Add please-bump version check by gvegayon · Pull Request #90 · USCCANA/netdiffuseR

gvegayon · 2026-09-04T17:15:02Z

Summary

Adds please-bump, a GitHub Action that checks a PR bumps the package version, and fails the check if not (report-only for now, see below).
Requires DESCRIPTION and the top NEWS.md heading (Changes in netdiffuseR version 1.2.3 (date) style) to agree on version whenever R/, src/, inst/, man/, man-roxygen/, data-raw/, DESCRIPTION, NAMESPACE, or NEWS.md change — catches "bumped DESCRIPTION, forgot NEWS.md" and vice versa.
Posts a sticky PR comment reporting what moved, from what to what, and what kind of bump it was.
Ships with fail-on-error: false: the check reports but never blocks a merge yet, so it doesn't retroactively redden any currently-open PR. A follow-up PR will flip it to true once it's been observed on a few real PRs.

Test plan

Ran the action locally (src/main.sh) against this repo's actual DESCRIPTION/NEWS.md: the current worktree (no changes) correctly passes; the r-news-changes preset regex was verified against this repo's actual NEWS.md heading before opening this PR.
Confirm the sticky comment posts correctly on this PR (this PR itself only touches .github/, which is outside the configured paths:, so the group will report skipped here — that's expected).

🤖 Generated with Claude Code

Requires DESCRIPTION and NEWS.md (heading style: 'Changes in netdiffuseR version 1.2.3 (date)') to agree on version whenever R/, src/, inst/, man/, man-roxygen/, data-raw/, DESCRIPTION, NAMESPACE, or NEWS.md change. Report-only for now (fail-on-error: false): the check posts its sticky PR comment but never blocks a merge. Flip fail-on-error to true in a follow-up once it has been observed on real PRs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

github-actions · 2026-09-04T17:17:11Z

Version bump check ✅

group	base	head	bump
netdiffuseR	—	—	⏭️ skipped

_{Checked 1 group(s) against f16350e503126db0f8f3384ce8afcbefde28f83d · please-bump}

Copilot

🟢 Approval recommended

Changes are isolated to GitHub Actions/config and are low-risk with report-only behavior enabled.

Pull request overview

Adds the please-bump GitHub Action to report whether PRs include an appropriate package version bump, based on changes to key package paths/files and consistency between DESCRIPTION and the top NEWS.md heading.

Changes:

Adds a new GitHub Actions workflow to run gvegayon/please-bump on PR events (report-only via fail-on-error: false).
Adds a repository configuration file defining which paths trigger version enforcement and which presets to apply (r-package, r-news-changes).

File summaries

File	Description
.github/workflows/please-bump.yml	New workflow to run the please-bump action on PRs (report-only).
.github/please-bump.yaml	please-bump configuration defining the netdiffuseR group, watched paths, and rule presets.

Review details

Files reviewed: 2/2 changed files
Comments generated: 1
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+


A Copilot review comment on the measles PR (UofUEpiBio/measles#53) flagged that pull_request + a write-scoped pull-requests token doesn't help PRs from forks, since GitHub forces GITHUB_TOKEN to read-only there regardless. Document the tradeoff at the point it's made instead of leaving it unexplained: please-bump already degrades gracefully on fork PRs (warns, continues, pass/fail unaffected -- see its README), and switching to pull_request_target to fix comments there would hand a write-scoped token to a job that also diffs/checks out the fork's own code, which needs real sandboxing to be safe. Not worth it just for a comment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

A Copilot review comment on #90 pointed out that without a branches: filter, this workflow also fires on PRs targeting any non-default branch, unlike this repo's other pull_request-triggered workflows -- unintended noise/cost. Match local convention. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

A Copilot review comment on USCCANA/netdiffuseR#90 pointed out that without a branches: filter, this workflow also fires on PRs targeting any non-default branch, unlike this repo's other pull_request-triggered workflows -- unintended noise/cost. Match local convention. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

A Copilot review comment on USCCANA/netdiffuseR#90 (same workflow file) pointed out that without a branches: filter, this workflow also fires on PRs targeting any non-default branch -- unintended noise/cost. Match local convention. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Explain the fork-PR comment limitation inline A Copilot review comment on UofUEpiBio/measles#53 (same workflow file) flagged that pull_request + a write-scoped pull-requests token doesn't help PRs from forks, since GitHub forces GITHUB_TOKEN to read-only there regardless. Document the tradeoff at the point it's made instead of leaving it unexplained: please-bump already degrades gracefully on fork PRs (warns, continues, pass/fail unaffected -- see its README), and switching to pull_request_target to fix comments there would hand a write-scoped token to a job that also diffs/checks out the fork's own code, which needs real sandboxing to be safe. Not worth it just for a comment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Restrict please-bump trigger to the default branch A Copilot review comment on USCCANA/netdiffuseR#90 (same workflow file) pointed out that without a branches: filter, this workflow also fires on PRs targeting any non-default branch -- unintended noise/cost. Match local convention. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Add please-bump version check Requires DESCRIPTION and NEWS.md (top heading style: '# measles 1.2.3') to agree on version whenever R/, src/, inst/, man/, data-raw/, DESCRIPTION, NAMESPACE, or NEWS.md change. Report-only for now (fail-on-error: false): the check posts its sticky PR comment but never blocks a merge. Flip fail-on-error to true in a follow-up once it has been observed on real PRs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Explain the fork-PR comment limitation inline A Copilot review comment on the measles PR (#53) flagged that pull_request + a write-scoped pull-requests token doesn't help PRs from forks, since GitHub forces GITHUB_TOKEN to read-only there regardless. Document the tradeoff at the point it's made instead of leaving it unexplained: please-bump already degrades gracefully on fork PRs (warns, continues, pass/fail unaffected -- see its README), and switching to pull_request_target to fix comments there would hand a write-scoped token to a job that also diffs/checks out the fork's own code, which needs real sandboxing to be safe. Not worth it just for a comment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Restrict please-bump trigger to the default branch A Copilot review comment on USCCANA/netdiffuseR#90 pointed out that without a branches: filter, this workflow also fires on PRs targeting any non-default branch, unlike this repo's other pull_request-triggered workflows -- unintended noise/cost. Match local convention. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Explain the fork-PR comment limitation inline A Copilot review comment on UofUEpiBio/measles#53 (same workflow file) flagged that pull_request + a write-scoped pull-requests token doesn't help PRs from forks, since GitHub forces GITHUB_TOKEN to read-only there regardless. Document the tradeoff at the point it's made instead of leaving it unexplained: please-bump already degrades gracefully on fork PRs (warns, continues, pass/fail unaffected -- see its README), and switching to pull_request_target to fix comments there would hand a write-scoped token to a job that also diffs/checks out the fork's own code, which needs real sandboxing to be safe. Not worth it just for a comment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Restrict please-bump trigger to the default branch A Copilot review comment on USCCANA/netdiffuseR#90 (same workflow file) pointed out that without a branches: filter, this workflow also fires on PRs targeting any non-default branch -- unintended noise/cost. Match local convention. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Add please-bump version check Requires DESCRIPTION and NEWS.md (heading style: 'Changes in rgexf version 1.2.3 (date)') to agree on version whenever R/, inst/, man/, DESCRIPTION, NAMESPACE, or NEWS.md change. Report-only for now (fail-on-error: false): the check posts its sticky PR comment but never blocks a merge. Flip fail-on-error to true in a follow-up once it has been observed on real PRs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Explain the fork-PR comment limitation inline A Copilot review comment on the measles PR (UofUEpiBio/measles#53) flagged that pull_request + a write-scoped pull-requests token doesn't help PRs from forks, since GitHub forces GITHUB_TOKEN to read-only there regardless. Document the tradeoff at the point it's made instead of leaving it unexplained: please-bump already degrades gracefully on fork PRs (warns, continues, pass/fail unaffected -- see its README), and switching to pull_request_target to fix comments there would hand a write-scoped token to a job that also diffs/checks out the fork's own code, which needs real sandboxing to be safe. Not worth it just for a comment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Restrict please-bump trigger to the default branch A Copilot review comment on USCCANA/netdiffuseR#90 pointed out that without a branches: filter, this workflow also fires on PRs targeting any non-default branch, unlike this repo's other pull_request-triggered workflows -- unintended noise/cost. Match local convention. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Add please-bump version check Checks only DESCRIPTION -- NEWS.md's top heading is the usethis dev-version convention ('# tabulergm (development version)'), which never contains a released version number to compare against. Report-only for now (fail-on-error: false): the check posts its sticky PR comment but never blocks a merge. Flip fail-on-error to true in a follow-up once it has been observed on real PRs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Explain the fork-PR comment limitation inline A Copilot review comment on the measles PR (UofUEpiBio/measles#53) flagged that pull_request + a write-scoped pull-requests token doesn't help PRs from forks, since GitHub forces GITHUB_TOKEN to read-only there regardless. Document the tradeoff at the point it's made instead of leaving it unexplained: please-bump already degrades gracefully on fork PRs (warns, continues, pass/fail unaffected -- see its README), and switching to pull_request_target to fix comments there would hand a write-scoped token to a job that also diffs/checks out the fork's own code, which needs real sandboxing to be safe. Not worth it just for a comment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Restrict please-bump trigger to the default branch A Copilot review comment on USCCANA/netdiffuseR#90 pointed out that without a branches: filter, this workflow also fires on PRs targeting any non-default branch, unlike this repo's other pull_request-triggered workflows -- unintended noise/cost. Match local convention. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Add please-bump version check Requires pyproject.toml and src/epicc/__init__.py's __version__ to agree whenever src/, app.py, or pyproject.toml change -- mirrors what scripts/bump_version.py already writes together. Report-only for now (fail-on-error: false): the check posts its sticky PR comment but never blocks a merge. Flip fail-on-error to true in a follow-up once it has been observed on real PRs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Explain the fork-PR comment limitation inline A Copilot review comment on the measles PR (UofUEpiBio/measles#53) flagged that pull_request + a write-scoped pull-requests token doesn't help PRs from forks, since GitHub forces GITHUB_TOKEN to read-only there regardless. Document the tradeoff at the point it's made instead of leaving it unexplained: please-bump already degrades gracefully on fork PRs (warns, continues, pass/fail unaffected -- see its README), and switching to pull_request_target to fix comments there would hand a write-scoped token to a job that also diffs/checks out the fork's own code, which needs real sandboxing to be safe. Not worth it just for a comment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Restrict please-bump trigger to the default branch A Copilot review comment on USCCANA/netdiffuseR#90 pointed out that without a branches: filter, this workflow also fires on PRs targeting any non-default branch, unlike this repo's other pull_request-triggered workflows -- unintended noise/cost. Match local convention. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Add a concurrency group to prevent duplicate sticky comments Two pushes close together start two overlapping runs; without this, both can read "no sticky comment yet" before either has posted one, producing two duplicate comments on the PR (observed on UofUEpiBio/epiworld#262). Cancelling the superseded run fixes it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Copilot AI lite review requested due to automatic review settings September 4, 2026 17:15

Copilot started reviewing on behalf of gvegayon September 4, 2026 17:15 View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Comment thread .github/workflows/please-bump.yml

Comment on lines +3 to +6

on:

pull_request:

types: [opened, synchronize, reopened]

gvegayon and others added 2 commits September 4, 2026 11:26

gvegayon merged commit ac9bd4c into master Sep 4, 2026
9 of 10 checks passed

gvegayon deleted the add-please-bump branch September 4, 2026 23:20

Navigation Menu

Uh oh!

Add please-bump version check - #90

Add please-bump version check#90
gvegayon merged 3 commits into
masterfrom
add-please-bump

gvegayon commented Sep 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

gvegayon commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

github-actions Bot commented Sep 4, 2026

Version bump check ✅

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gvegayon commented Sep 4, 2026 •

edited

Loading