feat: add optional annotated or signed tags #1871

DiogoAbu · 2021-04-06T05:51:27Z

This adds the option to annotate or sign the tag.
This is opt-in, the default values will result in the current implementation.

To make an unsigned, annotated tag:

{
  "tagAnnotate": true
}

To make an signed tag:

{
  "tagSign": true
}

Or by setting the git config tag.gpgsign to true.

To customize the tag message:

{
  "tagMessage": "release ${nextRelease.version}"
}

The message will be applied to the tag only if one of the following is true: tagAnnotate, tagSign or git config tag.gpgsign. Otherwise the tag is considered lightweight, which is the current implementation.

Also, tagSign takes precedence over tagAnnotate. The git config tag.gpgsign takes precedence over both.

DiogoAbu · 2021-04-06T05:56:22Z

#1871 #1589 #1266 #1192 #214

t1m0thyj · 2021-05-21T18:33:25Z

Hi, may I ask what's the status of this PR? We are also missing this feature, and adding it will be highly appreciated 🙏

gr2m · 2021-05-21T18:38:37Z

sorry for not getting back to it. Both @travi and I are too occupied right now, but we are discussing how to make more time for @semantic-release. Please give us some more time

stuart-warren · 2021-07-01T12:24:30Z

tools like miniver currently require annotated tags

https://github.com/jbweston/miniver

Annotated tags are meant for release while lightweight tags are meant for private or temporary object labels. For this reason, some git commands for naming objects (like git describe) will ignore lightweight tags by default.
https://git-scm.com/docs/git-tag

DanySK · 2021-11-26T14:16:07Z

I need annotated tags as well

…antic-release/semantic-release#1871

DanySK · 2021-11-26T14:29:05Z

Meanwhile, I concocted a terrible workaround to be able to get annotated tags:

tagFormat: "${version}"
plugins:
  - "@semantic-release/commit-analyzer"
  - "@semantic-release/release-notes-generator"
  - "@semantic-release/changelog"
  -
    - "@semantic-release/exec"
    - publishCmd: |
        git tag -a -f ${nextRelease.version} ${nextRelease.version} -F CHANGELOG.md
        git push --force origin ${nextRelease.version}
        # commands that need an annotated tag to work
  - "@semantic-release/github"
  - "@semantic-release/git"

DiogoAbu · 2021-11-26T16:53:52Z

As a alternative to @DanySK...
I use patch-package with this file passing -s to make it signed and -m to add the required message:

semantic-release+18.0.0.patch

diff --git a/node_modules/semantic-release/lib/git.js b/node_modules/semantic-release/lib/git.js
index 8aaf884..53a610f 100644
--- a/node_modules/semantic-release/lib/git.js
+++ b/node_modules/semantic-release/lib/git.js
@@ -221,7 +221,7 @@ async function verifyAuth(repositoryUrl, branch, execaOptions) {
  * @throws {Error} if the tag creation failed.
  */
 async function tag(tagName, ref, execaOptions) {
-  await execa('git', ['tag', tagName, ref], execaOptions);
+  await execa('git', ['tag', tagName, ref, '-s', '-m', `release ${tagName}`], execaOptions);
 }
 
 /**

DanySK · 2021-11-26T16:55:30Z

Still, it would be nice to see your PR merged

eladchen · 2021-11-28T07:42:14Z

@DanySK - While you wait, I recommend you check out https://github.com/abstracter-io/atomic-release

You can create a custom command that creates an annotated tag instead of a lightweight

lsagetlethias · 2022-01-03T14:26:20Z

Hello, what is the status of this PR?

DanySK · 2022-01-03T14:31:44Z

I'm also interested to understand what is holding this back, it's a major hassle for me at the moment

Langstra · 2022-01-05T15:40:46Z

We ran into an issue that looked like this, but in the end turned out to be something slightly different. Semantic-release creates notes and Gitlab treats those the same as commits. Thus when requiring signed commits, they also require you to sign notes, which is not possible.
https://gitlab.com/gitlab-org/gitlab/-/issues/209901

maaheeb · 2022-11-16T14:41:35Z

Would like to see this as well!

sharkymcdongles · 2022-11-17T12:10:55Z

+1 for asking for a merge pretty please <3

@travi @gr2m maybe pretty please

SchoolGuy · 2023-09-15T08:56:56Z

@travi Is there anything one can do to help with the progress of this PR? I would like to enable signed commits and tags for my repository but cannot do that due to the fact that this feature is missing with this project. My GPG key for the project would be available as a secret in GitHub Actions and Git would obviously be configured to use the mentioned key.

fastman · 2023-10-25T15:09:01Z

Looking forward to having this merged.

sheerlox

I've added a few comments. The main doubt I have with this change is the git config precedence over the semantic-release one.

I also notice you haven't added test cases covering your changes.

P.S. Sorry for the late response, I do realize this PR is over 2 years old, and I hope you're still willing to push it through after all that time.

sheerlox · 2023-11-22T11:04:10Z

lib/git.js

-  await execa("git", ["tag", tagName, ref], execaOptions);
+async function tag(tagName, ref, {tagAnnotate, tagSign, tagMessage}, execaOptions) {
+  const args = ["tag", tagName, ref];
+  const gitTagSign = await shouldSignTag(execaOptions);


What is the reasoning behind accounting for & giving precedence to the git configuration?

I see a few problems with that:

if I set tagSign to false in my config, it might still sign the tag based on my system configuration

it makes the changes breaking, as it will start unsolicitedly signing tags

Because of that, I don't think the git configuration should be accounted for. If overriding the release configuration behavior is needed in a specific setup, overriding it with the CLI flag is enough.

If I remember correctly...
I check for the git config first because signed tags must have a message, otherwise it fails. Currently if I set tag.gpgsign to true it will fail when creating a tag.
So if you set tagSign to false and tag.gpgsign is true it will still sign a tag to prevent the release from failing.
That said I don't think it is unsolicitedly if I previously set tag.gpgsign.
Does this make sense?

If one of -a, -s, or -u is passed, the command creates a tag object, and requires a tag message.

sheerlox · 2023-11-22T11:06:42Z

test/get-config.test.js

@@ -296,7 +320,9 @@ test.serial('Read configuration from file path in "extends"', async (t) => {
    branches: ["test_branch"],
    repositoryUrl: "https://host.null/owner/module.git",
    tagFormat: `v\${version}`,
-    plugins: ["plugin-1", ["plugin-2", { plugin2Opt: "value" }]],


This should probably not be removed.

sheerlox · 2023-11-22T11:11:56Z

docs/usage/configuration.md

+Default: `release ${nextRelease.version}`<br>
+CLI arguments: `-tm`, `--tag-message`
+
+The message for the tag. The tag message is generated with [Lodash template](https://lodash.com/docs#template) and will be compiled with the `nextRelease` variable.


nextRelease being an internal variable, there should be a link to its documentation.

sheerlox · 2023-11-22T11:12:46Z

cli.js

@@ -23,6 +23,14 @@ Usage:
    .option("b", { alias: "branches", describe: "Git branches to release from", ...stringList, group: "Options" })
    .option("r", { alias: "repository-url", describe: "Git repository URL", type: "string", group: "Options" })
    .option("t", { alias: "tag-format", describe: "Git tag format", type: "string", group: "Options" })
+    .option("ta", {
+      alias: "tag-annotate",
+      describe: "Whether to make an unsigned, annotated tag",


Streamline to "Toggle tag annotation".

sheerlox · 2023-11-22T11:13:18Z

cli.js

+      type: "boolean",
+      group: "Options",
+    })
+    .option("ts", {alias: "tag-sign", describe: "Whether to make GPG-signed tag", type: "boolean", group: "Options"})


Streamline to "Toggle tag signing".

sheerlox · 2023-11-22T11:25:04Z

index.js

+      {
+        tagAnnotate: options.tagAnnotate,
+        tagSign: options.tagSign,
+        tagMessage: template(options.tagMessage)({ nextRelease }),


I would make the tagMessage optional, and default to the nextRelease.gitTag.

Example use case: I want my release tags to be signed, but I don't care about the annotation message.

I tought it already was optional, and the default, set on get-config.js, is release \${nextRelease.version}.

AliSajid · 2024-01-19T02:21:01Z

Looking forward to this getting merged.

Korben11 · 2024-03-13T14:44:14Z

In the meantime, my workaround doesn't require a force push for using Gitlab API.

#!/usr/bin/env bash
# release.sh

# TODO: remove when merged, this is workaround for annotated tags
# https://github.com/semantic-release/semantic-release/pull/1871

if [ -z "$1" ]; then
	echo "Please provide a tag."
	echo "Usage: ./release.sh v[X.Y.Z]"
	exit
fi

GIT_TAG=$1

JSON_STRING=$( jq -n \
                  --arg tag_name "${GIT_TAG}" \
                  --arg ref "main" \
                  '{tag_name: $tag_name, ref: $ref}' )

if [ -n "$2" ]; then
  NOTES=$2
  JSON_STRING=$(echo $JSON_STRING | jq -r --arg message "${NOTES}" '.message = $message')
fi

echo "Recreating annotated tag ${GIT_TAG}..."

URL="https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/repository/tags"

curl -X DELETE "${URL}/${GIT_TAG}" -H "PRIVATE-TOKEN: ${GITLAB_TOKEN}"
curl -X POST "${URL}" -H "Content-Type: application/json" -H "PRIVATE-TOKEN: ${GITLAB_TOKEN}" -d "${JSON_STRING}"

{
  ...
  "plugins": [
    "@semantic-release/commit-analyzer",
    "@semantic-release/release-notes-generator",
    "@semantic-release/changelog",
    "@semantic-release/git",
    [
      "@semantic-release/exec",
      {
        "publishCmd": "./release.sh ${nextRelease.gitTag} \"${nextRelease.notes}\""
      }
    ],
    "@semantic-release/gitlab"
  ],
  ...
}

candrews · 2024-04-25T12:31:06Z

I'm eagerly awaiting the merge of this improvement 🤞

feat: add optional annotated or signed tags

ad64c53

DiogoAbu and others added 6 commits April 6, 2021 03:55

fix: improve tag option condition readability

d326da4

test: update tag function on tests

a27e041

test: extract tag gpg check to function

b7856dd

test: update test passing new config tag keys

c7704a0

style: update tag function to pass max-params

88a8795

Merge branch 'master' into feat/annotate-sign-tag

1cb5cde

Xunnamius mentioned this pull request Oct 19, 2021

Add dummy EDITOR to env execa options (support for annotated tags?) #1710

Open

DanySK added a commit to DanySK/publish-on-central that referenced this pull request Nov 26, 2021

fix: try to force semantic release to annotate the tag, see issue sem…

c479ac3

…antic-release/semantic-release#1871

Merge branch 'master' into feat/annotate-sign-tag

41baeb1

lsagetlethias mentioned this pull request Jan 3, 2022

GitHub: Commits signés SocialGroovyBot SocialGouv/support#142

Closed

Merge branch 'master' into feat/annotate-sign-tag

d02c7d6

kennethjor mentioned this pull request May 9, 2022

Fix Gradle version recognition autonomouslogic/semantic-release-gradle-sonatype-example#5

Open

DiogoAbu added 5 commits August 9, 2022 18:03

Merge branch 'master' into feat/annotate-sign-tag

f2ef03a

Merge branch 'master' into feat/annotate-sign-tag

913f0d8

Merge branch 'master' into feat/annotate-sign-tag

f436d3b

Merge branch 'master' into feat/annotate-sign-tag

bd10dd0

Merge branch 'master' into feat/annotate-sign-tag

50db694

Merge branch 'master' into feat/annotate-sign-tag

9b214dd

DiogoAbu added 9 commits December 21, 2022 15:08

Merge branch 'master' into feat/annotate-sign-tag

3d479ab

Merge branch 'master' into feat/annotate-sign-tag

e463b12

Merge branch 'master' into feat/annotate-sign-tag

ce5c8c9

Merge branch 'master' into feat/annotate-sign-tag

b9e6575

Merge branch 'master' into feat/annotate-sign-tag

83491d1

Merge branch 'master' into feat/annotate-sign-tag

510bdbf

Merge branch 'master' into feat/annotate-sign-tag

e1b4218

Merge branch 'master' into feat/annotate-sign-tag

2d41edb

Merge branch 'master' into feat/annotate-sign-tag

0c34d3c

This was referenced Nov 19, 2023

Possibility to create annotated tags #1266

Open

Hanging forever while tagging the release if git is configured to sign tags #3065

Open

sheerlox reviewed Nov 22, 2023

View reviewed changes

sheerlox mentioned this pull request Nov 22, 2023

Update GPG documentation semantic-release/git#498

Open

Merge branch 'master' into feat/annotate-sign-tag

760d072

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add optional annotated or signed tags #1871

feat: add optional annotated or signed tags #1871

DiogoAbu commented Apr 6, 2021

DiogoAbu commented Apr 6, 2021 •

edited

t1m0thyj commented May 21, 2021

gr2m commented May 21, 2021

stuart-warren commented Jul 1, 2021 •

edited

DanySK commented Nov 26, 2021

DanySK commented Nov 26, 2021

DiogoAbu commented Nov 26, 2021

DanySK commented Nov 26, 2021

eladchen commented Nov 28, 2021

lsagetlethias commented Jan 3, 2022

DanySK commented Jan 3, 2022

Langstra commented Jan 5, 2022

maaheeb commented Nov 16, 2022

sharkymcdongles commented Nov 17, 2022

SchoolGuy commented Sep 15, 2023

fastman commented Oct 25, 2023

sheerlox left a comment •

edited

sheerlox Nov 22, 2023

DiogoAbu Nov 24, 2023 •

edited

sheerlox Nov 22, 2023

sheerlox Nov 22, 2023

sheerlox Nov 22, 2023

sheerlox Nov 22, 2023

sheerlox Nov 22, 2023

DiogoAbu Nov 24, 2023

AliSajid commented Jan 19, 2024

Korben11 commented Mar 13, 2024

candrews commented Apr 25, 2024

feat: add optional annotated or signed tags #1871

Are you sure you want to change the base?

feat: add optional annotated or signed tags #1871

Conversation

DiogoAbu commented Apr 6, 2021

DiogoAbu commented Apr 6, 2021 • edited

t1m0thyj commented May 21, 2021

gr2m commented May 21, 2021

stuart-warren commented Jul 1, 2021 • edited

DanySK commented Nov 26, 2021

DanySK commented Nov 26, 2021

DiogoAbu commented Nov 26, 2021

DanySK commented Nov 26, 2021

eladchen commented Nov 28, 2021

lsagetlethias commented Jan 3, 2022

DanySK commented Jan 3, 2022

Langstra commented Jan 5, 2022

maaheeb commented Nov 16, 2022

sharkymcdongles commented Nov 17, 2022

SchoolGuy commented Sep 15, 2023

fastman commented Oct 25, 2023

sheerlox left a comment • edited

Choose a reason for hiding this comment

sheerlox Nov 22, 2023

Choose a reason for hiding this comment

DiogoAbu Nov 24, 2023 • edited

Choose a reason for hiding this comment

sheerlox Nov 22, 2023

Choose a reason for hiding this comment

sheerlox Nov 22, 2023

Choose a reason for hiding this comment

sheerlox Nov 22, 2023

Choose a reason for hiding this comment

sheerlox Nov 22, 2023

Choose a reason for hiding this comment

sheerlox Nov 22, 2023

Choose a reason for hiding this comment

DiogoAbu Nov 24, 2023

Choose a reason for hiding this comment

AliSajid commented Jan 19, 2024

Korben11 commented Mar 13, 2024

candrews commented Apr 25, 2024

DiogoAbu commented Apr 6, 2021 •

edited

stuart-warren commented Jul 1, 2021 •

edited

sheerlox left a comment •

edited

DiogoAbu Nov 24, 2023 •

edited