Open History to see the last commit
1name: Release queue
2on:
3 issue_comment:
4 types: [created]
5 pull_request_target:
6 branches: [main, v4/next-minor, v4/next-major]
7 push:
8 branches: [main, v4/next-minor, v4/next-major]
9
10permissions: {}
11
12jobs:
13 update:
14 name: Update
15 runs-on: ubuntu-latest
16 timeout-minutes: 10
17 permissions:
18 contents: write
19 pull-requests: write
20 steps:
21 - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
22 with:
23 fetch-depth: 0
24 token: ${{ secrets.EFFECT_BOT_GH }}
25 # Non-cone mode excludes root files too. Git preserves this restriction across gh pr checkout.
26 # Keep full checkouts for same-repo PRs, pushes, and comments used by release/rebase paths.
27 - name: Limit fork checkout to changesets
28 if: github.event.pull_request && github.event.pull_request.head.repo.full_name != github.repository
29 run: git sparse-checkout set --no-cone '/.changeset/'
30 # This checks out untrusted fork code with privileged bot credentials available to subsequent steps.
31 # Sparse checkout reduces exposed files; it is not a security boundary.
32 # No step may execute code from the working tree (including installs, builds, or repo scripts).
33 # The pinned release action only reads changeset files on the fork PR path.
34 - run: gh pr checkout ${{ github.event.pull_request.number }}
35 if: github.event.pull_request
36 env:
37 GITHUB_TOKEN: ${{ secrets.EFFECT_BOT_GH }}
38 - uses: Effect-TS/next-release-action@2c03239f3fa0d648a88eb6c5e4f266275f7658a8 # Restore automatic release branch rebasing
39 with:
40 github_token: ${{ secrets.EFFECT_BOT_GH }}
41 base_branch: main
42 eligible_branches: v4/next-minor,v4/next-major
43 git_user: effect-bot
44 git_email: tech-ops@effectful.co