@opengsd/gsd-core 1.20.0 → 1.21.0

package/scripts/release-notes/discord-release-summary.cjs

@@ -11,6 +11,8 @@ const DEFAULT_MAX_CONTENT = 1850;
 const SECTION_LIMITS = Object.freeze([
   ['Breaking', 4],
   ['Security', 4],
+  ['Removed', 3],
+  ['Deprecated', 3],
   ['Feature', 4],
   ['Fix', 4],
   ['Enhancement', 3],
@@ -49,6 +51,14 @@ function normalizeHeading(value) {
 
   if (lower.includes('breaking')) return 'Breaking';
   if (lower.includes('security')) return 'Security';
+  // Keep-a-Changelog headings (#5922): the release body is built from the
+  // CHANGELOG section, whose subsections use these names.
+  if (lower === 'added') return 'Feature';
+  if (lower === 'fixed') return 'Fix';
+  if (lower === 'changed') return 'Enhancement';
+  if (lower === 'deprecated') return 'Deprecated';
+  // Note: an old-format body with a `## Removed` heading now buckets under Removed (#5922).
+  if (lower === 'removed') return 'Removed';
   if (lower === 'feature' || lower === 'features') return 'Feature';
   if (lower === 'fix' || lower === 'fixes' || lower === 'bug fixes') return 'Fix';
   if (lower === 'enhancement' || lower === 'enhancements' || lower === 'improvements') return 'Enhancement';
@@ -58,11 +68,21 @@ function normalizeHeading(value) {
   return heading;
 }
 
+// A body built from a CHANGELOG section (#5922) carries Keep-a-Changelog
+// subsection headings. GitHub-generated and formatter output never does, so
+// its bullets keep the original (unchanged) handling.
+const CHANGELOG_HEADING_RE = /^###\s+(?:Added|Changed|Deprecated|Removed|Fixed|Security)\s*$/m;
+
 function collectSections(body) {
+  const text = normalizeNewlines(body);
+  return CHANGELOG_HEADING_RE.test(text) ? collectChangelogSections(text) : collectLegacySections(text);
+}
+
+function collectLegacySections(text) {
   const sections = new Map();
   let current = null;
 
-  for (const line of normalizeNewlines(body).split('\n')) {
+  for (const line of text.split('\n')) {
     const trimmed = line.trim();
     const heading = trimmed.match(/^#{2,3}\s+(.+)$/);
 
@@ -86,6 +106,67 @@ function collectSections(body) {
   return sections;
 }
 
+function collectChangelogSections(text) {
+  const sections = new Map();
+  let current = null;
+  // Bullet in flight: CHANGELOG bullets wrap onto indented continuation lines
+  // that carry the trailing (#issue) (#pr) references.
+  let pending = null;
+
+  function flush() {
+    if (!pending) return;
+    if (!sections.has(pending.section)) sections.set(pending.section, []);
+    sections.get(pending.section).push(summarizeChangelogBullet(pending.text) || cleanBullet(pending.text));
+    pending = null;
+  }
+
+  for (const line of text.split('\n')) {
+    const trimmed = line.trim();
+    const heading = trimmed.match(/^#{2,3}\s+(.+)$/);
+
+    if (heading) {
+      flush();
+      current = normalizeHeading(heading[1]);
+      continue;
+    }
+
+    // Indented bullets are nested detail of a CHANGELOG bullet, not entries.
+    if (/^\s+[*-]\s/.test(line)) {
+      flush();
+      continue;
+    }
+
+    const bullet = trimmed.match(/^([*-])\s+(.+)$/);
+    if (!bullet || !current) {
+      if (pending && /^\s+\S/.test(line)) pending.text += ` ${trimmed}`;
+      else flush();
+      continue;
+    }
+
+    flush();
+    const section = current === "What's Changed" ? classifyTitle(trimmed) : current;
+    pending = { section, text: trimmed };
+  }
+  flush();
+
+  return sections;
+}
+
+/**
+ * CHANGELOG bullets read `- **Headline** — long explanation (#issue) (#pr)`.
+ * The bold headline is the user-visible summary; keep it and the trailing
+ * issue/PR references. Returns null for any other bullet shape.
+ * @param {string} bulletLine
+ * @returns {string|null}
+ */
+function summarizeChangelogBullet(bulletLine) {
+  const m = bulletLine.match(/^[*-]\s+\*\*(.+?)\*\*\s+[—–-]\s/);
+  if (!m) return null;
+  const refs = bulletLine.match(/(?:\s\(#\d+\))+\s*$/);
+  const headline = cleanBullet(`- ${m[1]}`);
+  return refs ? `${headline}${refs[0].replace(/\s+/g, ' ').replace(/\s+$/, '')}` : headline;
+}
+
 function cleanBullet(value) {
   let text = String(value)
     .replace(/^[*-]\s+/, '')

package/scripts/release-pipeline-pr.cjs

@@ -0,0 +1,92 @@
+'use strict';
+
+/**
+ * The release pipeline's own back-merge PRs (#5890).
+ *
+ * The pipeline opens three kinds of PR, and none of them has an issue to link:
+ *
+ *   kind                    head branch                         base   opened by
+ *   release-merge           release/X.Y.0 | hotfix/X.Y.Z (Z>0)  main   release.yml "merge release back to main"
+ *   next-version-sync       chore/sync-next-version-<version>   next   scripts/sync-next-version.cjs
+ *   main-to-next-backmerge  chore/backmerge-main-to-next-<sha>  next   auto-backmerge.yml (#1389)
+ *
+ * Callers, each with its trust model:
+ *
+ *   - scripts/require-issue-link-policy.cjs (`Issue link required`) and
+ *     .github/workflows/pr-title-validator.yml (`validate-title`) run on
+ *     pull_request_target and load this module from a BASE-branch checkout,
+ *     so a PR cannot edit the predicate that judges it.
+ *   - scripts/changeset/lint.cjs (changeset-lint, #5903) runs on pull_request
+ *     and executes PR-tree code, so the base-checkout guarantee does not apply
+ *     (a PR could already edit lint.cjs itself). The fork guard is what blocks
+ *     forgery: sameRepo is derived from the GitHub event payload.
+ *
+ * What each caller exempts:
+ *
+ *   - `Issue link required`: the closing-reference requirement.
+ *   - `validate-title`: only the missing-issue-ref verdict; the title's type
+ *     prefix (`bad-prefix`) is still enforced on these PRs.
+ *   - changeset-lint: the fragment requirement; a malformed fragment or `pr:`
+ *     drift still fails.
+ *
+ * Anti-forgery (#1389): a branch name alone is attacker-chosen — a fork can
+ * name its branch anything. The exemption therefore also requires
+ * `sameRepo === true` (head.repo.full_name == the base repository), which only
+ * someone with push access to this repository can satisfy, and the exact base
+ * branch each kind targets.
+ */
+
+const { isReleaseVersion, SYNC_BRANCH_PREFIX } = require('./sync-next-version.cjs');
+
+const RELEASE_PIPELINE_PR_KIND = Object.freeze({
+  RELEASE_MERGE: 'release-merge',
+  NEXT_VERSION_SYNC: 'next-version-sync',
+  MAIN_TO_NEXT_BACKMERGE: 'main-to-next-backmerge',
+});
+
+// release.yml validate-version: X.Y.0 cuts release/X.Y.0; X.Y.Z with Z>0 cuts
+// hotfix/X.Y.Z. Same no-leading-zero grammar as its `grep -qE` checks.
+const RELEASE_BRANCH_RE = /^release\/(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.0$/;
+const HOTFIX_BRANCH_RE = /^hotfix\/(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.[1-9][0-9]*$/;
+
+// auto-backmerge.yml: BR="chore/backmerge-main-to-next-${SHORT_SHA}" (#1389),
+// SHORT_SHA=$(git rev-parse --short origin/main): 7 to 40 lowercase hex.
+const BACKMERGE_BRANCH_PREFIX = 'chore/backmerge-main-to-next-';
+const BACKMERGE_SHA_RE = /^[0-9a-f]{7,40}$/;
+
+/**
+ * Classify a PR as one of the release pipeline's own PRs.
+ *
+ * @param {{ headRef?: unknown, baseRef?: unknown, sameRepo?: unknown }} [pr]
+ * @returns {string|null} a RELEASE_PIPELINE_PR_KIND value, or null when the PR
+ *   is not a release-pipeline PR (including every fork PR).
+ */
+function releasePipelinePrKind({ headRef, baseRef, sameRepo } = {}) {
+  if (sameRepo !== true) return null;
+  if (typeof headRef !== 'string' || typeof baseRef !== 'string') return null;
+
+  if (baseRef === 'main' && (RELEASE_BRANCH_RE.test(headRef) || HOTFIX_BRANCH_RE.test(headRef))) {
+    return RELEASE_PIPELINE_PR_KIND.RELEASE_MERGE;
+  }
+  if (baseRef === 'next' && headRef.startsWith(SYNC_BRANCH_PREFIX)
+    && isReleaseVersion(headRef.slice(SYNC_BRANCH_PREFIX.length))) {
+    return RELEASE_PIPELINE_PR_KIND.NEXT_VERSION_SYNC;
+  }
+  if (baseRef === 'next' && headRef.startsWith(BACKMERGE_BRANCH_PREFIX)
+    && BACKMERGE_SHA_RE.test(headRef.slice(BACKMERGE_BRANCH_PREFIX.length))) {
+    return RELEASE_PIPELINE_PR_KIND.MAIN_TO_NEXT_BACKMERGE;
+  }
+  return null;
+}
+
+/** True iff the PR is one of the release pipeline's own PRs (see releasePipelinePrKind). */
+function isReleasePipelinePr(pr) {
+  return releasePipelinePrKind(pr) !== null;
+}
+
+module.exports = {
+  RELEASE_PIPELINE_PR_KIND,
+  BACKMERGE_BRANCH_PREFIX,
+  releasePipelinePrKind,
+  isReleasePipelinePr,
+};

package/scripts/require-issue-link-policy.cjs

@@ -37,10 +37,14 @@ const ISSUE_LINK_REASON = Object.freeze({
   FAIL_FILE_LIST_INCOMPLETE: 'fail_file_list_incomplete',
 });
 
-// #1389: backmerge PRs are opened by CI against `next`, never by a human or a
-// fork, so they are exempt from the issue-link requirement outright — but
-// ONLY when combined with `sameRepo === true` below (see header comment).
-const BACKMERGE_BRANCH_PREFIX = 'chore/backmerge-main-to-next-';
+// #1389 / #5890: the release pipeline's own back-merge PRs (release/hotfix ->
+// main, chore/sync-next-version-* and chore/backmerge-main-to-next-* -> next)
+// are opened by CI, never by a human or a fork, and have no issue to link, so
+// they are exempt outright. The predicate lives in release-pipeline-pr.cjs —
+// shared with pr-title-validator.yml so the two gates agree — and requires
+// `sameRepo === true` plus the exact base branch, so a fork cannot forge it
+// by naming its branch.
+const { releasePipelinePrKind, BACKMERGE_BRANCH_PREFIX } = require('./release-pipeline-pr.cjs');
 
 // #4196: Dependabot has no mechanism to link a PR it opens to a repo issue —
 // its alerts live in the Security tab, not as issues, so there is nothing
@@ -135,7 +139,7 @@ function allPathsAreTestsOrDocs(changedFiles) {
   });
 }
 
-function evaluateIssueLink({ prBody, headRef, sameRepo, authorLogin, changedFiles, changedFilesTotal }) {
+function evaluateIssueLink({ prBody, headRef, baseRef, sameRepo, authorLogin, changedFiles, changedFilesTotal }) {
   if (authorLogin === DEPENDABOT_LOGIN) {
     return { ok: true, reason: ISSUE_LINK_REASON.OK_DEPENDABOT_EXEMPT };
   }
@@ -144,10 +148,14 @@ function evaluateIssueLink({ prBody, headRef, sameRepo, authorLogin, changedFile
     return { ok: true, reason: ISSUE_LINK_REASON.OK_CLOSING_KEYWORD };
   }
 
-  // #1389: `sameRepo === true` is required, not just the branch-name prefix —
-  // a fork PR could otherwise name its branch to forge this exemption.
-  if (String(headRef || '').startsWith(BACKMERGE_BRANCH_PREFIX) && sameRepo === true) {
-    return { ok: true, reason: ISSUE_LINK_REASON.OK_BACKMERGE_EXEMPT };
+  // #1389: `sameRepo === true` is required, not just the branch name — a fork
+  // PR could otherwise name its branch to forge this exemption (#5890 adds the
+  // base branch and the release/sync shapes; see release-pipeline-pr.cjs).
+  const releaseKind = releasePipelinePrKind({ headRef, baseRef, sameRepo });
+  if (releaseKind) {
+    // `kind` names which release-pipeline PR this is (the reason keeps its
+    // #1389 name so existing consumers of the enum are unchanged).
+    return { ok: true, reason: ISSUE_LINK_REASON.OK_BACKMERGE_EXEMPT, kind: releaseKind };
   }
 
   if (!hasFollowUpReference(prBody)) {
@@ -175,6 +183,7 @@ function main() {
   const result = evaluateIssueLink({
     prBody: process.env.PR_BODY || '',
     headRef: process.env.HEAD_REF || '',
+    baseRef: process.env.BASE_REF || '',
     sameRepo: process.env.SAME_REPO === 'true',
     authorLogin: process.env.PR_AUTHOR_LOGIN || '',
     changedFiles,

package/scripts/sync-next-version.cjs

@@ -30,6 +30,15 @@ function isReleaseVersion(v) {
   return typeof v === 'string' && RELEASE_VERSION.test(v);
 }
 
+// The branch syncViaPr opens. scripts/release-pipeline-pr.cjs exempts exactly
+// this shape from the issue-link and PR-title gates (#5890).
+const SYNC_BRANCH_PREFIX = 'chore/sync-next-version-';
+
+/** The head branch of the sync PR for `version`. */
+function syncBranchName(version) {
+  return `${SYNC_BRANCH_PREFIX}${version}`;
+}
+
 /** Read the `version` field out of a package.json text blob. Throws on a missing/non-string version. */
 function versionFromPackageJson(text) {
   const parsed = JSON.parse(text);
@@ -76,7 +85,7 @@ function syncViaPr(version, { run = defaultRun } = {}) {
     process.stdout.write(`next already at ${version} — nothing to sync\n`);
     return 'noop';
   }
-  const branch = `chore/sync-next-version-${version}`;
+  const branch = syncBranchName(version);
   run('git', ['checkout', '-B', branch, 'origin/next'], { timeout: 15000 });
   applyVersion(version, { run });
   run('git', ['add', '-u'], { timeout: 15000 });
@@ -162,4 +171,4 @@ if (require.main === module) {
   }
 }
 
-module.exports = { isReleaseVersion, versionFromPackageJson, applyVersion, syncViaPr, main, defaultRun };
+module.exports = { isReleaseVersion, versionFromPackageJson, applyVersion, syncViaPr, main, defaultRun, SYNC_BRANCH_PREFIX, syncBranchName };