commitizen-ci

CI image for automated version bumps + changelogs with commitizen. Bump commits are SSH-signed by the commitizen-bot account.

Usage (ModernLeft org repos)

Secrets are pulled from Infisical at run time — never store the signing key or a PAT as a repo secret. The org-level INFISICAL_CLIENT_ID/INFISICAL_CLIENT_SECRET are available to all org repos automatically.

- name: Pull secrets from Infisical
  uses: https://github.com/Infisical/secrets-action@77ab1f4ccd183a543cb5b42435fbd181189f4995 # v1.0.16
  with:
      method: universal
      client-id: ${{ secrets.INFISICAL_CLIENT_ID }}
      client-secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
      domain: https://infisical.modernleft.org
      project-slug: development
      env-slug: prod
      secret-path: "/commitizen-bot"
      export-type: env

- name: Bump version with commitizen
  uses: docker://code.modernleft.org/modernleft/commitizen-ci:0.0.1
  env:
      SSH_SIGNING_KEY: ${{ env.COMMITIZEN_SIGNING_KEY }}
      GIT_USER_NAME: commitizen-bot
      GIT_USER_EMAIL: admin+commitizenbot@modernleft.org
  with:
      args: cz bump --yes --changelog

See the working example in this repo's .forgejo/workflows/build-push.yaml (checkout with env.COMMITIZEN_PAT for pushable full-history clones).

Usage (outside the ModernLeft org)

The bot's signing key is never shared. Run the image without SSH_SIGNING_KEY (bumps land unsigned) or provide your own key. See docs.modernleft.org → Development → Service bots for the access model.