Skip to content

chore(release): use own GH app for releasing#958

Open
jkowalleck wants to merge 14 commits intomainfrom
chore/releases-own-GHapp
Open

chore(release): use own GH app for releasing#958
jkowalleck wants to merge 14 commits intomainfrom
chore/releases-own-GHapp

Conversation

@jkowalleck
Copy link
Copy Markdown
Member

@jkowalleck jkowalleck commented Apr 10, 2026

use own GH app for release processes

AI Tool Disclosure

  • My contribution does not include any AI-generated content
  • My contribution includes AI-generated content, as disclosed below:
    • AI Tools: [e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]
    • LLMs and versions: [e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]
    • Prompts: [Summarize the key prompts or instructions given to the AI tools]

Affirmation

@jkowalleck jkowalleck requested a review from a team as a code owner April 10, 2026 12:17
@read-the-docs-community
Copy link
Copy Markdown

read-the-docs-community bot commented Apr 10, 2026

Documentation build overview

📚 CycloneDX Python Library | 🛠️ Build #32204013 | 📁 Comparing b0db8b5 against latest (d04d043)

  🔍 Preview build  

Show files changed (2 files in total): 📝 2 modified | ➕ 0 added | ➖ 0 deleted
File Status
contributing.html 📝 modified
index.html 📝 modified

@codacy-production
Copy link
Copy Markdown

codacy-production bot commented Apr 10, 2026

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results
Complexity 0
Duplication 0

View in Codacy

🟢 Coverage 100.00% diff coverage · +0.00% coverage variation

Metric Results
Coverage variation +0.00% coverage variation
Diff coverage 100.00% diff coverage (80.00%)

View coverage diff in Codacy

Coverage variation details
Coverable lines Covered lines Coverage
Common ancestor commit (e492b84) Report Missing Report Missing Report Missing
Head commit (b0db8b5) 5950 (+0) 5603 (+0) 94.17% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details
Coverable lines Covered lines Diff coverage
Pull request (#958) 1 1 100.00%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

1 Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.

TIP This summary will be updated as you push new changes. Give us feedback

@jkowalleck jkowalleck force-pushed the chore/releases-own-GHapp branch from 47c34e5 to b97b179 Compare April 10, 2026 12:19
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
@jkowalleck jkowalleck force-pushed the chore/releases-own-GHapp branch from b97b179 to 2964243 Compare April 10, 2026 12:40
semantic-release and others added 13 commits April 10, 2026 12:48
Automatically generated by python-semantic-release
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Automatically generated by python-semantic-release
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Automatically generated by python-semantic-release
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Automatically generated by python-semantic-release
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
@ShuP1
Copy link
Copy Markdown

ShuP1 commented Apr 10, 2026

I was curious to see new releases without changes on main branch, fearing another supply chain attack.
But it seems like the goal is indeed to control this risk 😅
Have fun

@jkowalleck
Copy link
Copy Markdown
Member Author

Exactly.
Goal is to harden release pipelines.

I was using non-latest RC releases without any substancial changes on purpose, to test the new pipeline.
It seams to be working now. :)

# see https://github.com/actions/create-github-app-token
uses: actions/create-github-app-token@v3
with:
# see https://github.com/organizations/CycloneDX/settings/apps/cyclonedx-internal-release-bot
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TODO: update to final link

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TODO: Rollback

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TODO: Rollback

[tool.poetry]
name = "cyclonedx-python-lib"
# !! version is managed by semantic_release
version = "11.7.0"
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TODO: Rollback

commit_parser_options = { parse_squash_commits = true, ignore_merge_commits = true }
commit_author = "semantic-release <semantic-release@bot.local>"
commit_message = "chore(release): {version}\n\nAutomatically generated by python-semantic-release\n\nSigned-off-by: semantic-release <semantic-release@bot.local>"
commit_message = "chore(release): {version}\n\nAutomatically generated by python-semantic-release"
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TODO: add feature to semanti-release to add signoff

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants