semantic-release VS action-semantic-pull-request

I'm trying to improve the security behind our release process, which uses semantic-release. During this process, it creates a change log which is committed to the repo, publishes a package and a few other things.

Conventional commits specification contains a set of rules for creating an explicit commit history, which makes it easier to write automated tools on top of, for example, semantic release. You can manually follow this convention in your project or use a tool to assist you, such as Commitizen.

When working with JavaScript projects, managing version numbers and commit messages is important for the maintainability of the project. Since 2020 I have been the main developer of Atomic Calendar Revive a highly customisable Home Assistant calendar card, I found maintaining versions and releases to be cumbersome until recently. In this article, I will introduce the commitizen and semantic-release packages for creation or appropriate commit messages and semantic versioning. I will also provide examples of how I am currently using these packages to streamline my release workflow and project maintenance.

To further streamline deployments, I introduced semantic-release. This tool automates commit tagging and tracks changes since the previous version. As a result, deployments now occur only when new tags are present, saving us valuable minutes.

If your projects ar made in javascript and related tools, I'd suggest you to check: semantic-release

Here you go: https://github.com/amannn/action-semantic-pull-request

I am not too familiar with GitLab, to be honest, but: - Commit/PR linting (to be in tandem with semantic versioning) is implemented via third-party GitHub Actions (https://github.com/amannn/action-semantic-pull-request and https://github.com/wagoid/commitlint-github-action), these might be hard to transfer - Blocking egress to mitigate supply chain attacks is performed by step security’s Harden Runner (https://github.com/step-security/harden-runner), you may raise a question there about GitLab support - CodeQL support is GitHub only AFAIK (but you would have to verify it)

There are many great tools to help with automation here, some of them are action-semantic-pull-request to enforce conventional commits and standard version to bump the version and create a changelog according to the conventional commits.

+1 on conventional commits (big fan)

also, +1 on fully paved road approach!

You might want to check out this GitHub Action to enforce PR title matches the spec: https://github.com/amannn/action-semantic-pull-request

amannn/[email protected] - ensures pull request title matches conventional commits specification