commitizen-ci

Reusable Forgejo workflow + CI image for automated version bumps, changelogs, and releases with commitizen.

Bump preview

pr-bump-preview.yml maintains one sticky PR comment stating exactly what release a merge would cut. It is not a reusable workflow, just an example.

name: PR Bump Preview

on:
    pull_request:
        types: [opened, reopened, synchronize, ready_for_review]

jobs:
    preview:
        if: "!github.event.pull_request.draft"
        runs-on: ubuntu-latest
        name: "Preview version bump"
        container:
            image: code.modernleft.org/modernleft/commitizen-ci:latest
        steps:
            - name: Checkout PR head
              uses: actions/checkout@v7
              with:
                  fetch-depth: 0

            - name: Preview bump and update the sticky comment
              env:
                  GITHUB_TOKEN: ${{ github.token }}
                  API_URL: ${{ github.api_url }}
                  REPO: ${{ github.repository }}
                  PR_NUMBER: ${{ github.event.pull_request.number }}
              run: cz-preview

Bump

A commitizen config in the repo is required.

The bare minimum: only the two required inputs. Commits are unsigned, and tags it publishes will not be able to trigger downstream workflows (such as a release job).

name: Bump version
on:
    push:
        branches:
            - main

jobs:
    bump:
        uses: ModernLeft/commitizen-ci/.forgejo/workflows/bump.yml@main
        with:
            git-user-name: Your Name
            git-user-email: you@example.org

This is an example workflow used in the ModernLeft repos.

name: Bump version
on:
    push:
        branches:
            - main

jobs:
    bump:
        uses: ModernLeft/commitizen-ci/.forgejo/workflows/bump.yml@main
        with:
            git-user-name: commitizen-bot
            git-user-email: admin+commitizenbot@modernleft.org
        secrets:
            INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
            INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}

The Infisical secrets pull both the SSH signing key and the bot's REPOSITORY_ACCESS_TOKEN from infisical-secret-path. Infisical is optional: without it, pass them as Actions secrets instead:

secrets:
    SSH_SIGNING_KEY: ${{ secrets.SSH_SIGNING_KEY }}
    REPOSITORY_ACCESS_TOKEN: ${{ secrets.REPOSITORY_ACCESS_TOKEN }}

Without a REPOSITORY_ACCESS_TOKEN the push uses the default actions token, which triggers no downstream workflows (such as a release job).

Input	Default	Purpose
git-user-name	required	Bump commit author
git-user-email	required	Bump commit email
push-tags	true	false pushes the bump commit only
infisical-secret-path	/forgejo-users/commitizen-bot	Infisical path for the key and token

Release

release.yml creates a Forgejo Release for a tag, using that version's changelog section as the body. Call it on the tag push:

name: Release
on:
    push:
        tags:
            - "[0-9]*.[0-9]*.[0-9]*"

jobs:
    release:
        uses: ModernLeft/commitizen-ci/.forgejo/workflows/release.yml@main
        with:
            version: ${{ github.ref_name }}