Repository: linear-b/gitstream-github-action
Pull request #285: Add create-tag and update-v2-tag scripts; enhance GitHub workflows for versioning and auto-deploy [skip ci]
Author: login: MishaKav
Labels: name: 5 min review
Created: 2025-04-21T12:16:35Z | Merged: 2025-04-21T12:54:51Z


<!--start_gitstream_placeholder-->
### ✨ PR Description
Purpose: This PR automates the version bumping process and introduces an auto-deploy feature for GitStream core updates.

Main changes:
- Added auto-deploy option to bump workflow with "auto-deploy" label
- Created new workflow for automatic tag creation and release on merge
- Added scripts for creating tags and updating v2 tag

_Generated by LinearB AI and added by gitStream._
<sub>AI-generated content may contain inaccuracies. Please verify before using. **[We’d love your feedback!](mailto:product@linearb.io)** 🚀</sub>
<!--end_gitstream_placeholder-->



Diff:
diff --git a/.github/workflows/bump-gitstream-core.yml b/.github/workflows/bump-gitstream-core.yml
index d44592d9..481eb338 100644
--- a/.github/workflows/bump-gitstream-core.yml
+++ b/.github/workflows/bump-gitstream-core.yml
@@ -6,9 +6,9 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Version number (ex. "2.1.20")
+        description: Version number (ex. "2.1.133")
         required: true
-        default: 2.1.20
+        default: 2.1.133
       ticket:
         description: LINBEE-XXXX ticket number
         default: LINBEE-8514
@@ -16,6 +16,12 @@ on:
       description:
         description: Add a description for this version
         required: false
+      auto-deploy:
+        description: Add label "auto-deploy" to PR
+        required: false
+        type: boolean
+        default: true
+
 jobs:
   publish_pr:
     name: Publish PR
@@ -27,6 +33,12 @@ jobs:
         run: |
           echo "VERSION=${{ inputs.version }}" >> "$GITHUB_ENV"
           echo "BRANCH_NAME=${{ inputs.ticket }}-bump-gitstream-core-to-${{ inputs.version }}" >> "$GITHUB_ENV"
+          echo "LABEL_ARG=" >> "$GITHUB_ENV"
+
+      - name: Set auto-deploy label
+        if: inputs.auto-deploy
+        run: |
+          echo "LABEL_ARG=--label auto-deploy" >> "$GITHUB_ENV"
 
       - name: Init npmrc
         run: |
@@ -53,4 +65,4 @@ jobs:
             --title "Bump \`@linearb/gitstream-core\` to \`${{ env.VERSION }}\`" \
             --body-file pr_description.txt \
             --head ${{ env.BRANCH_NAME }} \
-            --reviewer ${{ github.actor }}
+            --reviewer ${{ github.actor }} ${{ env.LABEL_ARG }}
diff --git a/.github/workflows/create-tag-on-merge.yml b/.github/workflows/create-tag-on-merge.yml
new file mode 100644
index 00000000..c18819e1
--- /dev/null
+++ b/.github/workflows/create-tag-on-merge.yml
@@ -0,0 +1,54 @@
+name: Create Tag on merge
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - develop
+    paths:
+      - src/**
+      - dist/**
+      - package*.json
+
+jobs:
+  create-tag:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+
+      - name: Create and push new tag
+        run: npm run create-tag
+
+      - name: Get latest commit
+        id: get-commit
+        run: echo "LAST_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV
+
+      - name: Check for associated pull request and auto-deploy label
+        id: should-deploy
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            const commit_sha = '${{ env.LAST_SHA }}';
+            const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({ commit_sha, owner, repo });
+            if (prs?.length > 0) {
+              const pull_number = prs[0].number;
+              const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number });
+              return pr.labels.some(label => label.name.includes('auto-deploy'));
+            }
+            return false;
+
+      - name: Create GitHub Release & Deploy
+        if: steps.should-deploy.outputs.result == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create $NEW_TAG --generate-notes
+          git checkout $NEW_TAG
+          npm run update-v2-tag
diff --git a/package.json b/package.json
index a8fe22eb..852532f8 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,9 @@
     "lint": "eslint . -c ./.github/linters/.eslintrc.yml",
     "package": "ncc build --minify src/index.ts -o dist --license licenses.txt",
     "test": "jest",
-    "all": "npm run format:write && npm run lint && npm run test && npm run package"
+    "all": "npm run format:write && npm run lint && npm run test && npm run package",
+    "create-tag": "./scripts/tag-version.sh",
+    "update-v2-tag": "git tag v2 -f && git push origin v2 -f"
   },
   "license": "Apache-2.0",
   "dependencies": {
diff --git a/scripts/tag-version.sh b/scripts/tag-version.sh
new file mode 100755
index 00000000..82ee95f4
--- /dev/null
+++ b/scripts/tag-version.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+git fetch --tags
+
+# Get the latest tag
+latest_tag=$(git describe --tags `git rev-list --tags --max-count=1`)
+
+# Check if the latest tag starts with 'v' and remove it
+if [[ $latest_tag == v* ]]; then
+  latest_tag=${latest_tag:1}
+fi
+
+# Split the latest tag into an array
+IFS='.' read -r -a version_parts <<< "$latest_tag"
+
+# Bump the patch version
+new_tag="${version_parts[0]}.${version_parts[1]}.$((version_parts[2] + 1))"
+
+# Create and push the new tag
+git tag $new_tag
+git push origin $new_tag
+echo "new_tag=$new_tag"
+
+echo "new_tag=$new_tag" >> $GITHUB_OUTPUT
+echo "NEW_TAG=$new_tag" >> $GITHUB_ENV
\ No newline at end of file


Reviews:
user: login: orca-security-us[bot]
body: ### Orca Security Scan Summary
| Status  | Check | Issues by priority |   |
| ------- | ----- | ------------------ | - |
| <img width="16" alt="Passed" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/status_v1/passed.png" title="Passed"> Passed | Infrastructure as Code | <img width="12" alt="high" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/high.png" title="High"> 0 &emsp; <img width="12" alt="medium" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/medium.png" title="Medium"> 0 &emsp; <img width="12" alt="low" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/low.png" title="Low"> 0 &emsp; <img width="12" alt="info" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/info.png" title="Info"> 0 | <a href="https://app.orcasecurity.io/shift-left/iac/scan-log/6b13aff0-0fce-44be-9e04-27fb78e6b509" target="_blank">View in Orca</a> |
| <img width="16" alt="Passed" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/status_v1/passed.png" title="Passed"> Passed | SAST | <img width="12" alt="high" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/high.png" title="High"> 0 &emsp; <img width="12" alt="medium" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/medium.png" title="Medium"> 0 &emsp; <img width="12" alt="low" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/low.png" title="Low"> 0 &emsp; <img width="12" alt="info" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/info.png" title="Info"> 0 | <a href="https://app.orcasecurity.io/shift-left/sast/scan-log/e1fa9177-ac01-4ac2-b914-31434517cb10" target="_blank">View in Orca</a> |
| <img width="16" alt="Passed" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/status_v1/passed.png" title="Passed"> Passed | Secrets | <img width="12" alt="high" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/high.png" title="High"> 0 &emsp; <img width="12" alt="medium" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/medium.png" title="Medium"> 0 &emsp; <img width="12" alt="low" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/low.png" title="Low"> 0 &emsp; <img width="12" alt="info" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/info.png" title="Info"> 0 | <a href="https://app.orcasecurity.io/shift-left/file_system_secret_detection/scan-log/fb2e9cb9-5fcf-4a70-b539-5cb2a859a8cf" target="_blank">View in Orca</a> |
| <img width="16" alt="Passed" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/status_v1/passed.png" title="Passed"> Passed | Vulnerabilities | <img width="12" alt="high" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/high.png" title="High"> 0 &emsp; <img width="12" alt="medium" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/medium.png" title="Medium"> 0 &emsp; <img width="12" alt="low" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/low.png" title="Low"> 0 &emsp; <img width="12" alt="info" src="https://raw.githubusercontent.com/orcasecurity/orca-cli/main/resources/images/prcomment/priority/info.png" title="Info"> 0 | <a href="https://app.orcasecurity.io/shift-left/file_system_vulnerabilities/scan-log/b8682de3-9c1d-4c2d-b4ca-04079b6eec3d" target="_blank">View in Orca</a> |
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-21T12:17:14Z
user: login: jit-ci[bot]
body: ❌ **Jit has detected 2 important findings in this PR that you should review.**
_The findings are detailed below as separate comments._
_It’s highly recommended that you fix these security issues before merge._

**Repository Risks:**
- **Database Integration**: Connects to a database, often involving sensitive data that must be securely managed.

**Repository Context:**

```mermaid
graph LR
    GitHub$Repository_U23_linear_U2D_b/gitstream_U2D_github_U2D_action["GitHub Repository<br/>linear-b/gitstream-github-action"]:::GitHub$Repository
    Team_U23_app_U2D_sec["Team<br/>app-sec"]:::Team
    Team_U23_Developers["Team<br/>Developers"]:::Team
    DBIntegration_U23_oracle["DBIntegration<br/>oracle"]:::DBIntegration
    Team_U23_app_U2D_sec -- "Owns" --> GitHub$Repository_U23_linear_U2D_b/gitstream_U2D_github_U2D_action
    Team_U23_Developers -- "Owns" --> GitHub$Repository_U23_linear_U2D_b/gitstream_U2D_github_U2D_action
    GitHub$Repository_U23_linear_U2D_b/gitstream_U2D_github_U2D_action -- "Is accessible to" --> DBIntegration_U23_oracle
```

state: COMMENTED
author_association: NONE
submitted_at: 2025-04-21T12:18:38Z
user: login: gitstream-cm[bot]
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-04-21T12:19:26Z
user: login: MishaKav
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-21T12:21:11Z
user: login: MishaKav
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-21T12:21:15Z
user: login: yeelali14
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-21T12:40:51Z

Review comments:
diff_hunk: @@ -27,6 +33,12 @@ jobs:
         run: |
           echo "VERSION=${{ inputs.version }}" >> "$GITHUB_ENV"
           echo "BRANCH_NAME=${{ inputs.ticket }}-bump-gitstream-core-to-${{ inputs.version }}" >> "$GITHUB_ENV"
+          echo "LABEL_ARG=" >> "$GITHUB_ENV"
+
path: .github/workflows/bump-gitstream-core.yml
user: login: jit-ci[bot]
body: **Security control:** Static Code Analysis Yaml

**Shell Injection In Github Actions**

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

**Severity:** HIGH

[Learn more about this issue](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)

---
<details>
<summary><b>Jit Bot commands and options (e.g., ignore issue)</b></summary>
<br />

You can trigger Jit actions by commenting on this PR review:
- `#jit_ignore_fp` Ignore and mark this specific single instance of finding as “False Positive”
- `#jit_ignore_accept` Ignore and mark this specific single instance of finding as “Accept Risk”
- `#jit_ignore_type_in_file` Ignore any finding of type "Shell Injection in GitHub Actions" in .github/workflows/bump-gitstream-core.yml; future occurrences will also be ignored.
- `#jit_undo_ignore` Undo ignore command
</details>

<!-- 609e02b4-b8fa-4aa8-ab8b-3fd8aa6a57bc -->
created_at: 2025-04-21T12:18:38Z
author_association: NONE
diff_hunk: @@ -53,4 +65,4 @@
             --title "Bump \`@linearb/gitstream-core\` to \`${{ env.VERSION }}\`" \
             --body-file pr_description.txt \
             --head ${{ env.BRANCH_NAME }} \
-            --reviewer ${{ github.actor }}
+            --reviewer ${{ github.actor }} ${{ env.LABEL_ARG }}
path: .github/workflows/bump-gitstream-core.yml
user: login: jit-ci[bot]
body: **Security control:** Static Code Analysis Yaml

**Shell Injection In Github Actions**

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

**Severity:** HIGH

[Learn more about this issue](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)

---
<details>
<summary><b>Jit Bot commands and options (e.g., ignore issue)</b></summary>
<br />

You can trigger Jit actions by commenting on this PR review:
- `#jit_ignore_fp` Ignore and mark this specific single instance of finding as “False Positive”
- `#jit_ignore_accept` Ignore and mark this specific single instance of finding as “Accept Risk”
- `#jit_ignore_type_in_file` Ignore any finding of type "Shell Injection in GitHub Actions" in .github/workflows/bump-gitstream-core.yml; future occurrences will also be ignored.
- `#jit_undo_ignore` Undo ignore command
</details>

<!-- 1e8fd6bc-9d91-482e-8315-ee0905c01f63 -->
created_at: 2025-04-21T12:18:38Z
author_association: NONE
diff_hunk: @@ -27,6 +33,12 @@ jobs:
         run: |
           echo "VERSION=${{ inputs.version }}" >> "$GITHUB_ENV"
           echo "BRANCH_NAME=${{ inputs.ticket }}-bump-gitstream-core-to-${{ inputs.version }}" >> "$GITHUB_ENV"
+          echo "LABEL_ARG=" >> "$GITHUB_ENV"
+
path: .github/workflows/bump-gitstream-core.yml
user: login: MishaKav
body: #jit_ignore_accept
created_at: 2025-04-21T12:21:11Z
author_association: COLLABORATOR
diff_hunk: @@ -53,4 +65,4 @@
             --title "Bump \`@linearb/gitstream-core\` to \`${{ env.VERSION }}\`" \
             --body-file pr_description.txt \
             --head ${{ env.BRANCH_NAME }} \
-            --reviewer ${{ github.actor }}
+            --reviewer ${{ github.actor }} ${{ env.LABEL_ARG }}
path: .github/workflows/bump-gitstream-core.yml
user: login: MishaKav
body: #jit_ignore_accept
created_at: 2025-04-21T12:21:15Z
author_association: COLLABORATOR

PR comments: