Copilot commented on code in PR #517:
URL: https://github.com/apache/casbin-jcasbin/pull/517#discussion_r3141735842
##########
.github/workflows/source-snapshot.yml:
##########
@@ -0,0 +1,139 @@
+name: Build Source Snapshot
+
+on:
+ workflow_run:
+ workflows:
+ - build
+ types:
+ - completed
+ branches:
+ - master
+ workflow_dispatch:
+
+permissions:
+ contents: write
+
+jobs:
+ build-source-snapshot:
+ if: ${{ github.repository == 'apache/casbin-jcasbin' && (github.event_name
== 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success') }}
+ runs-on: ubuntu-latest
Review Comment:
Snapshot numbering is derived from existing tags (`LAST_SNAPSHOT_NUMBER +
1`). If multiple runs execute concurrently (e.g., several merges close
together), they can compute the same next number and then race to create the
same tag, causing one run to fail. Consider adding a `concurrency` group (and
optionally `cancel-in-progress: false`) to serialize snapshot-release creation
on `master`.
##########
.github/workflows/source-snapshot.yml:
##########
@@ -0,0 +1,139 @@
+name: Build Source Snapshot
+
+on:
+ workflow_run:
+ workflows:
+ - build
+ types:
+ - completed
+ branches:
+ - master
+ workflow_dispatch:
+
+permissions:
+ contents: write
+
+jobs:
+ build-source-snapshot:
+ if: ${{ github.repository == 'apache/casbin-jcasbin' && (github.event_name
== 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success') }}
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
+ ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+
+ - name: Compute snapshot metadata
+ id: snapshot
+ run: |
+ LATEST_RELEASE_TAG="$(
+ git tag --list 'v*' |
+ grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' |
+ sort -V |
+ tail -n 1
+ )"
+
+ if [ -z "${LATEST_RELEASE_TAG}" ]; then
+ BASE_VERSION="0.1.0"
+ else
+ RELEASE_VERSION="${LATEST_RELEASE_TAG#v}"
+ MAJOR="${RELEASE_VERSION%%.*}"
+ REST="${RELEASE_VERSION#*.}"
+ MINOR="${REST%%.*}"
+ NEXT_MINOR="$((MINOR + 1))"
+ BASE_VERSION="${MAJOR}.${NEXT_MINOR}.0"
+ fi
+
+ ESCAPED_BASE_VERSION="${BASE_VERSION//./\\.}"
+ LAST_SNAPSHOT_NUMBER="$(
+ git tag --list "v${BASE_VERSION}-snapshot.*" |
+ sed -nE "s/^v${ESCAPED_BASE_VERSION}-snapshot\\.([0-9]+)$/\\1/p"
|
+ sort -n |
+ tail -n 1
+ )"
+ LAST_SNAPSHOT_NUMBER="${LAST_SNAPSHOT_NUMBER:-0}"
+ NEXT_SNAPSHOT_NUMBER="$((LAST_SNAPSHOT_NUMBER + 1))"
+ SNAPSHOT_VERSION="v${BASE_VERSION}-snapshot.${NEXT_SNAPSHOT_NUMBER}"
+ BASENAME="jcasbin-${SNAPSHOT_VERSION#v}-src"
+
+ echo "latest_release_tag=${LATEST_RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
+ echo "base_version=${BASE_VERSION}" >> "${GITHUB_OUTPUT}"
+ echo "number=${NEXT_SNAPSHOT_NUMBER}" >> "${GITHUB_OUTPUT}"
+ echo "version=${SNAPSHOT_VERSION}" >> "${GITHUB_OUTPUT}"
+ echo "basename=${BASENAME}" >> "${GITHUB_OUTPUT}"
+ if [ -n "${LAST_SNAPSHOT_NUMBER}" ] && [ "${LAST_SNAPSHOT_NUMBER}"
-gt 0 ]; then
+ echo
"previous_tag=v${BASE_VERSION}-snapshot.${LAST_SNAPSHOT_NUMBER}" >>
"${GITHUB_OUTPUT}"
+ else
+ echo "previous_tag=${LATEST_RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
+ fi
+
+ - name: Generate snapshot release notes
+ run: |
+ PREVIOUS_TAG="${{ steps.snapshot.outputs.previous_tag }}"
+ CURRENT_TAG="${{ steps.snapshot.outputs.version }}"
+ CURRENT_VERSION="${CURRENT_TAG#v}"
+ RELEASE_DATE="$(date -u +%F)"
+ RANGE="HEAD"
+
+ if [ -n "${PREVIOUS_TAG}" ]; then
+ RANGE="${PREVIOUS_TAG}..HEAD"
+ fi
+
+ FEATURES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei
'^(feat)(\(.+\))?: ' || true)"
+ FIXES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei
'^(fix)(\(.+\))?: ' || true)"
+ DOCS="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei
'^(docs?|doc)(\(.+\))?: ' || true)"
Review Comment:
The release-notes regexes don’t match Conventional Commits that include
breaking-change markers (e.g. `feat!:` / `fix(scope)!:`). Since
semantic-release previously relied on Conventional Commits, this will cause
some commits to be omitted from snapshot notes. Consider updating the patterns
to allow an optional `!` before the colon.
```suggestion
FEATURES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep
-Ei '^(feat)(\(.+\))?!?: ' || true)"
FIXES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei
'^(fix)(\(.+\))?!?: ' || true)"
DOCS="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei
'^(docs?|doc)(\(.+\))?!?: ' || true)"
```
##########
.github/workflows/maven-snapshot.yml:
##########
@@ -0,0 +1,70 @@
+name: Publish Maven Snapshot
+
+on:
+ workflow_run:
+ workflows:
+ - build
+ types:
+ - completed
+ branches:
+ - master
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+jobs:
+ publish-maven-snapshot:
+ if: ${{ github.repository == 'apache/casbin-jcasbin' && (github.event_name
== 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success') }}
Review Comment:
`workflow_dispatch` can be run from any branch/ref, but the job `if:`
currently allows publishing a snapshot whenever the workflow is manually
dispatched. That makes it easy to accidentally deploy snapshots built from
non-`master` code. Consider tightening the condition to only allow
`workflow_dispatch` when `github.ref == 'refs/heads/master'` (or otherwise
enforce the intended ref).
```suggestion
if: ${{ github.repository == 'apache/casbin-jcasbin' &&
((github.event_name == 'workflow_dispatch' && github.ref ==
'refs/heads/master') || github.event.workflow_run.conclusion == 'success') }}
```
##########
.github/workflows/source-snapshot.yml:
##########
@@ -0,0 +1,139 @@
+name: Build Source Snapshot
+
+on:
+ workflow_run:
+ workflows:
+ - build
+ types:
+ - completed
+ branches:
+ - master
+ workflow_dispatch:
+
+permissions:
+ contents: write
+
+jobs:
+ build-source-snapshot:
+ if: ${{ github.repository == 'apache/casbin-jcasbin' && (github.event_name
== 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success') }}
Review Comment:
`workflow_dispatch` can be run from any branch/ref, but the job `if:`
currently allows creating snapshot tags/releases whenever the workflow is
manually dispatched. This can create prereleases from non-`master` code and
pollute the tag namespace. Consider restricting manual dispatch to `master`
(e.g., by adding a `github.ref` guard in the job `if:`).
```suggestion
if: ${{ github.repository == 'apache/casbin-jcasbin' &&
((github.event_name == 'workflow_dispatch' && github.ref ==
'refs/heads/master') || github.event.workflow_run.conclusion == 'success') }}
```
##########
.github/workflows/source-release-draft.yml:
##########
@@ -0,0 +1,125 @@
+name: Build Source Release Draft
+
+on:
+ push:
+ tags:
+ - "v*"
+
+permissions:
+ contents: write
+
+jobs:
+ build-source-release-draft:
+ if: ${{ github.repository == 'apache/casbin-jcasbin' &&
!contains(github.ref_name, '-') }}
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
+
+ - name: Compute release metadata
+ id: release
+ run: |
+ TAG_NAME="${GITHUB_REF_NAME}"
+ if ! [[ "${TAG_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+ echo "Unsupported release tag: ${TAG_NAME}" >&2
+ exit 1
+ fi
+
+ VERSION="${TAG_NAME#v}"
+ BASENAME="jcasbin-${VERSION}-src"
+ PREVIOUS_TAG="$(
+ git tag --list 'v*' |
+ grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' |
+ sort -V |
+ awk -v current="${TAG_NAME}" '
+ $0 == current {
+ print previous
+ exit
+ }
+ {
+ previous = $0
+ }
+ '
+ )"
+
+ echo "tag=${TAG_NAME}" >> "${GITHUB_OUTPUT}"
+ echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
+ echo "basename=${BASENAME}" >> "${GITHUB_OUTPUT}"
+ echo "previous_tag=${PREVIOUS_TAG}" >> "${GITHUB_OUTPUT}"
+
+ - name: Generate release notes
+ run: |
+ CURRENT_TAG="${{ steps.release.outputs.tag }}"
+ CURRENT_VERSION="${{ steps.release.outputs.version }}"
+ PREVIOUS_TAG="${{ steps.release.outputs.previous_tag }}"
+ RELEASE_DATE="$(date -u +%F)"
+ RANGE="${CURRENT_TAG}"
+
+ if [ -n "${PREVIOUS_TAG}" ]; then
+ RANGE="${PREVIOUS_TAG}..${CURRENT_TAG}"
+ fi
+
+ FEATURES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei
'^(feat)(\(.+\))?: ' || true)"
+ FIXES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei
'^(fix)(\(.+\))?: ' || true)"
+ DOCS="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei
'^(docs?|doc)(\(.+\))?: ' || true)"
Review Comment:
The release-notes regexes don’t match Conventional Commits that include
breaking-change markers (e.g. `feat!:` / `fix(scope)!:`), so those commits
won’t appear in the drafted release notes. Consider updating the patterns to
allow an optional `!` before the colon.
```suggestion
FEATURES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep
-Ei '^(feat)(\(.+\))?!?: ' || true)"
FIXES="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei
'^(fix)(\(.+\))?!?: ' || true)"
DOCS="$(git log --pretty=format:'%s (%h)' "${RANGE}" | grep -Ei
'^(docs?|doc)(\(.+\))?!?: ' || true)"
```
##########
.github/workflows/maven-ci.yml:
##########
@@ -35,19 +30,3 @@ jobs:
uses: codecov/codecov-action@v1
Review Comment:
`codecov/codecov-action@v1` is an older major; consider upgrading to a
currently supported major (and adjusting config if needed) to avoid
deprecation/security issues.
```suggestion
uses: codecov/codecov-action@v4
```
##########
.github/workflows/maven-ci.yml:
##########
@@ -22,11 +22,6 @@ jobs:
uses: actions/setup-java@v1
Review Comment:
`actions/setup-java@v1` is an older major. Consider upgrading to
`actions/setup-java@v4` (it supports Java 8) to avoid deprecations and pick up
security fixes.
```suggestion
uses: actions/setup-java@v4
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
