Bug: the pipelines being run aren't updating the semantic tag version (possibly dependabot releated)

[Will-Mann-16]

Hi guys,

Love the work you've done with the library. However we recently we're having issues recently after enabling dependabot with some of our commits. The pipelines now will run, but won't release a new version at all. As you can see below, the red arrow indicates the last release and the actions on the pipeline are showing the release pipeline (all pass).

Feel free to look at the library here: https://www.github.com/ls6-events/astra for more detailed logging.

And this is our pipeline output for the most recent run (specifically the release job):

Run go-semantic-release/action@v1
downloading semantic-release binary...
running semantic-release...
/home/runner/work/_temp/7[6](https://github.com/LS6-Events/astra/actions/runs/7632591943/job/20793178009#step:4:7)634c[7](https://github.com/LS6-Events/astra/actions/runs/7632591943/job/20793178009#step:4:8)b-ddcc-4cf7-a27f-3[8](https://github.com/LS6-Events/astra/actions/runs/7632591943/job/20793178009#step:4:9)dcf55eff78 --version-file --changelog .generated-go-semantic-release-changelog.md --hooks goreleaser
[go-semantic-release]: version: 2.2[9](https://github.com/LS6-Events/astra/actions/runs/7632591943/job/20793178009#step:4:10).0
[go-semantic-release]: trying to prefetch plugins...
[go-semantic-release]: all plugins were prefetched!
[go-semantic-release]: ci-condition plugin: GitHub Actions@1.9.0
[go-semantic-release]: provider plugin: GitHub@1.16.0
[go-semantic-release]: getting default branch...
[go-semantic-release]: found default branch: main
[go-semantic-release]: found current branch: main
[go-semantic-release]: found current sha: 9162c781bd9bb9f968fcef1e60f40c9fff0d8af6
[go-semantic-release]: hooks plugins: GoReleaser@1.9.0
[go-semantic-release]: running CI condition...
[go-semantic-release]: getting latest release...
[go-semantic-release]: found version: 1.22.0
[go-semantic-release]: getting commits...
[go-semantic-release]: analyzing commits...
[go-semantic-release]: commit-analyzer plugin: default@1.[12](https://github.com/LS6-Events/astra/actions/runs/7632591943/job/20793178009#step:4:13).0
[go-semantic-release]: calculating new version...
[go-semantic-release]: no change
[go-semantic-release]: stopping plugins...

The actions yaml is here:

name: CI
on:
  push:
    branches:
      - 'main'
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Setup Go
        uses: actions/setup-go@v4
        with:
          go-version: 1.21.0
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v3
        with:
          version: v1.55.1
          args: --timeout=10m --config=.golangci.yml
  test:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-go@v3
        with:
          go-version: 1.21
      - run: go test -v ./...
  release:
    runs-on: ubuntu-latest
    needs: test
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-go@v3
        with:
          go-version: 1.21
      - uses: go-semantic-release/action@v1
        with:
          hooks: goreleaser
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

We suspect dependabot, but we don't entirely know. This has been happening across our repos soon after we enable dependabot but we did it all quite recently so it could be something else.

Thanks!

[cliedeman]

Hi @Will-Mann-16

It looks like the commit analyzer doesn't support commit messages with scopes. Created a test: https://github.com/go-semantic-release/commit-analyzer-cz/pull/3

That still doesnt explain why it doesn't release anything though. It should still generate a release when it hits the next 'normal' message like feat: or fix:.

[TommoLeedsy]

@cliedeman I work with @Will-Mann-16 and I manually renamed a dependabot's commit name to remove the scope. The release pipeline ran with no errors but it still failed to find a new version and release properly.

Below is the commit history of the repo and the red arrow shows the first and last time the pipeline actually released a new version. The top commit is the dependabot commit which I rename manually to remove the scope.

[christophwitzko]

Hi @Will-Mann-16 and @TommoLeedsy, thanks for using go-semantic-release 🕺

From what I can see, there have only been chore commits since the last release, v1.22.0. go-semantic-release is configured by default to only release if a fix or feat commit message is detected since the last release (the scope is parsed correctly but ignored for now).

You can configure dependapot in a way to use either a feat or fix commit prefix using the config file: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#commit-message

[TommoLeedsy]

@christophwitzko Thanks for your response, is there a possibility to add other commit types to cause a release? It might be nice if these were user customisable to an extent? I'm happy to work on a feature like this, if that's something you would be interested in.

[christophwitzko]

Yes, that sounds like a good idea! I will look into it. 👍

[TommoLeedsy]

@christophwitzko Sounds good, thank you very much!

[christophwitzko]

Hi everyone, I created an issue for that in the commit-analyzer repo: https://github.com/go-semantic-release/commit-analyzer-cz/issues/4

Will close this one for now.

[christophwitzko]

Hi everyone, I have extended the commit analyzer with customizable release rules: https://github.com/go-semantic-release/commit-analyzer-cz?tab=readme-ov-file#customizable-release-rules

You can now configure custom commit types/scopes that trigger releases. If you want that dependabot commits (chore(deps)) trigger a new minor release you can add the following .semrelrc config to your repo:

{
  "plugins":{
    "commit-analyzer":{
      "options":{
        "minor_release_rules":"feat,chore(deps)"
      }
    }
  }
}

Let me know if that works for you. ☺️

[TommoLeedsy]

@christophwitzko This looks fantastic, thank you very much.