Skip to content

fix(release): expose documentation pull request merge method #492

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
neilime merged 1 commit into from
Oct 29, 2026
Merged

fix(release): expose documentation pull request merge method #492

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .github/linters/trivy-ignore.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,3 +17,15 @@ vulnerabilities:
brace patterns cannot reach the vulnerable AST walkers through this
action. Reassess when changing Jampack, its CLI arguments, or this
dependency, and remove the exception when a patched release is available.
- id: CVE-2026-93753
paths:
- actions/deploy/jampack/package-lock.json
purls:
- pkg:npm/deepmerge@4.3.1
expired_at: 2026-11-12
statement: >-
Jampack uses deepmerge for defaults and repository-controlled configuration,
not processed HTML or downloaded images. This exception assumes trusted
repository configuration, including its imports and extends. Reassess if
these merge inputs change, and remove when a patched release is available.
Decision and supporting evidence: docs/adr/0001-deepmerge-exception.md.
30 changes: 19 additions & 11 deletions .github/workflows/release-actions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ on:
permissions: {}
jobs:
release-actions:
uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@218a19141dd9c88bd74b0ad28f1facb4c3568fbb # 1.0.0
uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2
permissions:
contents: read
secrets:
Expand All @@ -81,6 +81,12 @@ jobs:
# Update all actions and workflows, regardless of changes.
update-all: false

# Merge strategy for the documentation pull request: `merge`, `rebase`, or `squash`.
# Use `squash` for branches requiring signed commits and enable squash merging in the repository settings.
#
# Default: `rebase`
merge-method: rebase

# List of extra documentation files to update (if any).
documentation-files: ""

Expand All @@ -101,16 +107,18 @@ jobs:

### Workflow Call Inputs

| **Input** | **Description** | **Required** | **Type** | **Default** |
| -------------------------- | ---------------------------------------------------------------------------------- | ------------ | ----------- | ------------------- |
| **`runs-on`** | JSON array of runner(s) to use. | **false** | **string** | `["ubuntu-latest"]` |
| | See <https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job>. | | | |
| **`update-all`** | Update all actions and workflows, regardless of changes. | **false** | **boolean** | `false` |
| **`documentation-files`** | List of extra documentation files to update (if any). | **false** | **string** | - |
| **`extra-badges`** | JSON array of extra badges to include in generated documentation. | **false** | **string** | - |
| | Each badge should have `label`, `url`, and optional `linkUrl` properties. | | | |
| **`github-app-client-id`** | GitHub App Client ID to generate GitHub token in place of github-token. | **false** | **string** | - |
| | See <https://github.com/actions/create-github-app-token>. | | | |
| **Input** | **Description** | **Required** | **Type** | **Default** |
| -------------------------- | -------------------------------------------------------------------------------------------------------- | ------------ | ----------- | ------------------- |
| **`runs-on`** | JSON array of runner(s) to use. | **false** | **string** | `["ubuntu-latest"]` |
| | See <https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job>. | | | |
| **`update-all`** | Update all actions and workflows, regardless of changes. | **false** | **boolean** | `false` |
| **`merge-method`** | Merge strategy for the documentation pull request: `merge`, `rebase`, or `squash`. | **false** | **string** | `rebase` |
| | Use `squash` for branches requiring signed commits and enable squash merging in the repository settings. | | | |
| **`documentation-files`** | List of extra documentation files to update (if any). | **false** | **string** | - |
| **`extra-badges`** | JSON array of extra badges to include in generated documentation. | **false** | **string** | - |
| | Each badge should have `label`, `url`, and optional `linkUrl` properties. | | | |
| **`github-app-client-id`** | GitHub App Client ID to generate GitHub token in place of github-token. | **false** | **string** | - |
| | See <https://github.com/actions/create-github-app-token>. | | | |

<!-- inputs:end -->

Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/release-actions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,13 @@ on:
required: false
default: false
type: boolean
merge-method:
description: |
Merge strategy for the documentation pull request: `merge`, `rebase`, or `squash`.
Use `squash` for branches requiring signed commits and enable squash merging in the repository settings.
required: false
default: rebase
type: string
documentation-files:
description: "List of extra documentation files to update (if any)."
required: false
Expand Down Expand Up @@ -335,6 +342,7 @@ jobs:
with:
github-token: ${{ steps.generate-token.outputs.token || secrets.github-token || github.token }} # zizmor: ignore[secrets-outside-env] reusable workflow token override is intentional
branch: docs/actions-workflows-documentation-update
merge-method: ${{ inputs.merge-method }}
title: "docs: update actions and workflows documentation"
body: Update actions and workflows documentation
commit-message: |
Expand Down
36 changes: 18 additions & 18 deletions actions/release/summarize-changelog/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions actions/release/summarize-changelog/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,9 @@
"dependencies": {
"@langchain/anthropic": "1.6.0",
"@langchain/google-genai": "2.3.4",
"@langchain/openai": "1.7.0",
"@langchain/openai": "1.8.0",
"html-to-text": "^10.0.1",
"langchain": "1.5.19"
"langchain": "1.6.0"
},
"engines": {
"node": ">=24.0.0"
Expand Down
Loading