release-pr accepts a given version that is not above the current one or is already tagged

Aperta
  • Qualcosa non va?
#130 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
73/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github-actions, typescript
Ambito
devops, release

Direzione di ricerca

Read src/release-pr/index.ts, starting at the forced version handling around lines 38, 81-83, and 139; compare it with the older-version check in self-release. Check how shared and independent package versions are selected and how formatted tags are checked. Done means release-pr rejects versions that are not above the current version or whose tag already exists; add or update tests for those cases.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
Issue description

The version input of release-pr is only checked for valid semver (src/release-pr/index.ts#L139, used as is at L38 and L81-L83). A typo still opens a release PR, and merging it goes wrong:

  • lower and never published: it is published as npm latest (the default pnpm publish tag), so installs get the older line;
  • already on npm: release skips the publish (src/release/index.ts#L65-L68), then hits the existing tag: createTag fails, or createRelease attaches the release to the old tag (#94);
  • tagged but not on npm (npm: false): the same tag problem.

Traced, not run. self-release already refuses to move back to an older version; release-pr doesn't.

Expected: release-pr fails when the given version is not above the current one (shared: the group's highest version; independent: each package's), or when its formatted tag already exists. Related to #94 and #95.

Found by a read-only audit of main at 435a16b (first done at 046494f; no src/ file changed in between), report audits/actions-2026-11-11.md in the workspace repo.

Code sample
const forced = getString("version") && assertVersion(getString("version"));
if (forced) return pkgs.map((pkg) => ({ pkg, version: forced, reason: "given version" }));
Versions
  • @nanoforge-dev/actions 3.3.0 (main at 435a16b)
  • Bun 1.3.14
Issue priority

Low (slightly annoying)

I have tested this issue on a development release

435a16b

Lingua principale
TypeScript
Stelle
0
Fork
0
Merge medio
15h 51m
PR unite (30g)
21

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di NanoForge-dev/actions

Tutte le issue di NanoForge-dev/actions

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.