diff --git a/.github/scripts/dependabot_merge.py b/.github/scripts/dependabot_merge.py index bdc482d..cbc724d 100644 --- a/.github/scripts/dependabot_merge.py +++ b/.github/scripts/dependabot_merge.py @@ -33,6 +33,21 @@ def eligible_commits(commits): return False types = re.findall(r"(?m)^ update-type: (\S+)\s*$", metadata[1]) dependencies = re.findall(r"(?m)^- dependency-name: ", metadata[1]) + + # Requirement-only bumps omit update-type; trust only the signed, + # single-dependency subject with an unambiguous same-major increase. + if not types and len(dependencies) == 1 and "update-type:" not in metadata[1]: + subject = data["message"].splitlines()[0] + bump = re.fullmatch( + r"(?:[\w()/-]+: )?update (\S+) requirement from " + r">=(\d+\.\d+\.\d+) to >=(\d+\.\d+\.\d+)", subject, + re.IGNORECASE) + name = re.search(r"(?m)^- dependency-name: (\S+)\s*$", metadata[1]) + if bump and name and bump[1] == name[1]: + before = tuple(map(int, bump[2].split("."))) + after = tuple(map(int, bump[3].split("."))) + if after > before and after[0] == before[0]: + types = ["version-update:semver-minor"] if not types or len(types) != len(dependencies): return False if any(t not in {"version-update:semver-patch", diff --git a/.github/scripts/test_dependabot_merge.py b/.github/scripts/test_dependabot_merge.py index 728a50b..19f1969 100644 --- a/.github/scripts/test_dependabot_merge.py +++ b/.github/scripts/test_dependabot_merge.py @@ -57,6 +57,24 @@ def test_unknown_update_type(self): "version-update:semver-minor", "unknown") self.assertFalse(eligible_commits([self.commit])) + + def test_signed_requirement_bump_without_update_type(self): + self.commit["commit"]["message"] = ( + "chore: update example requirement from >=7.6.0 to >=7.7.0\n\n" + "---\nupdated-dependencies:\n- dependency-name: example\n" + " dependency-type: direct:production\n...\n") + self.assertTrue(eligible_commits([self.commit])) + original = self.commit["commit"]["message"] + for old, new in [("7.7.0", "8.0.0"), ("7.7.0", "7.5.0"), + ("7.7.0", "7.7.0rc1"), ("update example", "update other"), + (">=7.7.0", "<8"), + ("...\n", " update-type: unknown\n...\n")]: + self.commit["commit"]["message"] = original.replace(old, new) + self.assertFalse(eligible_commits([self.commit]), new) + self.commit["commit"]["message"] = original + self.commit["commit"]["verification"]["verified"] = False + self.assertFalse(eligible_commits([self.commit])) + def test_empty_commits(self): self.assertFalse(eligible_commits([])) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5d05dbb..72ea7dd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -31,13 +31,13 @@ jobs: python-version: ['3.9', '3.10', '3.11', '3.12', '3.13', '3.14'] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # setuptools_scm 依赖 git 标签推导版本号，浅克隆拿不到标签 fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} @@ -70,12 +70,12 @@ jobs: name: 可执行文件构建检查 runs-on: windows-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' @@ -108,7 +108,7 @@ jobs: Stop-Process -Id $proc.Id -Force Write-Host 'exe 启动正常' - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: Awespykit-exe path: dist/Awespykit.exe diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 47c3a4b..0872306 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -26,7 +26,7 @@ jobs: runs-on: ubuntu-latest steps: # Only trusted default-branch code receives the write token. - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.repository.default_branch }} persist-credentials: false diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f312107..9694b7e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -43,13 +43,13 @@ jobs: outputs: version: ${{ steps.actual.outputs.value }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # setuptools_scm 从 git 标签推导版本号，浅克隆拿不到标签 fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' @@ -114,7 +114,7 @@ jobs: /tmp/venv-check/bin/python -m pip install --no-deps dist-python/*.whl /tmp/venv-check/bin/python -c "import importlib.metadata as m; print('metadata ok:', m.version('Awespykit'))" - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: python-dist path: dist-python/* @@ -129,12 +129,12 @@ jobs: outputs: version: ${{ steps.actual.outputs.value }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: # 固定版本：exe 一旦发布出去就该是可复现的， # 换 Python 小版本会改变打包结果与体积。 @@ -222,7 +222,7 @@ jobs: sha256sum Awespykit.exe > Awespykit.exe.sha256 cat Awespykit.exe.sha256 - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: windows-exe path: | @@ -241,10 +241,10 @@ jobs: contents: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: artifacts - name: 整理附件并检查版本一致