Repository navigation
fix(release): vendor python-semantic-release's docker action to pin gitpython - #351
Merged
Merged
Conversation
…itpython GitPython 3.1.60 (2026-08-25) removed Actor.name_email_regex, which semantic_release.cli.config reads unconditionally — every release run now crashes on 'type object Actor has no attribute name_email_regex'. PSR pins gitpython ~= 3.0 (unpinned patch range), and the upstream action's Docker image is rebuilt from PyPI at job start regardless of which action SHA release.yml pins, so this recurs on every push to main until upstream ships python-semantic-release/python-semantic-release#1477. Vendors the action's Dockerfile/action.sh/action.yml unchanged, adding only a gitpython==3.1.59 pin to requirements.txt. Verified locally: the vendored image resolves gitpython 3.1.59 and `semantic-release version` loads config and runs cleanly. Revert to the upstream action once #1477 ships in a release.
There was a problem hiding this comment.
🟡 Changes recommended
The vendored action.sh introduces (and now embeds) a few concrete correctness/security issues (invalid prompt printing, malformed error string, non-failing invalid input, and logging/handling of signing key material) that should be addressed before merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR restores the release workflow by vendoring python-semantic-release’s Docker-based GitHub Action and pinning gitpython to a last-known-good version, avoiding the upstream image rebuild pulling a breaking GitPython release at job runtime.
Changes:
- Switch
.github/workflows/release.ymlto use a local, vendored semantic-release action. - Add a vendored Docker action under
.github/actions/semantic-release-pinned/with a pinnedgitpython==3.1.59. - Document the rationale and intended revert path once upstream releases a fix.
File summaries
| File | Description |
|---|---|
| .github/workflows/release.yml | Points the release job at the vendored semantic-release action and documents why. |
| .github/actions/semantic-release-pinned/requirements.txt | Pins python-semantic-release and GitPython to avoid the breaking GitPython release. |
| .github/actions/semantic-release-pinned/Dockerfile | Builds the action image from the pinned requirements. |
| .github/actions/semantic-release-pinned/action.yml | Defines the vendored Docker action and uses the local Dockerfile. |
| .github/actions/semantic-release-pinned/action.sh | Action entrypoint script (vendored) that executes semantic-release inside the container. |
| .github/actions/semantic-release-pinned/.dockerignore | Minimizes Docker build context to only needed files. |
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 4
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
release.yml's "Run semantic release" step started failing on every push tomainwithtype object 'Actor' has no attribute 'name_email_regex'. GitPython 3.1.60 (released 2026-08-25) dropped that attribute, python-semantic-release reads it unconditionally on every config load, and PSR's own dependency pin (gitpython ~= 3.0) is loose enough to resolve to it. Since the official action's Docker image is rebuilt from PyPI at job start regardless of which action SHArelease.ymlpins, this recurs on every push until upstream ships a fix — see python-semantic-release/python-semantic-release#1476, fix already open as #1477.Type of change
Related
none — upstream tracked at python-semantic-release/python-semantic-release#1476, #1477
Evidence
docker build .github/actions/semantic-release-pinned) and confirmedpip installresolvesgitpython-3.1.59, not 3.1.60.semantic-release version --no-commit --no-tag --no-push --no-changelog --no-vcs-release --skip-buildinside that image against this repo's checkout — config loads and it correctly reports the feature branch isn't a release branch, noActorcrash.make checkpasses locally — lint, type-check, 1174 passed, 1 skipped.Risk and scope
action.sh. Only the Docker image'sgitpythonversion is pinned down to the last-good release.uv run semantic-release— that would also drop thebuild_command's existing Docker-image constraints (no uv, Python 3.14, documented inpyproject.toml) and touch more than this fix needs.Dockerfile/action.sh/action.ymlare byte-for-byte copies of upstream at the pinned SHA (39dd2052, v10.6.1) except the one added line inrequirements.txtand theimage:path inaction.yml.Checklist
make checkpasses locally — lint, type-check, testsBREAKING CHANGE:footer, if any, survives into the squash message — n/a, not a breaking change