danger-pr-comment 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bed333a43c4c6883fbeea22eb24a5b1e7f92a3232fc446dfe0103b044c7b7579
-  data.tar.gz: 10e13269a7c517aa0f6539c728f5e6428960e1200e2577f4e58bdfa049f76d08
+  metadata.gz: ac924e732e1c8df10638ac0e603fd82deacd4f0a3f190c40147908bd07fcb9ab
+  data.tar.gz: 8fe5fdadc336e663248022ea2a5ad150bb7101ed4d9b5a5f24ef8fbed0278509
 SHA512:
-  metadata.gz: bf4f9f6a348f7ab8bcd42f5827a9c018e4a75fa12f3606613363bb6dfbc1983f9d8e9a1b4db36a06ece3f1bd4d5b232acf867d6f01699a31f7e56358cfa558a5
-  data.tar.gz: 15634bc538e51a3c634839bc36efb31fd5f37c960e7e97cc8c353ca7a55d1fdb5b52b04eb2048326303e27a573eff34dcf10578715e9a2b31b278acf6ddd53f9
+  metadata.gz: 7a4a9505d2a5659cc08cc7ec60d8a6d5383b539915b041057199c299bbe17bf43a052d83300ebeb88499b72789ec934d36519974a103cedf3b23e6c9e177a029
+  data.tar.gz: 4c7615bebc46bb91024bd78b628bade8a919247817462ba4ff1a207260fe45f335cfe34fac5a58626ef0c0a70c10a77ffaf377751045fe5a7e49481c61e5c7d3

data/README.md

@@ -1,9 +1,57 @@
 # Danger PR Comment
 
+[![Test](https://github.com/numbata/danger-pr-comment/actions/workflows/test.yml/badge.svg)](https://github.com/numbata/danger-pr-comment/actions/workflows/test.yml)
+
 Reusable GitHub Actions workflows for running Danger and posting a PR comment from a JSON report.
 
+## Table of Contents
+
+- [Usage](#usage)
+  - [Prerequisites](#prerequisites)
+  - [Quick Install](#quick-install)
+  - [Manual Setup](#manual-setup)
+- [Implementation Details](#implementation-details)
+  - [JSON Report Output](#json-report-output)
+    - [Shared Dangerfile](#shared-dangerfile)
+    - [Custom at_exit Hook](#custom-at_exit-hook)
+  - [Permissions](#permissions)
+  - [Inputs](#inputs)
+    - [danger-run.yml](#danger-runyml)
+    - [danger-comment.yml](#danger-commentyml)
+- [License](#license)
+
 ## Usage
 
+### Prerequisites
+
+Setup [Danger](https://github.com/danger/danger) in your repository.
+
+For example, the following `Gemfile` and `Dangerfile` install danger with the [danger-changelog plugin](https://github.com/dblock/danger-changelog).
+
+```ruby
+group :development, :test do
+  gem 'danger'
+  gem 'danger-changelog'
+  gem 'danger-pr-comment', require: false
+end
+```
+
+```
+# frozen_string_literal: true
+
+danger.import_dangerfile(gem: 'danger-pr-comment')
+
+changelog.check!
+```
+
+Run `bundle install` and `bundle exec danger` to make sure it works.
+
+```bash
+bundle exec danger
+
+Could not find the type of CI for Danger to run on.
+```
+
 ### Quick Install
 
 From your repository root:
@@ -12,7 +60,13 @@ From your repository root:
 curl -fsSL https://raw.githubusercontent.com/numbata/danger-pr-comment/main/scripts/install-workflows.sh | bash
 ```
 
-Use `--force` to overwrite existing workflow files. To target a specific directory:
+Use `--force` to overwrite existing workflow files `.github/workflows/danger.yml` and `.github/workflows/danger-comment.yml`: 
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/numbata/danger-pr-comment/main/scripts/install-workflows.sh | bash -s -- --force
+```
+
+To target a specific directory:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/numbata/danger-pr-comment/main/scripts/install-workflows.sh | bash -s -- --root /path/to/repo
@@ -30,8 +84,11 @@ on:
 
 jobs:
   danger:
-    uses: numbata/danger-pr-comment/.github/workflows/danger-run.yml@main
+    uses: numbata/danger-pr-comment/.github/workflows/danger-run.yml@v0.1.1
     secrets: inherit
+    with:
+      ruby-version: '3.4'
+      bundler-cache: true
 ```
 
 Create `.github/workflows/danger-comment.yml` in your repository:
@@ -43,34 +100,35 @@ on:
     workflows: [Danger]
     types: [completed]
 
+permissions:
+  actions: read        # download artifacts
+  issues: write        # list + create/update comments
+  pull-requests: write # PR comment access
+
 jobs:
   comment:
-    uses: numbata/danger-pr-comment/.github/workflows/danger-comment.yml@main
+    uses: numbata/danger-pr-comment/.github/workflows/danger-comment.yml@v0.1.1
     secrets: inherit
 ```
 
-## Requirements
+## Implementation Details
 
-- Your repository must run `bundle exec danger` successfully.
-- Your Dangerfile must write a JSON report to `ENV['DANGER_REPORT_PATH']` (for example, via a custom `at_exit` hook or a shared Dangerfile).
-- The `Danger Comment` workflow needs `actions: read` and `issues: write` permissions to download artifacts and post comments.
+Using danger-pr-comment solves the problem of needing special permissions to post a PR comment from contributions from forks. This is implemented by producing a JSON report during the PR, and reading the report in a separate workflow.
 
-### Dangerfile report example
+### JSON Report Output
 
-If you want a shared Dangerfile, add the gem and import it:
+Your Dangerfile must write a JSON report to `ENV['DANGER_REPORT_PATH']`.
 
-```ruby
-# Gemfile
-gem 'danger-pr-comment', require: false
-```
+#### Shared Dangerfile
 
 ```ruby
-# Dangerfile
-# Import danger-pr-comment for automatic danger report export
+# Import danger-pr-comment for automatic danger report export to JSON
 danger.import_dangerfile(gem: 'danger-pr-comment')
 ```
 
-Or add this to your project's `Dangerfile` (or a shared Dangerfile) to emit the JSON report yourself:
+See [Dangerfile](Dangerfile) for implementation details.
+
+#### Custom `at_exit` Hook
 
 ```ruby
 # Dangerfile
@@ -106,9 +164,13 @@ at_exit do
 end
 ```
 
-## Inputs
+### Permissions
+
+The `Danger Comment` workflow requires explicit permissions. Reusable workflows cannot grant permissions to their callers. Required: `actions: read` (download artifacts from the Danger run), `issues: write` and `pull-requests: write` (create/update PR comments).
+
+### Inputs
 
-`danger-run.yml` inputs:
+#### `danger-run.yml`
 
 - `ruby-version`: Ruby version for `ruby/setup-ruby`. Leave empty to use `.ruby-version`/`.tool-versions`.
 - `bundler-cache`: Enable Bundler caching (default `true`).
@@ -116,7 +178,7 @@ end
 - `report-artifact-name`: Artifact name for the report (default `danger-report`).
 - `report-file`: Report filename (default `danger-report.json`).
 
-`danger-comment.yml` inputs:
+#### `danger-comment.yml`
 
 - `report-artifact-name`: Artifact name to download (default `danger-report`).
 - `report-file`: Report filename inside the artifact (default `danger-report.json`).

data/lib/danger-pr-comment/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DangerPrComment
-  VERSION = '0.1.0'
+  VERSION = '0.1.1'
 end

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: danger-pr-comment
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Andrei Subbota
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-10-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: danger
@@ -40,7 +41,9 @@ files:
 homepage: https://github.com/numbata/danger-pr-comment
 licenses:
 - MIT
-metadata: {}
+metadata:
+  rubygems_mfa_required: 'true'
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -55,7 +58,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.8
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
 summary: Reusable workflows and shared Dangerfile for PR comment reporting.
 test_files: []