ci: add PR bump preview workflow by bearomorphism · Pull Request #1957 · commitizen-tools/commitizen

bearomorphism · 2026-05-09T07:13:45Z

Description

Adds a GitHub Actions workflow that runs cz bump --dry-run against every incoming pull request and posts (or updates) a sticky comment summarising the would-be version bump and changelog entries. Reviewers can spot unexpected version bumps before merging.

The pattern is also documented in docs/tutorials/github_actions.md so other projects can copy/paste the same workflow.

How it works

Trigger: pull_request_target (matches label_pr.yml) so the workflow has pull-requests: write even for fork PRs. The job only runs cz bump --dry-run, a read-only command, so PR-controlled scripts are not executed.
Setup: Uses commitizen-tools/setup-cz — no language-specific toolchain required.
Dry-run: Captures cz bump --dry-run --yes output and exit status. Exit code 21 (NoneIncrementExit) is treated as "no eligible bump" instead of an error; other non-zero codes are surfaced in the comment.
Sticky comment: A hidden  marker lets peter-evans/create-or-update-comment edit the previous preview in place on every push instead of stacking comments.

Companion changes are being prepared for commitizen-tools/commitizen-action (replaces the draft #102 attempt) and commitizen-tools/setup-cz (examples/) so the same pattern is available to consumers of either action.

Closes#1510

Type of changes

CI/CD related
Documentation update

Steps to Test This Pull Request

The workflow self-tests once it lands on master: open a follow-up PR and confirm a 🔍 Commitizen bump preview comment appears and updates as you push commits.

Expected output

The workflow posts (and replaces on every push) a single sticky comment whose body depends on the dry-run exit code.

cz bump --dry-run --yes succeeds (status 0) — eligible bump:

Rendered comment

🔍 Commitizen bump preview
Merging this PR will produce the following bump:
bump: version 4.15.1 → 4.16.0
tag to create: v4.16.0
increment detected: MINOR

<!-- commitizen-bump-preview -->## 🔍 Commitizen bump preview
Merging this PR will produce the following bump:
```bump: version 4.15.1 → 4.16.0tag to create: v4.16.0increment detected: MINOR```

NoneIncrementExit (status 21) — no eligible commits:

🔍 Commitizen bump preview
No commits in this PR are eligible for a version bump.

Any other non-zero status — error surfaced inside the comment:

🔍 Commitizen bump preview
⚠️cz bump --dry-run exited with status 3:
NoCommitsFoundError

The status-0 example above is the literal output of cz bump --dry-run --yes against the current master of this repository (verified locally).

Checklist

My PR title follows conventional commit style
Documentation updated

Adds a workflow that runs cz bump --dry-run on incoming pull requests and posts (or updates) a sticky comment summarising the would-be version bump and changelog entries. This makes unexpected version bumps visible to reviewers before merging, addressing commitizen-tools#1510. The pattern is documented in docs/tutorials/github_actions.md so other projects can copy/paste the same workflow. Closescommitizen-tools#1510 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

codecov · 2026-05-09T07:14:59Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.23%. Comparing base (4b93a50) to head (52530b0).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@ Coverage Diff @@## master #1957 +/- ##
=======================================
Coverage 98.23% 98.23% =======================================
Files 61 61 Lines 2779 2779 =======================================
Hits 2730 2730 Misses 49 49

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copilot

Pull request overview

Adds a GitHub Actions workflow to comment a “bump preview” on pull requests, and documents the pattern so downstream users can reuse it.

Changes:

Add .github/workflows/pr-bump-preview.yml to run cz bump --dry-run on PRs and post/update a sticky comment.
Document the new PR bump preview workflow in docs/tutorials/github_actions.md.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
docs/tutorials/github_actions.md	Documents a reusable “PR bump preview” workflow and explains how it works.
.github/workflows/pr-bump-preview.yml	New workflow that runs Commitizen in CI for PRs and posts/updates a sticky PR comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Address Copilot review feedback on commitizen-tools#1957: * `cz bump` renders Jinja templates from the working directory whenever `update_changelog_on_bump` is set in config, using a non-sandboxed `FileSystemLoader('.')`. Under `pull_request_target` with a write token, executing those templates against fork-controlled files would risk RCE / token exfiltration. Gate the job to same-repo PRs by comparing `head.repo.full_name` to `base.repo.full_name`. * Set `persist-credentials: false` on `actions/checkout` as defense in depth, so the workflow token is not written to `.git/config`. * Adjust docs to drop the misleading `and changelog entries` claim (the dry-run only shows changelog entries when `update_changelog_on_bump` is enabled), and rewrite the safety explanation to reflect the real threat model. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Mirrors the security fix on commitizen-tools/commitizen#1957: * `cz bump` can render Jinja templates from the working directory when `update_changelog_on_bump` is set in config, using a non-sandboxed loader. Under `pull_request_target` this would let a fork PR execute arbitrary code with a write token, so gate the job to same-repo PRs only (`head.repo == base.repo`). * Add `persist-credentials: false` on `actions/checkout` as defense in depth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

bearomorphism · 2026-05-09T08:55:27Z

Note for reviewers: the duplication across this repo, commitizen-action, and setup-cz is intentional for now. Tracked as a follow-up in #1959 (mirrored at commitizen-tools/setup-cz#20) — once these PRs are merged and we have one or two real bump-preview comments in production, we plan to promote the example into a reusable workflow in setup-cz and shrink the workflows in commitizen + commitizen-action to ~8-line wrappers pinned to a tagged setup-cz release.

Lee-W

love this! adding changelogs might also be a good idea

bearomorphism requested review from Lee-W, noirbizarre and woile as code owners May 9, 2026 07:13

github-actionsBot added pr-status: wait-for-review type: feature A new enhacement proposal labels May 9, 2026

This was referenced May 9, 2026
feat: rework PR bump preview workflow commitizen-tools/commitizen-action#102
Open
feat(examples): add PR bump preview example commitizen-tools/setup-cz#19
Open
Generate expected bump version comment when receiving a new pull request #1510
Open

bearomorphism requested a review from Copilot May 9, 2026 08:29

Copilotstarted reviewing on behalf of bearomorphism May 9, 2026 08:29 View session

bearomorphism marked this pull request as draft May 9, 2026 08:33

CopilotAI reviewed May 9, 2026
View reviewed changes

Comment thread.github/workflows/pr-bump-preview.yml Outdated
Comment thread.github/workflows/pr-bump-preview.yml
Comment threaddocs/tutorials/github_actions.md Outdated
Comment threaddocs/tutorials/github_actions.md

bearomorphism marked this pull request as ready for review May 9, 2026 08:36

This was referenced May 9, 2026
Promote PR bump preview to a reusable workflow in setup-cz #1959
Open
Triage audit: 30 open untriaged non-bug issues (May 2026, follow-up to #1964) #1965
Open

Lee-W approved these changes May 12, 2026
View reviewed changes

Lee-W reviewed May 12, 2026
View reviewed changes

bearomorphism changed the title ~~feat(ci): add PR bump preview workflow~~ci: add PR bump preview workflowMay 19, 2026

bearomorphism merged commit fc263cd into commitizen-tools:masterMay 19, 2026
20 checks passed

bearomorphism mentioned this pull request May 30, 2026
ci: make bump preview comment sticky #2008
Merged
8 tasks

Navigation Menu

Uh oh!

Uh oh!

ci: add PR bump preview workflow - #1957

ci: add PR bump preview workflow#1957
bearomorphism merged 2 commits into
commitizen-tools:masterfrom
bearomorphism:feat/pr-bump-preview

bearomorphism commented May 9, 2026•
edited
Loading

Uh oh!

codecovBot commented May 9, 2026•
edited
Loading

Uh oh!

CopilotAI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bearomorphism commented May 9, 2026•
edited
Loading

Uh oh!

Lee-W left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

bearomorphism commented May 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

How it works

Type of changes

Steps to Test This Pull Request

Expected output

🔍 Commitizen bump preview

🔍 Commitizen bump preview

🔍 Commitizen bump preview

Checklist

Uh oh!

codecovBot commented May 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bearomorphism commented May 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Lee-W left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bearomorphism commented May 9, 2026•
edited
Loading

codecovBot commented May 9, 2026•
edited
Loading

bearomorphism commented May 9, 2026•
edited
Loading