fix(release): never publish an empty changelog (commit-based fallback) - #1766
Conversation
…es finds no PRs releases/generate-notes aggregates merged pull requests over the compared tag range. Work landing as direct commits on dev (or through PRs based on dev rather than the release branch) leaves that range with nothing to aggregate, so the body collapsed to the npm line plus a compare link: v2.17.0..v2.18.2 had 0 of 36 commits PR-associated and v2.18.2..v2.19.0 had 2 of 21, and both releases shipped a 169-char stub. The workflow now detects an empty PR delta and renders the commit log instead, categorized by conventional-commit prefix, excluding merge and release-bump commits. The renderer keeps only PR-numbered entries, so the fallback travels on its own --commit-fallback channel and is emitted only when the PR pipeline produced no sections at all.
…adata Audit findings on the first commit: (1) a preview whose notes came from the fallback would carry into a stable release as meaningful, but the PR renderer discards non-PR bullets, collapsing the stable body back to the stub; (2) %an is a free-form git display name, so a contributor named e.g. Abhishek Sharma rendered as a live @abhishek mention, and subjects could inject markdown or a forged unit separator; (3) real merges using the merge: conventional prefix were not treated as plumbing. extractCommitBulletSections carries PR-free bullets through the renderer, sanitizeCommitText neutralizes mentions/markdown/separators, authors render as plain text in a (sha, Name) trailer, non-hex shas are dropped, parseCommitLog splits the author from the right, and merge: joins the plumbing filter. Nine regression tests cover each.
… carried notes Second audit round: (1) U+001F is legal in git author names too, so right-splitting still let author metadata shift the subject; the log is now NUL-delimited (git log -z), which git forbids inside commit content, and records parse as exactly three fields. (2) The workflow gated fallback generation on carried notes as well as the delta, so a stable release carrying commit-based preview notes silently dropped every post-preview direct commit; the guard now depends on this range delta only and the renderer decides whether to emit. (3) The sanitizer escaped by deletion, mangling technical text like Map<K, V> | CLI; metacharacters are now backslash-escaped instead.
…ests Third audit round: concatenating carried and current fallback bodies emitted a duplicate heading when both touched the same category; mergeCommitBulletSections now merges by category with bullet de-duplication. Two converted tests still carried literal \\u001f fixtures, so parseCommitLog returned nothing and they asserted on an empty string; both now use real NUL fields and assert the entry renders.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe release process now generates commit-based fallback notes when generated PR notes lack meaningful categories. The CLI parses and sanitizes eligible commits, renders categorized sections, merges them with carried notes, and integrates the result into the release workflow. ChangesRelease note fallback
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow
participant Git
participant CommitFallbackCLI
participant ReleaseNotesRenderer
ReleaseWorkflow->>Git: Read commits from notes_range_start..GITHUB_SHA
Git-->>ReleaseWorkflow: NUL-delimited commit log
ReleaseWorkflow->>CommitFallbackCLI: Render commit-fallback notes
CommitFallbackCLI-->>ReleaseWorkflow: Categorized fallback notes
ReleaseWorkflow->>ReleaseNotesRenderer: Render carried, generated, and fallback notes
ReleaseNotesRenderer-->>ReleaseWorkflow: Complete release body
Possibly related PRs
Suggested reviewers: ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Deterministic PR hygiene checks passed. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cfee2d2c9a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const renderedAnyPrSection = parts.length > (npmMetadata ? 1 : 0); | ||
| if (!renderedAnyPrSection) { |
There was a problem hiding this comment.
When a stable release carries any preview PR section but its post-preview range contains only direct commits, the Create GitHub release workflow deliberately populates commitFallbackNotes; however, the carried PR makes renderedAnyPrSection true, so this branch discards the current fallback and any carried commit-only preview bullets. The resulting stable notes silently omit all direct changes in that delta. Merge the commit bullets into the existing category output, or only let PR content from the same delta suppress its fallback.
Useful? React with 👍 / 👎.
1 participant
Summary
Release bodies for v2.18.2 and v2.19.0 shipped as a 169-character stub - just the npm line and a compare link. Root cause: the releases/generate-notes API aggregates MERGED PULL REQUESTS over the compared tag range, and recent ranges have almost none, because work lands as direct commits on dev (or through PRs based on dev rather than the release branch). Measured on the live repo: v2.17.0..v2.18.2 = 0 of 36 commits PR-associated, v2.18.2..v2.19.0 = 2 of 21.
This adds a commit-based fallback: when the PR delta yields no categories, the workflow renders the commit log instead, categorized by conventional-commit prefix, excluding merge and release-bump commits. Replaying the real v2.18.2..v2.19.0 range turns the 169-char stub into a 1.8 KB categorized changelog.
Hardening folded in from three adversarial review rounds:
Verification
Checklist
Summary by CodeRabbit