Repository navigation
Conversation
Bring the repo onto the release process the other datasync repos use: check-version-bump.yml fails a pull request that changes code without bumping package.json above the latest tag, and back-merge-pr.yml opens the master -> development back-merge pull request after a push to master. Both files are the copies running in datasync-content-store-filesystem. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The version guard skips library source changes and can accept unchanged versions, leaving the main release safeguard ineffective.
Review effort: Balanced
Findings: 7
Open (7)
What changed in this PR
Adds release guardrails for the MongoDB content store’s development → master workflow.
Changes:
- Introduces pull-request version-bump validation.
- Automates
master→developmentback-merge PR creation. - Adds a Talisman checksum exemption for the version-check workflow.
| File | Description |
|---|---|
.talismanrc |
Configures the workflow checksum exemption. |
.github/workflows/check-version-bump.yml |
Detects release-affecting changes and validates versions. |
.github/workflows/back-merge-pr.yml |
Opens back-merge PRs after pushes to master. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
check-version-bump.yml was copied from an app template: it only counted app.js, routes/, views/ and similar as code, so a change under src/ or typings/ never required a bump. It now diffs the PR from its merge base, treats src/, typings/ and package.json as release-affecting, and requires the package.json version to be above the highest v* tag by SemVer precedence instead of the nearest tag compared with sort -V. Back-merge PRs from master are skipped, since they carry code that is already released. back-merge-pr.yml skips when master is already contained in development instead of comparing tip SHAs, which made a manual run after a completed back-merge try to open an empty PR and fail. .talismanrc: the check-version-bump.yml exemption checksum is regenerated for the new content (Talisman flags one of its echo lines as a secret pattern). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Lock file regenerated (fixed 6 on its own: handlebars critical, brace-expansion, browserslist, js-yaml high, baseline-browser-mapping moderate, @babel/core low; all dev-only transitive). Direct upgrades: none Overrides: none .talismanrc: package-lock.json checksum replaced by a filecontent/base64content ignore so the regen does not trip Talisman. Vuln count: snyk 0 → 0, npm audit 13 → 7. Build verified passing. Remaining 7 moderate need majors (jest 30, node-notifier 11) or a cross-major uuid; left for a separate change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Releases here still go
development→masterwithout the two guard-rails the other datasync repos have: nothing checks that a PR bumpspackage.json, and nothing opens the back-merge PR aftermastermoves.Fix
Adds the two workflows exactly as they run in
datasync-content-store-filesystem:check-version-bump.ymlpackage.jsonversion bump, or the version is not above the latest tagback-merge-pr.ymlmastermaster → developmentback-merge PR if none is open.talismanrcgets the checksum exemption forcheck-version-bump.ymlthatdatasync-asset-store-filesystemalready carries — Talisman flags one of itsecholines as a potential secret pattern.Verification
Both files are byte-identical to the copies live in
datasync-content-store-filesystem; YAML parses.