ci: add bump version workflow #267
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Bump Version | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| with: | ||
| fetch-depth: '0' | ||
| - name: Set branch name | ||
| id: extract_branch | ||
| run: echo "::set-output name=branch_name::$(echo ${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}})" | ||
| - name: Bump version and push tag | ||
| id: bump_version | ||
| uses: anothrNick/[email protected] | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }} | ||
| WITH_V: true | ||
| DEFAULT_BUMP: patch | ||
| PRERELEASE: true | ||
| RELEASE_BRANCHES: ${{ steps.extract_branch.outputs.branch_name }} No newline at end of file |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fix the issue, we will add a permissions block at the root of the workflow file. This block will specify the least privileges required for the workflow to function correctly. Based on the workflow's steps, it needs to read repository contents and push tags, which requires contents: write. We will add this block to the top level of the workflow, ensuring it applies to all jobs.
| @@ -2,6 +2,7 @@ | ||
|
|
||
| permissions: | ||
| contents: write | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| bump_version: |
There was a problem hiding this comment.
Pull Request Overview
Adds a new GitHub Actions workflow to bump the project version and push a tag on manual dispatch.
- Introduces a
bump-version.ymlworkflow triggered viaworkflow_dispatch - Extracts the current branch name and uses
github-tag-actionto bump the version - Configures a prerelease bump with a default patch increment
Comments suppressed due to low confidence (1)
.github/workflows/bump-version.yml:16
- The
::set-outputcommand is deprecated. Use the new workflow command file syntax, e.g.:echo "branch_name=$(echo ${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/]}})" >> $GITHUB_OUTPUT.
run: echo "::set-output name=branch_name::$(echo ${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}})"
| @@ -0,0 +1,25 @@ | |||
| name: Bump Version | |||
|
|
|||
There was a problem hiding this comment.
Consider explicitly setting permissions: contents: write at the root or job level to ensure the action has the minimum required scope to push tags.
| permissions: | |
| contents: write |
No description provided.