fix(ci): DCO 按提交作者豁免自动化 —— 否则自动发版路径结构上不可用 - #135
Merged
Merged
Conversation
release-please 用 GitHub API 建提交：作者固定是 github-actions[bot]，工作流里设的 GIT_AUTHOR_* 对它无效，所以那条提交**永远不可能**有 Signed-off-by。而分支保护要求 DCO 通过 → RP 开的 release PR 一律合不进去（#115 / #120 / #132 都撞在这，其中 #132 是本轮要发的 2.2.5）。 改法是把豁免按"提交作者"给，而不是按"PR 作者"整条放过： - 豁免名单只有我们自己那两个自动化身份（github-actions[bot] / dependabot[bot] 的 noreply 邮箱） - 人的提交缺签名照样红；**混合 PR 里有 bot 提交也不影响这条**（这是豁免不是后门的关键） - 每次跑都打印"人类提交 N 条 / 机器提交豁免 M 条"，放过了谁要看得见 - 顺手把 SHA 从 ${{ }} 内插改成 env（BASE_SHA/HEAD_SHA），这样测试才能把仓库注进去跑 新增 tests/test_dco_bot_exemption.py：把这段 shell 从 YAML 里抽出来，在一次性 git 仓库上 跑 4 种形状（人无签名→红 / 人有签名→绿 / bot 无签名→绿且记出"豁免 1" / bot+人无签名→仍红）。 4 passed。 Signed-off-by: ReSerendipity <zengyangc@outlook.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
一句话
release-please的提交作者固定是github-actions[bot]（它用 GitHub API 建提交，工作流里设GIT_AUTHOR_*对它无效），所以那条提交永远不可能带Signed-off-by。而分支保护要求 DCO 通过→ RP 开的 release PR 一律合不进去。#115 / #120 / #132 都撞在这；#132 正是本轮要发的 2.2.5。
也就是说：过去这几天我们把 RP 的"能不能开 PR、会不会整份重写文件"都修好了，
但自动发版路径其实一直卡在最后这一步 —— DCO 让它结构性不可用。
改法：豁免按"提交作者"给，不按"PR 作者"整条放过
if: github.actor != 'dependabot[bot]'（整条 PR 级）github-actions[bot]/dependabot[bot]）顺手把
base/headSHA 从${{ }}内插改成env（BASE_SHA/HEAD_SHA）—— 不然这段 shell抽出来没法注入仓库，也就没法测。
测试：证明这是豁免不是后门
新增
tests/test_dco_bot_exemption.py：把那段脚本从 YAML 里抽出来，在一次性 git 仓库上跑 4 种形状 ——4 passed。之后
合这条 → 在 #132 上重跑 DCO → 绿了就合 #132，让 RP 自己打
v2.2.5tag、建 Release、跑
build-release挂资产 —— 那是这条自动路径的第一次完整实跑。