Test for release script dependency

Creating a release draft, so that I can manually add release notes.

.github/workflows/main.yml

@@ -2,7 +2,6 @@ name: Test
 
 on:
   push:
-    branches: [main]
   workflow_dispatch:
 
 jobs:
@@ -15,5 +14,3 @@ jobs:
           fetch-depth: 0 # Ensure Talisman can operate on a valid revision range
       - name: Test action
         uses: ./
-        with:
-          remote-sha: 89df42eb70ebff472b384403e6b17e44391eba79

.talismanrc

@@ -0,0 +1,3 @@
+fileignoreconfig:
+  - filename: README.md
+    checksum: 6645dc4ac99294dd313e0c696499112aa0efc455627d7b9982e791559d727ada

Dockerfile

@@ -1,8 +1,12 @@
-FROM alpine:3.13.6
+FROM ubuntu:20.04
 
-RUN apk update && apk add git
+ENV DEBIAN_FRONTEND=noninteractive
 
-ADD ["https://github.com/thoughtworks/talisman/releases/download/v1.22.0/talisman_linux_amd64", "/talisman"]
+RUN apt update && apt install software-properties-common -y \
+  && add-apt-repository ppa:git-core/ppa -y \
+  && apt install -y git
+
+ADD ["https://github.com/thoughtworks/talisman/releases/download/v1.30.0/talisman_linux_amd64", "/talisman"]
 RUN chmod +x /talisman
 
 COPY entrypoint.sh /entrypoint.sh

README.md

@@ -5,12 +5,14 @@ This action uses [Talisman](https://thoughtworks.github.io/talisman/) to scan th
 ## Example usage
 
 ```yml
-uses: carhartl/talisman-secrets-scan-action@v1
+steps:
+  - name: Detect secrets with Talisman in incoming commits
+    uses: carhartl/talisman-secrets-scan-action@v1.4.0
 ```
 
 ## Caveat
 
-When using this along with the `actions/checkout@v2` step, you'll need to configure it to fetch the entire history:
+When using this along with the `actions/checkout@v2` step you'll need to configure it to avoid a too shallow clone:
 
 ```yml
 - uses: actions/checkout@v2
@@ -18,7 +20,7 @@ When using this along with the `actions/checkout@v2` step, you'll need to config
     fetch-depth: 0
 ```
 
-Otherwise you'll run into talisman erroring out while it's trying to execute git with an invalid revision range:
+Otherwise you may run into Talisman erroring out while it's trying to execute git with an invalid revision range:
 
 ```
 time="2021-09-19T07:07:32Z" level=fatal msg="Git command execution failed" command="git diff 0c4a631e70056a95df1c235d238a80828e07cf9c..a32a5c7e1a3d250bf18a080a44a764d9b93b9690 --name-only --diff-filter=ACM" dir=/github/workspace error="exit status 128" output="fatal: Invalid revision range 0c4a631e70056a95df1c235d238a80828e07cf9c..a32a5c7e1a3d250bf18a080a44a764d9b93b9690\n"

entrypoint.sh

@@ -2,4 +2,5 @@
 
 set -e
 
+sh -c "git config --global --add safe.directory $PWD"
 sh -c "echo $* | /talisman --githook pre-push"

lefthook.yml

@@ -0,0 +1,8 @@
+pre-commit:
+  parallel: true
+  commands:
+    shellcheck:
+      glob: "*.sh"
+      run: shellcheck {staged_files}
+    prettier:
+      run: prettier --check .

password.txt

@@ -1,2 +0,0 @@
-user=John
-password=7FAB324C-585E-4085-874A-161FBA2AEDE8

run.sh

@@ -0,0 +1,52 @@
+#!/bin/sh
+
+set -eu
+
+_user() {
+  printf "\033[0;33m%s\033[0m" "$1"
+}
+
+_fail() {
+  printf "\033[0;31m==> %s\033[0m\n\n" "$1"
+}
+
+prep_release() {
+  if ! git diff-index --quiet HEAD --; then
+    _fail "Repo must not be dirty"
+    exit 1
+  fi
+
+  grep -rlZE 'v\d+\.\d+\.\d+' --exclude=Dockerfile --exclude-dir=.git . | xargs sed -i '' 's/v[0-9]\{1,\}\.[0-9]\{1,\}\.[0-9]\{1,\}/'"$1"'/g'
+
+  _user "Prepare release draft on GitHub? "
+  read -r answer
+  if [ "$answer" = "y" ]; then
+    if ! command -v gh > /dev/null 2>&1; then
+      _fail "Script requires GitHub CLI: \`brew install gh\`"
+      exit 1
+    fi
+    git add --update
+    git commit -S -m "Prepare for $1 release"
+    git push origin main
+    git tag -s "$1" -m "Release $1"
+    git push --tags
+    gh release create --draft --latest --title "$1" --verify-tag
+    gh release view "$1" --web
+  fi
+}
+
+_help() {
+  echo "Usage: ./run.sh [command]"
+  echo ""
+  echo "Available commands:"
+  echo "prep-release <version>                Prepare new release draft"
+}
+
+cmd="${1:-}"
+case "$cmd" in
+  "prep-release")
+    shift
+    prep_release "$@"
+    ;;
+  *) _help ;;
+esac