chore(deps): bump getsentry/craft from 2.18.3 to 2.19.0#5551
Conversation
Bumps [getsentry/craft](https://github.com/getsentry/craft) from 2.18.3 to 2.19.0. - [Release notes](https://github.com/getsentry/craft/releases) - [Changelog](https://github.com/getsentry/craft/blob/master/CHANGELOG.md) - [Commits](getsentry/craft@1c58bfd...c6e2f04) --- updated-dependencies: - dependency-name: getsentry/craft dependency-version: 2.19.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
dependencies
dependabot
bot
requested review from
alwx,
antonis and
lucas-zimerman
as code owners
dependabot
bot
added
dependencies
Semver Impact of This PR⚪ None (no version bump detected) 📋 Changelog PreviewThis is how your changes will appear in the changelog.
🤖 This preview updates automatically when you update the PR. |
1 similar comment
Semver Impact of This PR⚪ None (no version bump detected) 📋 Changelog PreviewThis is how your changes will appear in the changelog.
🤖 This preview updates automatically when you update the PR. |
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
|
|
||
| - name: Prepare release | ||
| uses: getsentry/craft@1c58bfd57bfd6a967b6f3fc92bead2c42ee698ce # v2 | ||
| uses: getsentry/craft@c6e2f04939b6ee67030588afbb5af76b127d8203 # v2 |
There was a problem hiding this comment.
Bug: Upgrading getsentry/craft may break the release process. The craft-pre-release.sh script expects a positional argument that the new version of the action might no longer provide.
Severity: HIGH
Suggested Fix
Verify the invocation signature for preReleaseCommand in the new version of getsentry/craft. If the positional argument is no longer passed, update craft-pre-release.sh to retrieve the version from an environment variable or another source, or modify the script to handle a missing argument gracefully.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: .github/workflows/release.yml#L46
Potential issue: The `release.yml` workflow upgrades the `getsentry/craft` action to a
new version. The release notes for this new version suggest that the `NEW-VERSION`
argument is now optional. The `craft-pre-release.sh` script, which is executed by this
action, expects the version to be passed as the second positional argument (`$2`). The
script also uses `set -u`, which will cause it to exit with an error if an unset
variable is referenced. If the upgraded `craft` action no longer passes this positional
argument, the release script will fail, breaking the release process.
Did we get this right? 👍 / 👎 to inform future reviews.
antonis
left a comment
antonis
left a comment
There was a problem hiding this comment.
LGTM and a test release was 🟢
getsentry/publish#6942
https://github.com/getsentry/sentry-react-native/actions/runs/21130877507/job/60761429025
1 participant
Bumps getsentry/craft from 2.18.3 to 2.19.0.
Release notes
Sourced from getsentry/craft's releases.
Changelog
Sourced from getsentry/craft's changelog.
... (truncated)
Commits
c6e2f04release: 2.19.032c2e8efix(action): Use environment variables for complex inputs (#716)ec24326fix(aws-lambda): Skip layer publication for pre-release versions (#714)86aa29bfix(prepare): Make NEW-VERSION optional and auto-create changelog (#715)15e3969feat(action): emit publish request issue URL as annotation (#708)bca0ad7fix: Don't mention PRs to avoid linking in changelog previews (#712)1e970f4fix(docker): Add image template var and strict template validation (#713)fa3407afix(docker): Add GITHUB_API_TOKEN and x-access-token fallbacks for ghcr.io (#...c216c1ameta: Bump new development versionb6b2fb2Merge branch 'release/2.18.3'Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)