mirror of
https://github.com/usetrmnl/trmnl-home-assistant.git
synced 2026-08-13 23:18:27 -07:00
Ikraam GhoorandClaude Opus 5
9cfe6ab2b0
Necessary because the release notes are assembled from commit subjects and were interpolated into a shell string, escaping only double quotes. Backticks and $(...) survived that, so anyone able to land a commit could have run arbitrary shell when the release was cut. CodeQL flagged it as high severity once the surrounding line was touched. Passing argv to `gh` removes the shell from the path entirely, so the notes are data rather than syntax. The remaining `git` calls still build shell strings, but their inputs are tag names and version fields that already require push access to influence. Worth converting separately. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Release Scripts
release.js
Automates the version bump process across all project files.
--addon is required. The repo ships two add-ons off one tag stream, and
releasing the wrong one is silent, so there is no default.
trmnl-ha
Versioned in this repo and tagged v<version>.
- Bumps version in
package.json,config.yaml, andCHANGELOG.md - Creates a git commit with the changes
- Tags the commit with the new version
- Optionally pushes to remote
trmnl-terminus
Its version mirrors the bundled Terminus release and is written by the
terminus-upstream-bump workflow, so it takes no bump type. The script only
publishes whatever config.yaml already says, tagged terminus-v<version>.
Usage
From the project root:
# Using npm scripts (recommended)
cd trmnl-ha/ha-trmnl
npm run release:patch # 0.0.1 -> 0.0.2
npm run release:minor # 0.0.1 -> 0.1.0
npm run release:major # 0.0.1 -> 1.0.0
npm run release:dry # See what would change
# Direct script usage
bun scripts/release.js --addon=trmnl-ha patch
bun scripts/release.js --addon=trmnl-ha minor --dry-run
bun scripts/release.js --addon=trmnl-ha major --push
# Publish the Terminus add-on at its current version
bun scripts/release.js --addon=trmnl-terminus --push
Options
--dry-run,-d- Preview changes without modifying files--push,-p- Push commit and tags to remote after release
Examples
# Preview a patch release
npm run release:dry
# Create a patch release (bug fixes)
npm run release:patch
# Create a minor release (new features) and push
bun scripts/release.js minor --push
# Create a major release (breaking changes)
npm run release:major
Before releasing
Make sure you have:
- Updated the
[Unreleased]section in CHANGELOG.md with your changes - Committed all your work (script checks for uncommitted changes)
- Updated your GitHub username in CHANGELOG.md URLs
After releasing
If you didn't use --push, remember to:
git push && git push --tags