[eliasjpr]

Why this PR carries (MINOR)

Since #8, every push to master has failed the release job at Create Release with already_exists on tag_name (for example run 40490741711). The job keeps computing 1.0.32, and a tag and release v1.0.32 already exist at 7440c2c ("Merge 82f4b14 into c3331ca"). That commit is PR #2's merge ref. It was tagged by a pull_request run before #4 limited the job to pushes, and it is not on master. As a result, nothing merged after it has been released (#3 to #10).

This PR leaves every tag as it is. It carries the (MINOR) marker on purpose, so the next computed version is 1.1.0, which does not collide.

How the version is computed (checked against the action's source)

From paulhatch/semantic-version@v4.0.2 (dist/index.js):

• The last tag is git describe --tags --abbrev=0 --match='v*[0-9.]' HEAD~1. v1.0.32 is not an ancestor of master, so this returns v1.0.31.
• The action scans git log --pretty="%s" <merge-base>..HEAD, which is commit subjects only. search_commit_body is not an input of v4.0.2 and is ignored.
• A (MINOR) in any subject means minor+1 and patch 0, so 1.1.0. short_tags defaults to true, so version_tag is v1.1.
• Bump Shard Version then commits version: 1.1.0 to master. Create Release makes the tag and the "Release v1.1.0" prerelease at github.sha, the pushed commit (commitish defaults to context.sha in actions/create-release). Like every earlier tag, it therefore sits on the commit before the bump.
• No v1.1 tag or release exists yet. The v1 tag (2022) is a different name.

I ran the action's own dist/index.js locally with the workflow's inputs, against this repository's history and tags:

HEAD	computed
master today	1.0.32 / v1.0.32 (reproduces the failure)
merge commit of this PR	1.1.0 / v1.1
squash merge, title kept	1.1.0 / v1.1
rebase merge	1.1.0 / v1.1
squash with the title edited, (MINOR) only in the body	1.0.32 (collides again)
the next push after v1.1	1.1.1 / v1.1.1

A merge commit, rebase or squash all work, provided a squash keeps (MINOR) in its title. A merge commit's own subject ("Merge pull request …") has no marker, but the log includes this branch's first commit, whose subject does. A marker that is only in the body is not detected.

Changes (review nits left from #10)

• src/configuration.cr: the default-secret error and warning said "Set SESSION_SECRET". An assigned secret wins over the variable, so that did nothing when the published value was assigned. They also suggested c.secret = ENV["SESSION_SECRET"], which raises KeyError when the variable is unset. Now they name the actual source: either "remove the secret = assignment" (or assign a random 32+ byte value), or "SESSION_SECRET holds the published default".
• spec/spec_helper.cr: reset_config now resets on_started, on_deleted, on_loaded, on_client and on_regenerated.
• docs/getting-started/quick-start.md: names the stores that encrypt with the secret ("a Redis store with encrypt_redis_data, or CookieStore"), as UPGRADE.md and docs/security/encryption.md do.
• UPGRADE.md: adds a short Releases list of what 1.1.0 contains, because the repo has no changelog. It is written from the merged commits of Keep the current session per request, not per store #2 to Session: a memory store never needs the secret; safer encryptor cache #10.

Verification (Crystal 1.22.1)

• The specs were written first. With master's src and spec_helper.cr, the 4 new examples fail: 3 on the message text and 1 on a leaked callback.
• crystal spec with Redis: 564 examples, 0 failures, 0 pending.
• crystal tool format --check src spec scripts examples is clean.
• scripts/check_docs.cr on README.md, UPGRADE.md and docs/**/*.md: 157 snippets, 0 failed.
• -Dpreview_mt on the configuration, presets, cookie_store, request_isolation and session_handler_error_handling specs: 119 examples, 0 failures.
• ameba on src: 44 findings, the same as master.
• An independent read-only review confirmed the version computation (it ran dist/index.js itself) and found nothing blocking. Its wording nit on the binding bullet is fixed in the second commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HT5gvYGR83U2M4DyA6NA6f

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}