semantic-release / env-ci

Hi 👋 I'm a user of semantic-release, thanks for making our hacking smooth and semantic!

Bug

According to the official document, GitHub Actions' GITHUB_REF should be a reference to PR merge branch like refs/pull/:prNumber/merge.

But the test in this repo uses the head branch instead:

env-ci/test/services/github.test.js

Line 55 in 1f504fd

GITHUB_REF: 'refs/heads/pr-branch',

If we change this test to make it following the doc, npm test will fail.

Context of this bug report

I want to confirm that current implementation is intentional or not, to fix a problem in pull_request_target event support. ~~Currently semantic-release triggers a release even from pull_request_target event, see this workflow run for example.~~ Current test code uses head branch as GITHUB_REF, but it should be a merge branch instead.

I made a test to reproduce the problem but not sure how I should fix it.

If current implementation (which doesn't follow the GitHub documentation) is a bug, and we will fix it to return reference to PR merge branch like refs/pull/:prNumber/merge; The fix for pull_request_target event will be simple:

diff --git a/services/github.js b/services/github.js
index e951430..cba02c7 100644
--- a/services/github.js
+++ b/services/github.js
@@ -18,13 +18,20 @@ const getPrEvent = ({env}) => {
   return {pr: undefined, branch: undefined};
 };
 
+const getPrNumber = (env) => {
+  const event = env.GITHUB_EVENT_PATH ? require(env.GITHUB_EVENT_PATH) : undefined;
+  return event && event.pull_request ? event.pull_request.number : undefined;
+};
+
 module.exports = {
   detect({env}) {
     return Boolean(env.GITHUB_ACTIONS);
   },
   configuration({env, cwd}) {
     const isPr = env.GITHUB_EVENT_NAME === 'pull_request' || env.GITHUB_EVENT_NAME === 'pull_request_target';
-    const branch = parseBranch(env.GITHUB_REF);
+    const branch = parseBranch(isPr ? `refs/pull/${getPrNumber(env)}/merge` : env.GITHUB_REF);
 
     return {
       name: 'GitHub Actions',
diff --git a/test/services/github.test.js b/test/services/github.test.js
index 1f7215e..86b9e87 100644
--- a/test/services/github.test.js
+++ b/test/services/github.test.js
@@ -92,7 +92,7 @@ test('PR - target', (t) => {
       build: '1246789',
       branch: 'master',
       isPr: true,
-      prBranch: 'pr-branch',
+      prBranch: 'refs/pull/10/merge',
       pr: '10',
       root: '/workspace',
       slug: 'owner/repo',

But if not, we probably need to find the head branch ref from env.GITHUB_EVENT_PATH and it could be complicated.

Update:

Currently semantic-release triggers a release even from pull_request_target event

This problem was resolved by #142, which sets isPr = true for the workflow run triggered by a pull_request_target event. So in this issue, I focus on the mismatch between test code and GitHub official documentation.

Here is changes to fix known issues based on the GitHub official document:
semantic-release:1f504fd...KengoTODA:3b1f1bd

Hey Kengo, thank you for the thorough issue and test case.

Could you start a pull request?

@gr2m started at #158, thanks!

🎉 This issue has been resolved in version 5.4.1 🎉

The release is available on:

Your semantic-release bot 📦🚀

GITHUB_REF should be not head branch ref but `refs/pull/:prNumber/merge`

Bug

Context of this bug report