Skip to content

fix(ci): widen the marker check to the filters it guards #279

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
allanbowe merged 3 commits into from
Oct 6, 2026
Merged

fix(ci): widen the marker check to the filters it guards #279

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a00348b
fix(ci): widen the marker check to the filters it guards
sasjs-dev[bot] Oct 5, 2026
052f55e
fix(ci): name the postcss-selector-parser advisory in the toolchain a…
sasjs-dev[bot] Oct 6, 2026
6365758
chore(ci): format the release audit script for the prettier gate
sasjs-dev[bot] Oct 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions .git-hooks/commit-msg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,19 @@ fi
# This is not hypothetical, and it happened here. This repo's #274 carried two
# `chore(ci): ... [skip release]` subjects, so the squashed commit on main was
# filtered out whole, the crypto fix merged, and no version was ever published.
if (echo "$subject" | grep -Eq "\[skip (release|ci)\]") then
echo "${RED}❌ The commit subject contains [skip release] or [skip ci]!"
# Mirrors the upstream filters rather than a subset of them:
# - semantic-release drops any commit matching
# /\[skip\s+release]|\[release\s+skip]/i (lib/definitions/plugins.js), so the
# match is case-insensitive and accepts any run of whitespace
# - GitHub skips the push or pull_request run entirely for [skip ci],
# [ci skip], [no ci], [skip actions] and [actions skip], case-insensitively
# A narrower pattern let "[SKIP RELEASE]" and "[release skip]" through, and both
# still suppressed the release.
if (echo "$subject" | grep -Eqi "\[(skip[[:space:]]+release|release[[:space:]]+skip|skip[[:space:]]+ci|ci[[:space:]]+skip|no[[:space:]]+ci|skip[[:space:]]+actions|actions[[:space:]]+skip)\]") then
echo "${RED}❌ The commit subject carries a skip marker!"
echo "Under squash-merge that suppresses the release for the whole PR, not"
echo "just this commit. Drop the marker - a conventional type is enough:"
echo "just this commit, and [skip ci] stops the workflow running at all."
echo "Drop the marker - a conventional type is enough:"
echo " chore(deps): refresh the lockfile"
exit 1
fi
Expand Down
4 changes: 4 additions & 0 deletions release/audit.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,10 @@ const EXEMPT = new Map([
'GHSA-6j4f-fj2g-mc7p',
'brace-expansion, inside the npm package that @semantic-release/npm bundles.'
],
[
'GHSA-rj75-hqrm-r3gf',
"postcss-selector-parser, inside the npm package that @semantic-release/npm bundles. Affected through 7.1.5. npm ships its own bundled copy, so no resolver change reaches it - 11.21.0 is the last 11.x and @semantic-release/npm requires ^11 - and the eventual fix is that plugin moving to npm 12. Unreachable here: the parser reads this repo's own release config, not the commits being matched."
],
['GHSA-rpw4-54j3-4h4q', 'ip-address, inside the npm package that @semantic-release/npm bundles.'],
['GHSA-2vr4-cq9g-pvrc', 'ip-address, inside the npm package that @semantic-release/npm bundles.'],
['GHSA-j6r3-76f7-8jcv', 'ip-address, inside the npm package that @semantic-release/npm bundles.'],
Expand Down
Loading