Repository navigation
ci: add sync-plugin-version workflow - #14
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow to create a PR syncing plugin.json’s version with pushed v* tags, intended to reduce manifest/tag drift.
Changes:
- Adds a tag-triggered workflow that checks out
main. - Computes the target version from the tag name.
- Updates
plugin.json, pushes a branch, and opens a sync PR.
Comments suppressed due to low confidence (3)
.github/workflows/sync-plugin-version.yml:46
- The tag-derived output is interpolated directly into this shell assignment, which lets shell metacharacters in a crafted tag name be evaluated during the workflow. Use an environment variable or otherwise quote/escape the event data before using it in
runscripts.
BRANCH="chore/sync-plugin-version-${{ steps.ver.outputs.tag }}"
.github/workflows/sync-plugin-version.yml:51
- This command embeds the tag-derived output directly in a quoted shell argument, so command substitutions or quotes in a crafted tag name can alter the command that runs. Keep the tag in an environment variable (or sanitize it) and pass it as data rather than templating it into the script.
git commit -m "chore: sync plugin.json version to ${{ steps.ver.outputs.tag }}"
.github/workflows/sync-plugin-version.yml:57
- The PR title/body template embeds the tag-derived output directly into the shell script. A crafted tag can break out of the quoted argument or trigger command substitution here; pass the tag via
envor otherwise escape it before constructing thegh pr createarguments.
--title "chore: sync plugin.json version to ${{ steps.ver.outputs.tag }}" \
--body "Triggered by release ${{ steps.ver.outputs.tag }}. Auto-sync to prevent drift. Closes workflow-registry#37."
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+35
to
+36
| p = json.load(open('plugin.json')) | ||
| p['version'] = '$TARGET' |
Comment on lines
+33
to
+39
| python3 -c " | ||
| import json | ||
| p = json.load(open('plugin.json')) | ||
| p['version'] = '$TARGET' | ||
| json.dump(p, open('plugin.json', 'w'), indent=2) | ||
| open('plugin.json', 'a').write('\n') | ||
| " |
Comment on lines
+49
to
+52
| git checkout -b "$BRANCH" | ||
| git add plugin.json | ||
| git commit -m "chore: sync plugin.json version to ${{ steps.ver.outputs.tag }}" | ||
| git push origin "$BRANCH" |
| --base main \ | ||
| --head "$BRANCH" \ | ||
| --title "chore: sync plugin.json version to ${{ steps.ver.outputs.tag }}" \ | ||
| --body "Triggered by release ${{ steps.ver.outputs.tag }}. Auto-sync to prevent drift. Closes workflow-registry#37." |
| run: | | ||
| if [ ! -f plugin.json ]; then echo "no plugin.json; skipping"; exit 0; fi | ||
| CURRENT=$(python3 -c "import json; print(json.load(open('plugin.json')).get('version',''))") | ||
| TARGET="${{ steps.ver.outputs.version }}" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Installs
.github/workflows/sync-plugin-version.ymlwhich auto-bumpsplugin.jsonversion to match the git tag on everyv*tag push. Prevents plugin.json/tag drift. Closes GoCodeAlone/workflow-registry#37.