review` so the job fires on the draft → ready flip | |
| # (the job itself skips while the PR is a draft). | |
| types: [opened, synchronize, reopened, labeled, unlabeled, ready_for_review] | |
| # No token needed at the workflow level; the single job grants itself the minimum. | |
| permissions: {} | |
| concurrency: | |
| group: changeset-check-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| changeset: | |
| name: Changeset advisory | |
| permissions: | |
| contents: read | |
| pull-requests: write # post/update the advisory sticky comment | |
| # Same-repo PRs only (fork PRs get a read-only token and can't comment), and | |
| # never on knope's own release PR (it deletes changesets as it prepares). | |
| # Runs on drafts too: a cheap App-token advisory comment, no SARIF — only the | |
| # heavy / SARIF jobs skip drafts (see tests/test_workflow_draft_guard.py). | |
| if: >- | |
| ${{ github.event.pull_request.head.repo.full_name == github.repository | |
| && github.head_ref != 'release' }} | |
| runs-on: ubuntu-slim | |
| timeout-minutes: 5 | |
| steps: | |
| # Mint a clauster-ci App token (≥5,000 REST req/hr) so this check's GitHub | |
| # API calls (pulls.listFiles + issues.listComments + create/update comment, | |
| # which run on every PR synchronize) draw on the App pool instead of the | |
| # 1,000/hr github-actions[bot] pool. Under a multi-PR update storm | |
| # (pr-auto-update fans a main push out across every open PR, each emitting a | |
| # synchronize) those per-PR calls add up fast and helped exhaust the pool. | |
| # The job's `if:` already gates same-repo, so the App secrets are always | |
| # present here; the `|| secrets.GITHUB_TOKEN` fallback is kept for parity | |
| # with the other minting workflows. | |
| - name: Mint GitHub App token | |
| id: app-token | |
| # Advisory, non-blocking job: soft-fail the mint so a transient App error | |
| # (key rotation, permission change, API blip) degrades to the GITHUB_TOKEN | |
| # fallback on the github-script step below, rather than redding a check that | |
| # documents itself as never blocking a merge. (repo-config-drift's mint does | |
| # the same.) A failed step yields empty outputs, so `||` selects GITHUB_TOKEN. | |
| continue-on-error: true | |
| uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 | |
| with: | |
| client-id: ${{ secrets.CLAUSTER_CI_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.CLAUSTER_CI_APP_PRIVATE_KEY }} | |
| permission-contents: read | |
| permission-pull-requests: write | |
| - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| github-token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }} | |
| script: | | |
| const { owner, repo } = context.repo; | |
| const pr = context.payload.pull_request; | |
| const marker = '<!-- changeset-check -->'; | |
| try { | |
| const labels = (pr.labels || []).map(l => l.name); | |
| // `no-changelog` is the manual opt-out (CI / refactor / tests). The | |
| // `dependencies` label — which Renovate's base preset stamps on every | |
| // dep-bump PR — opts those out too: clauster is changesets-only and | |
| // Renovate can't author a fragment, so a dep bump ships with no changelog | |
| // entry by design and rides the next release. Nagging it is pure noise. | |
| if (labels.includes('no-changelog') || labels.includes('dependencies')) { | |
| core.info('no-changelog/dependencies label set; skipping.'); | |
| return; | |
| } | |
| const files = await github.paginate(github.rest.pulls.listFiles, { | |
| owner, repo, pull_number: pr.number, per_page: 100, | |
| }); | |
| const hasChangeset = files.some(f => /^\.changeset\/.+\.md$/.test(f.filename)); | |
| const touchesSrc = files.some(f => f.filename.startsWith('src/')); | |
| const comments = await github.paginate(github.rest.issues.listComments, { | |
| owner, repo, issue_number: pr.number, per_page: 100, | |
| }); | |
| const existing = comments.find(c => (c.body || '').includes(marker)); | |
| if (touchesSrc && !hasChangeset) { | |
| const body = [ | |
| marker, | |
| '⚠️ **No changeset found.** This PR changes `src/` but adds no `.changeset/*.md` fragment.', | |
| '', | |
| 'clauster releases are changesets-only: a user-facing change needs a fragment, or it ships with', | |
| '**no changelog entry and no version bump**. Add one — run `knope document-change`, or commit a', | |
| '`.changeset/<slug>.md` with front-matter `default: patch|minor|major|perf|security|build`', | |
| 'and a one-line summary. Internal-only PRs (CI, refactor, tests) can add the', | |
| '**`no-changelog`** label instead.', | |
| '', | |
| '_Advisory only — this check never blocks the merge._', | |
| ].join('\n'); | |
| if (existing) { | |
| await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body }); | |
| } else { | |
| await github.rest.issues.createComment({ owner, repo, issue_number: pr.number, body }); | |
| } | |
| core.warning('PR changes src/ without a changeset — add one or apply the no-changelog label.'); | |
| } else if (existing) { | |
| await github.rest.issues.updateComment({ | |
| owner, repo, comment_id: existing.id, | |
| body: `${marker}\n✅ Changeset present (or no \`src/\` change) — thanks!`, | |
| }); | |
| } | |
| } catch (err) { | |
| // Advisory check: never fail the job on a comment/API hiccup. | |
| core.warning(`changeset check skipped: ${err.message}`); | |
| } |