Skip to content

build: add "[security]" to the PR title when appropriate - #2694

Open
nschonni wants to merge 1 commit into
nodejs:mainfrom
nschonni:security-title
Open

build: add "[security]" to the PR title when appropriate#2694
nschonni wants to merge 1 commit into
nodejs:mainfrom
nschonni:security-title

Conversation

@nschonni

@nschonni nschonni commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Description

Will optionally make the PR title feat[security]: Node.js ... instead of the current feat: Node.js ... when the changing release lines are marked as security releases.

Motivation and Context

Makes it more visible for this repo, but also for the downstream Official Image PRs when we're sending over a security release.
I didn't find a particular conventional commit format for these commit messages.

Testing Details

Example Output(if appropriate)

Changin the v26 version number, which currently was a security release

Checking for updates for 27
        Latest version: v27.0.0-alpha.0.0.0
        Released: 2026-10-29
        Security release: false
        alpine3.23: everything up to date!
        alpine3.24: everything up to date!
        bookworm: everything up to date!
        bookworm-slim: everything up to date!
        trixie: everything up to date!
        trixie-slim: everything up to date!
::set-env name=NODE_PR_TITLE::feat[security]: Node.js v26.13.1

Changing v27, which isn't a security release

Checking for updates for 27
        Latest version: v27.0.0-alpha.0.0.0
        Released: 2026-10-29
        Security release: false
        alpine3.23: everything up to date!
        alpine3.24: everything up to date!
        bookworm: everything up to date!
        bookworm-slim: everything up to date!
        trixie: updating to v27.0.0-alpha.0.0.0
        trixie-slim: everything up to date!
::set-env name=NODE_PR_TITLE::feat: Node.js v27.0.0-alpha.0.0.0

Types of changes

  • Documentation
  • Version change (Update, remove or add more Node.js versions)
  • Variant change (Update, remove or add more variants, or versions of variants)
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Other (none of the above)

Checklist

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have read the CONTRIBUTING.md document.
  • All new and existing tests passed.

MikeMcC399
MikeMcC399 approved these changes Nov 11, 2026
View reviewed changes

@MikeMcC399 MikeMcC399 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should also try to get the PR title aligned with the content when there are sequential changes to the PR content. That would be a different scope to this PR though, and more complex to achieve.

@MikeMcC399

MikeMcC399 commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

Typically commit messages use () rather than [] (see for instance https://www.conventionalcommits.org/en/v1.0.0/)

so that would be feat(security):

That would only be an issue if it were being parsed to add to a change log, which doesn't apply in this case.

Was there some reason you chose the square brackets?

SimenB
SimenB approved these changes Nov 12, 2026
View reviewed changes

@SimenB SimenB left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

makes sense 👍

maybe a label as well?

@nschonni

nschonni commented Nov 12, 2026

Copy link
Copy Markdown
Member Author

I was just looking at the commits/PRs in the official images, but I guess that form is their recommendation https://github.com/docker-library/official-images/blob/master/README.md#security-releases.

@MikeMcC399

MikeMcC399 commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

I was just looking at the commits/PRs in the official images, but I guess that form is their recommendation https://github.com/docker-library/official-images/blob/master/README.md#security-releases.

In that case I would drop the "feat" and just have "[security]", so perhaps for example:

  • Node.js xx.yy.zz
  • [security] Node.js 22.yy.zz, 24.yy.zz, 26.yy.zz

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SimenB SimenB SimenB approved these changes
@MikeMcC399 MikeMcC399 MikeMcC399 approved these changes

Assignees

No one assigned

Labels

security release

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@nschonni @MikeMcC399 @SimenB