Merge pull request #829 from peter-evans/logging

fix: improve logging

.eslintrc.json

@@ -9,8 +9,7 @@
     "plugin:import/errors",
     "plugin:import/warnings",
     "plugin:import/typescript",
-    "plugin:prettier/recommended",
-    "prettier/@typescript-eslint"
+    "plugin:prettier/recommended"
   ],
   "plugins": ["@typescript-eslint"],
   "rules": {

.github/workflows/ci.yml

@@ -1,12 +1,12 @@
 name: CI
 on:
   push:
-    branches: [master]
+    branches: [main]
     paths-ignore:
       - 'README.md'
       - 'docs/**'
   pull_request:
-    branches: [master]
+    branches: [main]
     paths-ignore:
       - 'README.md'
       - 'docs/**'
@@ -45,7 +45,7 @@ jobs:
     steps:
       - uses: actions/checkout@v2
         with:
-          ref: master
+          ref: main
       - if: matrix.target == 'built' || github.event_name == 'pull_request'
         uses: actions/download-artifact@v2
         with:
@@ -108,7 +108,7 @@ jobs:
             ```
 
   package:
-    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: [test]
     runs-on: ubuntu-latest
     steps:
@@ -123,7 +123,7 @@ jobs:
           commit-message: 'build: update distribution'
           title: Update distribution
           body: |
-            - Updates the distribution for changes on `master`
+            - Updates the distribution for changes on `main`
 
             Auto-generated by [create-pull-request][1]
 

README.md

@@ -44,7 +44,7 @@ All inputs are **optional**. If not set, sensible defaults will be used.
 
 | Name | Description | Default |
 | --- | --- | --- |
-| `token` | `GITHUB_TOKEN` or a `repo` scoped [Personal Access Token (PAT)](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token). | `GITHUB_TOKEN` |
+| `token` | `GITHUB_TOKEN` (`contents: write`, `pull-requests: write`) or a `repo` scoped [Personal Access Token (PAT)](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token). | `GITHUB_TOKEN` |
 | `path` | Relative path under `GITHUB_WORKSPACE` to the repository. | `GITHUB_WORKSPACE` |
 | `commit-message` | The message to use when committing changes. | `[create-pull-request] automated change` |
 | `committer` | The committer name and email address in the format `Display Name <email@address.com>`. Defaults to the GitHub Actions bot user. | `GitHub <noreply@github.com>` |
@@ -157,6 +157,11 @@ To create a project card for the pull request, pass the `pull-request-number` st
           issue-number: ${{ steps.cpr.outputs.pull-request-number }}
 ```
 
+### Auto-merge
+
+Auto-merge can be enabled on a pull request allowing it to be automatically merged once requirements have been satisfied.
+See [enable-pull-request-automerge](https://github.com/peter-evans/enable-pull-request-automerge) action for usage details.
+
 ## Reference Example
 
 The following workflow sets many of the action's inputs for reference purposes.

docs/assets/cpr-gitgraph.htm

@@ -29,37 +29,37 @@
             orientation: "vertical-reverse"
         });
 
-        const master = gitgraph.branch("master");
-        master.commit("Last commit on base");
-        const localMaster = gitgraph.branch("<#1> master (local)");
-        localMaster.commit({
+        const main = gitgraph.branch("main");
+        main.commit("Last commit on base");
+        const localMain = gitgraph.branch("<#1> main (local)");
+        localMain.commit({
             subject: "<uncommitted changes>",
             body: "Changes to the local base during the workflow",
         })
         const remotePatch = gitgraph.branch("create-pull-request/patch");
         remotePatch.merge({
-            branch: localMaster,
+            branch: localMain,
             commitOptions: {
                 subject: "[create-pull-request] automated change",
                 body: "Changes pushed to create the remote branch",
             },
         });
-        master.commit("New commit on base");
+        main.commit("New commit on base");
 
-        const localMaster2 = gitgraph.branch("<#2> master (local)");
-        localMaster2.commit({
+        const localMain2 = gitgraph.branch("<#2> main (local)");
+        localMain2.commit({
             subject: "<uncommitted changes>",
             body: "Changes to the updated local base during the workflow",
         })
         remotePatch.merge({
-            branch: localMaster2,
+            branch: localMain2,
             commitOptions: {
                 subject: "[create-pull-request] automated change",
                 body: "Changes force pushed to update the remote branch",
             },
         });
 
-        master.merge(remotePatch);
+        main.merge(remotePatch);
 
     </script>
 

docs/concepts-guidelines.md

@@ -16,6 +16,7 @@ This document covers terminology, how the action works, general usage guidelines
   - [Push using SSH (deploy keys)](#push-using-ssh-deploy-keys)
   - [Push pull request branches to a fork](#push-pull-request-branches-to-a-fork)
   - [Authenticating with GitHub App generated tokens](#authenticating-with-github-app-generated-tokens)
+  - [GPG commit signature verification](#gpg-commit-signature-verification)
   - [Running in a container or on self-hosted runners](#running-in-a-container-or-on-self-hosted-runners)
 
 ## Terminology
@@ -97,7 +98,7 @@ Workflows triggered by [`release`](https://docs.github.com/en/actions/reference/
 ```yml
       - uses: peter-evans/create-pull-request@v3
         with:
-          base: master
+          base: main
 ```
 
 ### Restrictions on repository forks
@@ -129,6 +130,8 @@ jobs:
     if: github.event.pull_request.head.repo.full_name == github.repository
 ```
 
+For further reading regarding the security of pull requests, see this GitHub blog post titled [Keeping your GitHub Actions and workflows secure: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)
+
 ### Triggering further workflow runs
 
 Pull requests created by the action using the default `GITHUB_TOKEN` cannot trigger other workflows. If you have `on: pull_request` or `on: push` workflows acting as checks on pull requests, they will not run.
@@ -161,7 +164,7 @@ Alternatively, use the action directly and reference the commit hash for the ver
   - uses: thirdparty/foo-action@172ec762f2ac8e050062398456fccd30444f8f30
 ```
 
-This action uses [ncc](https://github.com/vercel/ncc) to compile the Node.js code and dependencies into a single JavaScript file under the [dist](https://github.com/peter-evans/create-pull-request/tree/master/dist) directory.
+This action uses [ncc](https://github.com/vercel/ncc) to compile the Node.js code and dependencies into a single JavaScript file under the [dist](https://github.com/peter-evans/create-pull-request/tree/main/dist) directory.
 
 ## Advanced usage
 
@@ -272,6 +275,48 @@ GitHub App generated tokens are more secure than using a PAT because GitHub App
           token: ${{ steps.generate-token.outputs.token }}
 ```
 
+### GPG commit signature verification
+
+The action can use GPG to sign commits with a GPG key that you generate yourself.
+
+1. Follow GitHub's guide to [generate a new GPG key](https://docs.github.com/en/github/authenticating-to-github/generating-a-new-gpg-key).
+
+2. [Add the public key](https://docs.github.com/en/github/authenticating-to-github/adding-a-new-gpg-key-to-your-github-account) to the user account associated with the [Personal Access Token (PAT)](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) that you will use with the action.
+
+3. Copy the private key to your clipboard, replacing `email@example.com` with the email address of your GPG key.
+   ```
+   # macOS
+   gpg --armor --export-secret-key email@example.com | pbcopy
+   ```
+
+4. Paste the private key into a repository secret where the workflow will run. e.g. `GPG_PRIVATE_KEY`
+
+5. Create another repository secret for the key's passphrase, if applicable. e.g. `GPG_PASSPHRASE`
+
+6. The following example workflow shows how to use [crazy-max/ghaction-import-gpg](https://github.com/crazy-max/ghaction-import-gpg) to import your GPG key and allow the action to sign commits.
+
+   Note that the `committer` email address *MUST* match the email address used to create your GPG key.
+
+```yaml
+    steps:
+      - uses: actions/checkout@v2
+
+      - uses: crazy-max/ghaction-import-gpg@v3
+        with:
+          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git-user-signingkey: true
+          git-commit-gpgsign: true
+
+      # Make changes to pull request here
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v3
+        with:
+          token: ${{ secrets.PAT }}
+          committer: example <email@example.com>
+```
+
 ### Running in a container or on self-hosted runners
 
 This action can be run inside a container, or on [self-hosted runners](https://docs.github.com/en/actions/hosting-your-own-runners), by installing the necessary dependencies.

docs/examples.md

@@ -21,6 +21,7 @@
   - [Filtering push events](#filtering-push-events)
   - [Dynamic configuration using variables](#dynamic-configuration-using-variables)
   - [Setting the pull request body from a file](#setting-the-pull-request-body-from-a-file)
+  - [Using a markdown template](#using-a-markdown-template)
   - [Debugging GitHub Actions](#debugging-github-actions)
 
 
@@ -37,7 +38,7 @@ name: Update AUTHORS
 on:
   push:
     branches:
-      - master
+      - main
 jobs:
   updateAuthors:
     runs-on: ubuntu-latest
@@ -61,14 +62,14 @@ jobs:
 
 This is a use case where a branch should be kept up to date with another by opening a pull request to update it. The pull request should then be updated with new changes until it is merged or closed.
 
-In this example scenario, a branch called `production` should be updated via pull request to keep it in sync with `master`. Merging the pull request is effectively promoting those changes to production.
+In this example scenario, a branch called `production` should be updated via pull request to keep it in sync with `main`. Merging the pull request is effectively promoting those changes to production.
 
 ```yml
 name: Create production promotion pull request
 on:
   push:
     branches:
-      - master
+      - main
 jobs:
   productionPromotion:
     runs-on: ubuntu-latest
@@ -78,8 +79,8 @@ jobs:
           ref: production
       - name: Reset promotion branch
         run: |
-          git fetch origin master:master
-          git reset --hard master
+          git fetch origin main:main
+          git reset --hard main
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v3
         with:
@@ -95,7 +96,7 @@ This pattern will work well for updating any kind of static content based on the
 Raises a pull request to update the `CHANGELOG.md` file based on the tagged commit of the release.
 Note that [git-chglog](https://github.com/git-chglog/git-chglog/) requires some configuration files to exist in the repository before this workflow will work.
 
-This workflow assumes the tagged release was made on a default branch called `master`.
+This workflow assumes the tagged release was made on a default branch called `main`.
 
 ```yml
 name: Update Changelog
@@ -122,7 +123,7 @@ jobs:
           title: Update Changelog
           body: Update changelog to reflect release changes
           branch: update-changelog
-          base: master
+          base: main
 ```
 
 ## Use case: Create a pull request to update X periodically
@@ -173,9 +174,9 @@ The above workflow works best in combination with a build workflow triggered on
 name: CI
 on:
   push:
-    branches: [master]
+    branches: [main]
   pull_request:
-    branches: [master]
+    branches: [main]
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -324,7 +325,7 @@ jobs:
 This example is designed to be run in a seperate repository from the fork repository itself.
 The aim of this is to prevent committing anything to the fork's default branch would cause it to differ from the upstream.
 
-In the following example workflow, `owner/repo` is the upstream repository and `fork-owner/repo` is the fork. It assumes the default branch of the upstream repository is called `master`.
+In the following example workflow, `owner/repo` is the upstream repository and `fork-owner/repo` is the fork. It assumes the default branch of the upstream repository is called `main`.
 
 The [Personal Access Token (PAT)](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) should have `repo` scope. Additionally, if the upstream makes changes to the `.github/workflows` directory, the action will be unable to push the changes to a branch and throw the error "_(refusing to allow a GitHub App to create or update workflow `.github/workflows/xxx.yml` without `workflows` permission)_". To allow these changes to be pushed to the fork, add the `workflow` scope to the PAT. Of course, allowing this comes with the risk that the workflow changes from the upstream could run and do something unexpected. Disabling GitHub Actions in the fork is highly recommended to prevent this.
 
@@ -345,8 +346,8 @@ jobs:
       - name: Reset the default branch with upstream changes
         run: |
           git remote add upstream https://github.com/owner/repo.git
-          git fetch upstream master:upstream-master
-          git reset --hard upstream-master
+          git fetch upstream main:upstream-main
+          git reset --hard upstream-main
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v3
         with:
@@ -560,6 +561,31 @@ The content must be [escaped to preserve newlines](https://github.community/t/se
           body: ${{ steps.get-pr-body.outputs.body }}
 ```
 
+### Using a markdown template
+
+In this example, a markdown template file is added to the repository at `.github/pull-request-template.md` with the following content.
+```
+This is a test pull request template
+Render template variables such as {{ .foo }} and {{ .bar }}.
+```
+
+The template is rendered using the [render-template](https://github.com/chuhlomin/render-template) action and the result is used to create the pull request.
+```yml
+      - name: Render template
+        id: template
+        uses: chuhlomin/render-template@v1.2
+        with:
+          template: .github/pull-request-template.md
+          vars: |
+            foo: this
+            bar: that
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v3
+        with:
+          body: ${{ steps.template.outputs.result }}
+```
+
 ### Debugging GitHub Actions
 
 #### Runner Diagnostic Logging

package.json

@@ -29,26 +29,26 @@
   },
   "homepage": "https://github.com/peter-evans/create-pull-request",
   "dependencies": {
-    "@actions/core": "1.2.6",
+    "@actions/core": "1.2.7",
     "@actions/exec": "1.0.4",
-    "@octokit/core": "3.2.4",
-    "@octokit/plugin-paginate-rest": "2.8.0",
-    "@octokit/plugin-rest-endpoint-methods": "4.5.2",
+    "@octokit/core": "3.4.0",
+    "@octokit/plugin-paginate-rest": "2.13.3",
+    "@octokit/plugin-rest-endpoint-methods": "5.1.1",
     "uuid": "8.3.2"
   },
   "devDependencies": {
-    "@types/jest": "26.0.20",
-    "@types/node": "14.14.22",
-    "@typescript-eslint/parser": "4.14.0",
-    "@vercel/ncc": "0.27.0",
-    "eslint": "7.18.0",
-    "eslint-plugin-github": "4.1.1",
-    "eslint-plugin-jest": "24.1.3",
+    "@types/jest": "26.0.23",
+    "@types/node": "15.0.3",
+    "@typescript-eslint/parser": "4.23.0",
+    "@vercel/ncc": "0.28.5",
+    "eslint": "7.26.0",
+    "eslint-plugin-github": "4.1.3",
+    "eslint-plugin-jest": "24.3.6",
     "jest": "26.6.3",
     "jest-circus": "26.6.3",
-    "js-yaml": "4.0.0",
-    "prettier": "2.2.1",
-    "ts-jest": "26.4.4",
-    "typescript": "4.1.3"
+    "js-yaml": "4.1.0",
+    "prettier": "2.3.0",
+    "ts-jest": "26.5.6",
+    "typescript": "4.2.4"
   }
 }

src/create-pull-request.ts

@@ -195,11 +195,13 @@ export async function createPullRequest(inputs: Inputs): Promise<void> {
 
     if (result.hasDiffWithBase) {
       // Create or update the pull request
+      core.startGroup('Create or update the pull request')
       const pull = await githubHelper.createOrUpdatePullRequest(
         inputs,
         baseRemote.repository,
         branchRepository
       )
+      core.endGroup()
 
       // Set outputs
       core.startGroup('Setting outputs')

src/github-helper.ts

@@ -43,7 +43,8 @@ export class GitHubHelper {
   ): Promise<Pull> {
     // Try to create the pull request
     try {
-      const {data: pull} = await this.octokit.pulls.create({
+      core.info(`Attempting creation of pull request`)
+      const {data: pull} = await this.octokit.rest.pulls.create({
         ...this.parseRepository(baseRepository),
         title: inputs.title,
         head: headBranch,
@@ -71,13 +72,15 @@ export class GitHubHelper {
     }
 
     // Update the pull request that exists for this branch and base
-    const {data: pulls} = await this.octokit.pulls.list({
+    core.info(`Fetching existing pull request`)
+    const {data: pulls} = await this.octokit.rest.pulls.list({
       ...this.parseRepository(baseRepository),
       state: 'open',
       head: headBranch,
       base: inputs.base
     })
-    const {data: pull} = await this.octokit.pulls.update({
+    core.info(`Attempting update of pull request`)
+    const {data: pull} = await this.octokit.rest.pulls.update({
       ...this.parseRepository(baseRepository),
       pull_number: pulls[0].number,
       title: inputs.title,
@@ -95,7 +98,7 @@ export class GitHubHelper {
   }
 
   async getRepositoryParent(headRepository: string): Promise<string> {
-    const {data: headRepo} = await this.octokit.repos.get({
+    const {data: headRepo} = await this.octokit.rest.repos.get({
       ...this.parseRepository(headRepository)
     })
     if (!headRepo.parent) {
@@ -120,7 +123,7 @@ export class GitHubHelper {
     // Apply milestone
     if (inputs.milestone) {
       core.info(`Applying milestone '${inputs.milestone}'`)
-      await this.octokit.issues.update({
+      await this.octokit.rest.issues.update({
         ...this.parseRepository(baseRepository),
         issue_number: pull.number,
         milestone: inputs.milestone
@@ -129,7 +132,7 @@ export class GitHubHelper {
     // Apply labels
     if (inputs.labels.length > 0) {
       core.info(`Applying labels '${inputs.labels}'`)
-      await this.octokit.issues.addLabels({
+      await this.octokit.rest.issues.addLabels({
         ...this.parseRepository(baseRepository),
         issue_number: pull.number,
         labels: inputs.labels
@@ -138,7 +141,7 @@ export class GitHubHelper {
     // Apply assignees
     if (inputs.assignees.length > 0) {
       core.info(`Applying assignees '${inputs.assignees}'`)
-      await this.octokit.issues.addAssignees({
+      await this.octokit.rest.issues.addAssignees({
         ...this.parseRepository(baseRepository),
         issue_number: pull.number,
         assignees: inputs.assignees
@@ -157,7 +160,7 @@ export class GitHubHelper {
     }
     if (Object.keys(requestReviewersParams).length > 0) {
       try {
-        await this.octokit.pulls.requestReviewers({
+        await this.octokit.rest.pulls.requestReviewers({
           ...this.parseRepository(baseRepository),
           pull_number: pull.number,
           ...requestReviewersParams