Pular para conteúdo

AUR-499 - Publishing the suggested version and changelog entry

Status: implemented for the reconstruction. Profile owner: AUR-006. Upstream: AUR-498 (engine), AUR-490 (shared review passes).

Purpose

The review uses the AUR-498 internal/changelog engine over the reviewed commit messages to show the suggested next version and a Markdown changelog entry in the review report and, when publishing, in the pull request's review body. The GitHub Action also exposes the suggested version/entry as outputs so a consumer workflow can read them.

Nothing is tagged, written to CHANGELOG.md, or released by this card. Text from commits and pull requests is untrusted data: it is redacted through the same sink pr_history.go uses, escaped by the engine, bounded, never executed, and never authorizes a publication on its own. Publication stays behind the existing authorization gate.

Configuration

internal/config adds two review settings, both read from the base branch when reviewing a pull request (authoritative like every other review setting):

Setting Values Default Meaning
review.changelog off/absent, on off Publish the suggested version and changelog entry.
review.version [v]major.minor.patch 0.0.0 Current release line the engine bumps from. A published tag is never read (AUR-472/AUR-478 own that decision).

An unrecognized review.changelog value is a parse error, never a silent fallback. --changelog forces the feature on for a single run.

Commit sources (AC-001)

  • --pr reads the pull request title and body (githubclient.GetPullRequestMetadata) plus every page of the pull request's commit messages (githubclient.GetPullRequestCommits), all read-only. The title/body is folded into a synthetic first commit so the engine sees the whole narrative.
  • --base reads the local range base..HEAD through the read-only analyzer (analyzer.Repo.Commits), which uses git log when a git binary is present and a first-parent object walk otherwise.
  • A missing source (no metadata, no commits, an unreadable range, or a base version that does not parse) omits the section, appends a declared limitation to the report, and never crashes the review.

Surfaces (AC-002)

The shared pass buildChangelogSection (cmd/aurumcode/passes.go) redacts every commit field, runs changelog.NextVersion and changelog.Render, and render.ChangelogSection (internal/render) formats the block. Both --pr (published review body) and --base (stdout report) call that one function. The engine's entry is escaped, so a subject like <script>alert(1)</script> renders as &lt;script&gt;... and cannot inject markup.

Action output (AC-003)

action.yml declares a changelog input and version, changelog_bump and changelog outputs. When enabled, the entrypoint passes --changelog and points AURUMCODE_OUTPUT_FILE at a temporary file; the CLI writes the output in GitHub Actions' key=value/heredoc format, and the entrypoint appends it to $GITHUB_OUTPUT (never the deprecated ::set-output). .github/workflows/review.yml mounts that file and re-exports the keys as job outputs.

Trust boundary (AC-004)

Commit and pull request text is data. Every field passes through redaction.Filter.Redact before the engine sees it, so a registered canary in a subject is replaced with the sink marker. An injection-style subject is escaped by the engine and only ever classifies as its Conventional Commit type; it cannot change a rule, a severity, --fail-on, or the publication gate.

Non-goals

Creating a tag or release, writing CHANGELOG.md in the consumer repository, choosing the bump from a published tag, and any new provider.

Validation

tests/acceptance/AUR-499.sh runs four behavioral selectors and three mutations, rejects an unknown selector with exit 64, and reports missing Go as infrastructure (exit 79). Mutations run on a writable staging copy, never the repository.

  • AC-001 PR metadata/commits yield the section; missing metadata omits it with a limitation; --base reads the local range.
  • AC-002 the published body and --base report contain the version and entry, and both paths call the shared pass.
  • AC-003 action.yml declares the outputs and the entrypoint fills $GITHUB_OUTPUT.
  • AC-004 a canary secret is redacted; an injection subject is escaped and does not alter the bump or classification.
  • MUT-001 makes the body append a no-op -> AC-001/AC-002 fail.
  • MUT-002 deletes the Action outputs -> AC-003 fails.
  • MUT-003 echoes the raw subject -> AC-004 fails.