From 9483913537b8cdf3b4999ed6792ebfbb4cd135de Mon Sep 17 00:00:00 2001
From: Tsvika Shapira <tsvika@moonmath.ai>
Date: Sun, 27 Sep 2026 15:28:31 +0300
Subject: [PATCH] ci(pins): list the bumps in the pins commit message

The repo squash-merges with the PR's commit messages as the body, and
the pins commit had only a subject, so the squash commit had no message.
The script now also writes the list of bumps, which the workflow puts in
the commit body, as Dependabot does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GyMoD8tx4oz1bpJ1tEL845
---
 .github/scripts/pins_pr_body.py            |  9 +++++++--
 .github/workflows/update-template-pins.yml | 15 +++++++++++++--
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/.github/scripts/pins_pr_body.py b/.github/scripts/pins_pr_body.py
index aa2e114..dc608b3 100644
--- a/.github/scripts/pins_pr_body.py
+++ b/.github/scripts/pins_pr_body.py
@@ -1,7 +1,8 @@
 """Write the body of the template action pins PR, with the release notes of each bump.
 
 Reads the pin changes from `git diff` of the template's workflows, and fetches the
-notes of every release in each bumped range with `gh`. Prints the body to stdout.
+notes of every release in each bumped range with `gh`. Prints the body to stdout, and
+writes the list of bumps, for the commit message, to the path given as an argument.
 """
 
 import json
@@ -126,8 +127,12 @@ def release_notes(repo: str, old: str, new: str) -> str:
 
 
 def main() -> None:
+    changes = pin_changes()
+    bumps = "".join(f"- {repo} {old} → {new}\n" for repo, (old, new) in changes.items())
+    with open(sys.argv[1], "w", encoding="utf-8") as f:
+        f.write(bumps)
     body = INTRO + "\n## Release notes\n\n"
-    for repo, (old, new) in pin_changes().items():
+    for repo, (old, new) in changes.items():
         try:
             section = release_notes(repo, old, new)
         except subprocess.CalledProcessError as exc:
diff --git a/.github/workflows/update-template-pins.yml b/.github/workflows/update-template-pins.yml
index 38e3440..0992404 100644
--- a/.github/workflows/update-template-pins.yml
+++ b/.github/workflows/update-template-pins.yml
@@ -53,16 +53,27 @@ jobs:
           done
 
       - name: Write the pull request body, with release notes
+        id: body
         env:
           GH_TOKEN: ${{ github.token }}
-        run: python3 .github/scripts/pins_pr_body.py > "$RUNNER_TEMP/pr-body.md"
+        run: |
+          python3 .github/scripts/pins_pr_body.py "$RUNNER_TEMP/bumps.txt" > "$RUNNER_TEMP/pr-body.md"
+          {
+            echo 'bumps<<EOF'
+            cat "$RUNNER_TEMP/bumps.txt"
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
 
       - name: Create pull request
         id: cpr
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: "ci: update action pins in the template"
+          # The squash merge takes its message from this commit's body.
+          commit-message: |
+            ci: update action pins in the template
+
+            ${{ steps.body.outputs.bumps }}
           title: "⬆️ Update action pins in the template"
           body-path: ${{ runner.temp }}/pr-body.md
           branch: ci/template-action-pins