commitizen-ci

Reusable Forgejo workflow + CI image for automated version bumps and changelogs with commitizen. Bump commits are signed with your own SSH key. No shared bot key exists, so there is nothing to leak.

One-time user setup

1. Generate a dedicated signing key (never reuse your auth key):

   ssh-keygen -t ed25519 -f ~/.ssh/cz_signing -N "" -C "cz-signing"
   

2. Add ~/.ssh/cz_signing.pub to your Forgejo account under Settings → SSH / GPG Keys → Add Key, then verify it so commits show Verified.

3. Store the private key (~/.ssh/cz_signing) as an Actions secret named CZ_SIGNING_KEY:

   • personal repos → user Settings → Actions → Secrets
   • org repos → org Settings → Actions → Secrets (user-level secrets do not reach org-owned repos)

Per-repo adoption

Have a [tool.commitizen] table (or .cz.toml) in the repo, then add .forgejo/workflows/bump.yaml:

name: Bump version
on:
    push:
        branches:
            - main

jobs:
    bump:
        uses: ModernLeft/commitizen-ci/.forgejo/workflows/bump.yml@main
        with:
            git-user-name: Your Name
            git-user-email: you@example.org
        secrets:
            SSH_SIGNING_KEY: ${{ secrets.CZ_SIGNING_KEY }}

Pin @main to a release tag of this repo for reproducibility. Gate the bump on your tests by adding a test job and needs: test on the caller.

Releasing is type-based. The full release model is documented at docs.modernleft.org/development/releases. Mechanically, this workflow exposes bumped (true/false) and version outputs. It detects the bump by comparing HEAD before and after (not by exit code) and pushes commit and tag in one git push --atomic. The workflow is self-contained: a consuming repo supplies only the with: inputs, the secrets:, and its own cz config — no particular tag settings are required (the config templates still set annotated_tag = true as a convention).

pr-bump-preview.yml maintains one sticky PR comment stating exactly what release a merge would cut. The logic lives in the cz-preview script baked into this image (dry-run, comment body, sticky create-or-update against the Forgejo API), so the workflow itself is a thin two-step caller with no per-repo values — copy the file as-is (it ships with the type templates). Script changes reach consumers as image releases via renovate tag bumps, not file re-propagation.

ModernLeft org repos

Org-owned repos skip the personal-key setup and sign as the commitizen-bot account. The workflow pulls the bot's key from Infisical at run time when the caller passes the org-level machine-identity credentials (available to every org repo automatically):

with:
    git-user-name: commitizen-bot
    git-user-email: admin+commitizenbot@modernleft.org
secrets:
    INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
    INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}

The key is pulled from the /commitizen-bot Infisical path by default. Set infisical-secret-path under with: to use a different path.

Notes

• Omit the secrets: block and bumps land unsigned but still attributed to the configured identity.
• Repos that track the version in a file (version_provider = uv, npm, …) and never publish tags should set push-tags: false under with:, which pushes only the bump commit.
• Pushes use the repo's own Actions job token. Branch protection that excludes the token will reject the push.
• The image can also be used directly: uses: docker://code.modernleft.org/modernleft/commitizen-ci:latest with env SSH_SIGNING_KEY, GIT_USER_NAME, GIT_USER_EMAIL.