GitHub api tag push

.changeset/green-dogs-change.md

@@ -0,0 +1,10 @@
+---
+"@changesets/action": minor
+---
+
+Introduce a new input commitUsingApi that allows pushing tags and commits
+using the GitHub API instead of the git CLI.
+
+When used, this means means that all tags and commits will be attributed
+to the user whose GITHUB_TOKEN is used,
+and also signed using GitHub's internal GPG key.

README.md

@@ -12,6 +12,7 @@ This action for [Changesets](https://github.com/atlassian/changesets) creates a
 - title - The pull request title. Default to `Version Packages`
 - setupGitUser - Sets up the git user for commits as `"github-actions[bot]"`. Default to `true`
 - createGithubReleases - A boolean value to indicate whether to create Github releases after `publish` or not. Default to `true`
+- commitUsingApi - A boolean value to indicate whether to use the GitHub API to push changes or not, so changes are GPG-signed. Default to `false`
 - cwd - Changes node's `process.cwd()` if the project is not located on the root. Default to `process.cwd()`
 
 ### Outputs

action.yml

@@ -28,6 +28,13 @@ inputs:
     description: "A boolean value to indicate whether to create Github releases after `publish` or not"
     required: false
     default: true
+  commitUsingApi:
+    description: >
+      A boolean value to indicate whether to push changes via Github API or not,
+      this will mean all commits and tags are signed using GitHub's GPG key,
+      and attributed to the user or app who owns the GITHUB_TOKEN
+    required: false
+    default: false
   branch:
     description: Sets the branch in which the action will run. Default to `github.ref_name` if not provided
     required: false

package.json

@@ -4,23 +4,23 @@
   "main": "dist/index.js",
   "license": "MIT",
   "devDependencies": {
-    "@changesets/changelog-github": "^0.4.2",
-    "@changesets/cli": "^2.20.0",
-    "@changesets/write": "^0.1.6",
-    "@vercel/ncc": "^0.36.1",
-    "fixturez": "^1.1.0",
-    "prettier": "^2.0.5",
-    "typescript": "^5.0.4",
     "@babel/core": "^7.13.10",
     "@babel/preset-env": "^7.13.10",
     "@babel/preset-typescript": "^7.13.0",
+    "@changesets/changelog-github": "^0.4.2",
+    "@changesets/cli": "^2.20.0",
+    "@changesets/write": "^0.1.6",
     "@types/fs-extra": "^8.0.0",
     "@types/jest": "^29.5.1",
     "@types/node": "^20.11.17",
     "@types/semver": "^7.5.0",
+    "@vercel/ncc": "^0.36.1",
     "babel-jest": "^29.5.0",
+    "fixturez": "^1.1.0",
     "husky": "^3.0.3",
-    "jest": "^29.5.0"
+    "jest": "^29.5.0",
+    "prettier": "^2.0.5",
+    "typescript": "^5.0.4"
   },
   "scripts": {
     "build": "ncc build src/index.ts -o dist --transpile-only --minify",
@@ -41,6 +41,7 @@
     "@changesets/read": "^0.5.3",
     "@manypkg/get-packages": "^1.1.3",
     "@octokit/plugin-throttling": "^5.2.1",
+    "@s0/ghcommit": "^1.2.1",
     "fs-extra": "^8.1.0",
     "mdast-util-to-string": "^1.0.6",
     "remark-parse": "^7.0.1",

src/index.ts

@@ -1,7 +1,15 @@
 import * as core from "@actions/core";
 import fs from "fs-extra";
 import * as gitUtils from "./gitUtils";
-import { runPublish, runVersion } from "./run";
+import {
+  getApiPushStrategy,
+  getApiTaggingStrategy,
+  getCliPushStrategy,
+  getCliTaggingStrategy,
+  runPublish,
+  runVersion,
+  setupOctokit,
+} from "./run";
 import readChangesetState from "./readChangesetState";
 
 const getOptionalInput = (name: string) => core.getInput(name) || undefined;
@@ -27,6 +35,8 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
     await gitUtils.setupUser();
   }
 
+  const commitUsingApi = core.getBooleanInput("commitUsingApi");
+
   core.info("setting GitHub credentials");
   await fs.writeFile(
     `${process.env.HOME}/.netrc`,
@@ -48,7 +58,9 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
 
   switch (true) {
     case !hasChangesets && !hasPublishScript:
-      core.info("No changesets present or were removed by merging release PR. Not publishing because no publish script found.");
+      core.info(
+        "No changesets present or were removed by merging release PR. Not publishing because no publish script found."
+      );
       return;
     case !hasChangesets && hasPublishScript: {
       core.info(
@@ -84,10 +96,16 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
         );
       }
 
+      const octokit = setupOctokit(githubToken);
+      const taggingStrategy = commitUsingApi
+        ? getApiTaggingStrategy(octokit)
+        : getCliTaggingStrategy();
+
       const result = await runPublish({
         script: publishScript,
-        githubToken,
+        octokit,
         createGithubReleases: core.getBooleanInput("createGithubReleases"),
+        taggingStrategy,
       });
 
       if (result.published) {
@@ -102,19 +120,25 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
     case hasChangesets && !hasNonEmptyChangesets:
       core.info("All changesets are empty; not creating PR");
       return;
-    case hasChangesets:
+    case hasChangesets: {
+      const octokit = setupOctokit(githubToken);
+      const gitPushStrategy = commitUsingApi
+        ? getApiPushStrategy(octokit)
+        : getCliPushStrategy();
       const { pullRequestNumber } = await runVersion({
         script: getOptionalInput("version"),
-        githubToken,
+        octokit,
         prTitle: getOptionalInput("title"),
         commitMessage: getOptionalInput("commit"),
         hasPublishScript,
+        gitPushStrategy,
         branch: getOptionalInput("branch"),
       });
 
       core.setOutput("pullRequestNumber", String(pullRequestNumber));
 
       return;
+    }
   }
 })().catch((err) => {
   core.error(err);

src/run.test.ts

@@ -5,7 +5,7 @@ import fs from "fs-extra";
 import path from "path";
 import writeChangeset from "@changesets/write";
 import { Changeset } from "@changesets/types";
-import { runVersion } from "./run";
+import { getCliPushStrategy, runVersion, setupOctokit } from "./run";
 
 jest.mock("@actions/github", () => ({
   context: {
@@ -18,19 +18,20 @@ jest.mock("@actions/github", () => ({
   },
 }));
 jest.mock("@actions/github/lib/utils", () => ({
-    GitHub: {
-        plugin: () => {
-            // function necessary to be used as constructor
-            return function() {
-                return {
-                    rest: mockedGithubMethods,
-                }
-            }
-        },
+  GitHub: {
+    plugin: () => {
+      // function necessary to be used as constructor
+      return function () {
+        return {
+          rest: mockedGithubMethods,
+        };
+      };
     },
-    getOctokitOptions: jest.fn(),
+  },
+  getOctokitOptions: jest.fn(),
 }));
 jest.mock("./gitUtils");
+jest.mock("@s0/ghcommit/git");
 
 let mockedGithubMethods = {
   pulls: {
@@ -89,7 +90,8 @@ describe("version", () => {
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      octokit: setupOctokit("@@GITHUB_TOKEN"),
+      gitPushStrategy: getCliPushStrategy(),
       cwd,
     });
 
@@ -122,7 +124,8 @@ describe("version", () => {
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      octokit: setupOctokit("@@GITHUB_TOKEN"),
+      gitPushStrategy: getCliPushStrategy(),
       cwd,
     });
 
@@ -155,7 +158,8 @@ describe("version", () => {
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      octokit: setupOctokit("@@GITHUB_TOKEN"),
+      gitPushStrategy: getCliPushStrategy(),
       cwd,
     });
 
@@ -208,7 +212,8 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      octokit: setupOctokit("@@GITHUB_TOKEN"),
+      gitPushStrategy: getCliPushStrategy(),
       cwd,
       prBodyMaxCharacters: 1000,
     });
@@ -265,7 +270,8 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      octokit: setupOctokit("@@GITHUB_TOKEN"),
+      gitPushStrategy: getCliPushStrategy(),
       cwd,
       prBodyMaxCharacters: 500,
     });