Introduce an option to use the GitHub API to commit changes, for GPG

.changeset/green-dogs-change.md

@@ -0,0 +1,10 @@
+---
+"@changesets/action": major
+---
+
+Start using GitHub API to push tags and commits to repos
+
+Rather than use local git commands to push changes to GitHub,
+this action now uses the GitHub API directly,
+which means that all tags and commits will be attributed to the user whose
+GITHUB_TOKEN is used, and signed.

.changeset/ninety-poems-explode.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": patch
+---
+
+Update to latest version of ghcommit

.changeset/thick-jars-chew.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": minor
+---
+
+Handle custom publish commands more gracefully

package.json

@@ -4,23 +4,23 @@
   "main": "dist/index.js",
   "license": "MIT",
   "devDependencies": {
-    "@changesets/changelog-github": "^0.4.2",
-    "@changesets/cli": "^2.20.0",
-    "@changesets/write": "^0.1.6",
-    "@vercel/ncc": "^0.36.1",
-    "fixturez": "^1.1.0",
-    "prettier": "^2.0.5",
-    "typescript": "^5.0.4",
     "@babel/core": "^7.13.10",
     "@babel/preset-env": "^7.13.10",
     "@babel/preset-typescript": "^7.13.0",
+    "@changesets/changelog-github": "^0.4.2",
+    "@changesets/cli": "^2.20.0",
+    "@changesets/write": "^0.1.6",
     "@types/fs-extra": "^8.0.0",
     "@types/jest": "^29.5.1",
     "@types/node": "^20.11.17",
     "@types/semver": "^7.5.0",
+    "@vercel/ncc": "^0.36.1",
     "babel-jest": "^29.5.0",
+    "fixturez": "^1.1.0",
     "husky": "^3.0.3",
-    "jest": "^29.5.0"
+    "jest": "^29.5.0",
+    "prettier": "^2.0.5",
+    "typescript": "^5.0.4"
   },
   "scripts": {
     "build": "ncc build src/index.ts -o dist --transpile-only --minify",
@@ -41,6 +41,7 @@
     "@changesets/read": "^0.5.3",
     "@manypkg/get-packages": "^1.1.3",
     "@octokit/plugin-throttling": "^5.2.1",
+    "@s0/ghcommit": "^1.2.0",
     "fs-extra": "^8.1.0",
     "mdast-util-to-string": "^1.0.6",
     "remark-parse": "^7.0.1",

src/gitUtils.ts

@@ -11,53 +11,4 @@ export const setupUser = async () => {
     "user.email",
     `"github-actions[bot]@users.noreply.github.com"`,
   ]);
-};
-
-export const pullBranch = async (branch: string) => {
-  await exec("git", ["pull", "origin", branch]);
-};
-
-export const push = async (
-  branch: string,
-  { force }: { force?: boolean } = {}
-) => {
-  await exec(
-    "git",
-    ["push", "origin", `HEAD:${branch}`, force && "--force"].filter<string>(
-      Boolean as any
-    )
-  );
-};
-
-export const pushTags = async () => {
-  await exec("git", ["push", "origin", "--tags"]);
-};
-
-export const switchToMaybeExistingBranch = async (branch: string) => {
-  let { stderr } = await getExecOutput("git", ["checkout", branch], {
-    ignoreReturnCode: true,
-  });
-  let isCreatingBranch = !stderr
-    .toString()
-    .includes(`Switched to a new branch '${branch}'`);
-  if (isCreatingBranch) {
-    await exec("git", ["checkout", "-b", branch]);
-  }
-};
-
-export const reset = async (
-  pathSpec: string,
-  mode: "hard" | "soft" | "mixed" = "hard"
-) => {
-  await exec("git", ["reset", `--${mode}`, pathSpec]);
-};
-
-export const commitAll = async (message: string) => {
-  await exec("git", ["add", "."]);
-  await exec("git", ["commit", "-m", message]);
-};
-
-export const checkIfClean = async (): Promise<boolean> => {
-  const { stdout } = await getExecOutput("git", ["status", "--porcelain"]);
-  return !stdout.length;
-};
+};

src/run.test.ts

@@ -31,6 +31,7 @@ jest.mock("@actions/github/lib/utils", () => ({
     getOctokitOptions: jest.fn(),
 }));
 jest.mock("./gitUtils");
+jest.mock("@s0/ghcommit/git");
 
 let mockedGithubMethods = {
   pulls: {

src/run.ts

@@ -17,6 +17,7 @@ import * as gitUtils from "./gitUtils";
 import readChangesetState from "./readChangesetState";
 import resolveFrom from "resolve-from";
 import { throttling } from "@octokit/plugin-throttling";
+import { commitChangesFromRepo } from "@s0/ghcommit/git";
 
 // GitHub Issues/PRs messages have a max size limit on the
 // message body payload.
@@ -130,8 +131,6 @@ export async function runPublish({
     { cwd }
   );
 
-  await gitUtils.pushTags();
-
   let { packages, tool } = await getPackages(cwd);
   let releasedPackages: Package[] = [];
 
@@ -157,12 +156,24 @@ export async function runPublish({
 
     if (createGithubReleases) {
       await Promise.all(
-        releasedPackages.map((pkg) =>
-          createRelease(octokit, {
-            pkg,
-            tagName: `${pkg.packageJson.name}@${pkg.packageJson.version}`,
-          })
-        )
+        releasedPackages.map(async (pkg) => {
+          const tagName = `${pkg.packageJson.name}@${pkg.packageJson.version}`;
+          // Tag will only be created locally,
+          // Create it using the GitHub API so it's signed.
+          await octokit.rest.git
+            .createRef({
+              ...github.context.repo,
+              ref: `refs/tags/${tagName}`,
+              sha: github.context.sha,
+            })
+            .catch((err) => {
+              // Assuming tag was manually pushed in custom publish script
+              core.warning(`Failed to create tag ${tagName}: ${err.message}`);
+            });
+          if (createGithubReleases) {
+            await createRelease(octokit, { pkg, tagName });
+          }
+        })
       );
     }
   } else {
@@ -180,11 +191,21 @@ export async function runPublish({
 
       if (match) {
         releasedPackages.push(pkg);
-        if (createGithubReleases) {
-          await createRelease(octokit, {
-            pkg,
-            tagName: `v${pkg.packageJson.version}`,
+        const tagName = `v${pkg.packageJson.version}`;
+        // Tag will only be created locally,
+        // Create it using the GitHub API so it's signed.
+        await octokit.rest.git
+          .createRef({
+            ...github.context.repo,
+            ref: `refs/tags/${tagName}`,
+            sha: github.context.sha,
+          })
+          .catch((err) => {
+            // Assuming tag was manually pushed in custom publish script
+            core.warning(`Failed to create tag ${tagName}: ${err.message}`);
           });
+        if (createGithubReleases) {
+          await createRelease(octokit, { pkg, tagName });
         }
         break;
       }
@@ -324,9 +345,6 @@ export async function runVersion({
 
   let { preState } = await readChangesetState(cwd);
 
-  await gitUtils.switchToMaybeExistingBranch(versionBranch);
-  await gitUtils.reset(github.context.sha);
-
   let versionsByDirectory = await getVersionsByDirectory(cwd);
 
   if (script) {
@@ -367,16 +385,20 @@ export async function runVersion({
   );
 
   const finalPrTitle = `${prTitle}${!!preState ? ` (${preState.tag})` : ""}`;
+  const finalCommitMessage = `${commitMessage}${
+    !!preState ? ` (${preState.tag})` : ""
+  }`;
 
-  // project with `commit: true` setting could have already committed files
-  if (!(await gitUtils.checkIfClean())) {
-    const finalCommitMessage = `${commitMessage}${
-      !!preState ? ` (${preState.tag})` : ""
-    }`;
-    await gitUtils.commitAll(finalCommitMessage);
-  }
-
-  await gitUtils.push(versionBranch, { force: true });
+  await commitChangesFromRepo({
+    octokit,
+    ...github.context.repo,
+    branch: versionBranch,
+    message: finalCommitMessage,
+    base: {
+      commit: github.context.sha,
+    },
+    force: true,
+  });
 
   let existingPullRequests = await existingPullRequestsPromise;
   core.info(JSON.stringify(existingPullRequests.data, null, 2));

tsconfig.json

@@ -39,7 +39,7 @@
     // "noFallthroughCasesInSwitch": true,    /* Report errors for fallthrough cases in switch statement. */
 
     /* Module Resolution Options */
-    // "moduleResolution": "node",            /* Specify module resolution strategy: 'node' (Node.js) or 'classic' (TypeScript pre-1.6). */
+    "moduleResolution": "nodenext",               /* Specify module resolution strategy: 'node' (Node.js) or 'classic' (TypeScript pre-1.6). */
     // "baseUrl": "./",                       /* Base directory to resolve non-absolute module names. */
     // "paths": {},                           /* A series of entries which re-map imports to lookup locations relative to the 'baseUrl'. */
     // "rootDirs": [],                        /* List of root folders whose combined content represents the structure of the project at runtime. */