Follow-up to the injection fix (0f2299f), which I'd over-trimmed. Restores
original behavior with the safety fix kept:
- Re-add the if: guard so the job skips [skip ci]/[skip version] and its own
'chore: bump version' commits, so the bot's bump commit can't re-trigger
the workflow.
- Re-add the Create summary step (reads the message via env TRIGGER_MSG and
takes only the first line, so a multi-line/special-char body can't corrupt
the markdown table or the script).
- Bump detection matches a [major]/[minor] tag OR the original conventional
prefixes (BREAKING/major:, feat/feature/minor:), so existing feat:/BREAKING:
commits keep bumping minor/major as before.
- Keep the original dev-only trigger and paths-ignore.
The message reaches both steps via env (COMMIT_MSG / TRIGGER_MSG), never
spliced into run-script source. Verified: YAML parses and bump detection
returns the right type for feat:/BREAKING:/[minor]/[major]/plain messages,
including ones containing backticks, pipes and $(...).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The bump-version job did `COMMIT_MSG="${{ github.event.head_commit.message }}"`
inside a run: block. GitHub Actions text-substitutes ${{ }} into the script
source BEFORE bash runs, so a commit body containing backticks, $(...) or |
is spliced in raw — breaking the step (and an arbitrary-command-injection
vector). Commit e3337f0's body contained `vagrant up | Out-Host`, so the
backticks opened a command substitution and the pipe was a syntax error:
"syntax error near unexpected token `|`" — the reported CI failure.
Pass the message via env: COMMIT_MSG instead, so it reaches the step as an
inert environment variable that bash never re-parses. Verified by simulation:
the old form reproduces the exact error; the new form handles backticks,
pipes and $(...) safely and still detects [major]/[minor] markers.
Also removes three stray ``` markdown code fences (lines 64/70/71) that had
been pasted into the YAML, and the dead BACKEND_DIR var + placeholder
comment. YAML validated with a parser.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Add VERSION file (starting at 1.0.0)
- Add GitHub Actions workflow to auto-bump version on push
- patch: default for all commits
- minor: commits starting with "feat:" or "feature:"
- major: commits starting with "BREAKING:" or "major:"
- Add CLI commands: version, check-update
- Update 'serverkit update' to show semantic versions
- Compare local vs remote version before updating
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Juan Denis