feat(release): close GA gaps — signed tags, real install-path smoke test - #214
feat(release): close GA gaps — signed tags, real install-path smoke test#2142233admin wants to merge 2 commits into
Conversation
- Fix stale README/public-beta.md claims that macOS/Linux have no Release ZIP (false since v0.7.0-beta.2; PR #65 already shipped it). - Add SSH-based tag signing: release.yml fails closed on unsigned GA (non-beta/-rc) tags via git verify-tag against .github/allowed_signers; beta cadence is unaffected. docs/RELEASE_SIGNING.md covers maintainer setup and verification. - Document release-provenance verification in README (gh attestation verify + SHA-256 + tag signature). - bootstrap.py: add --local-asset, a CI-only bypass around the GitHub API so a freshly built local zip can be installed through the real download-verify-install code path. - cross-platform-smoke (ci.yml): package the build the way release.yml does, install it via bootstrap.py --local-asset, and assert PATH / CODE_INTEL_HOME actually persist (Windows: User registry scope; POSIX: a genuinely fresh interactive shell after the documented profile edit) instead of only proving $env:GITHUB_PATH was appended for this job. Closes remaining #59 proposal 6 gap and #158.
|
✅ Health of changed files: 2.6 (unchanged) 📋 At a glance ✅ Health gate: passed 📌 Before you merge
🔎 More signals (2)🔥 Hotspot touched (1)
💀 Dead code (1 finding)
📊 See the full report for this PR |
|
Warning Review limit reached
Next review available in: 49 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe change adds local release-archive installation to ChangesRelease distribution
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant CI smoke job
participant bootstrap.py
participant Release ZIP
participant Environment
CI smoke job->>Release ZIP: Build platform/version archive
CI smoke job->>bootstrap.py: Install with --local-asset and --version
bootstrap.py->>Release ZIP: Copy and install local archive
bootstrap.py->>Environment: Persist PATH and CODE_INTEL_HOME
CI smoke job->>Environment: Validate fresh environment state
Possibly related PRs
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Checked both signals:
🤖 Addressed by Claude Code |
Code Intel change risk
Top signals
revspec: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 600-642: Update the CI persistence checks around the Windows and
POSIX assertion steps to isolate the local-asset installation from state created
by the earlier Install portable pipeline. Before bootstrap or the packaged
installation runs, remove or redirect the existing Windows user environment
values and POSIX environment/profile file, then assert the expected PATH and
CODE_INTEL_HOME values produced by the packaged install rather than accepting
pre-existing state.
In `@README.md`:
- Around line 248-249: Update the SHA-256 verification section in README.md to
provide separate commands for Windows using certutil, macOS using shasum, and
Linux using sha256sum, ensuring each command verifies the referenced Windows
archive checksum file.
- Line 65: Update the README macOS/Linux quick-start section to lead with the
packaged code-intel CLI and its Release ZIP/bootstrap.py installation path
available from v0.7.0-beta.2. Move the PowerShell and Rust source-build
prerequisites into an explicitly labeled fallback path, while preserving the
existing compatibility instructions and commands.
- Line 252: Update the release-tag requirement near the “正式版” description to
explicitly recognize versioned prerelease suffixes such as “-beta.<n>” and
“-rc.<n>”, or document the exact tag pattern; ensure tags like “v0.7.0-beta.2”
and “v0.7.0-rc.1” are excluded from the SSH-signature requirement.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: cdd0fc9a-aba5-43df-83ba-904962484890
📒 Files selected for processing (7)
.github/allowed_signers.github/workflows/ci.yml.github/workflows/release.ymlREADME.mddocs/RELEASE_SIGNING.mddocs/public-beta.mdskills/code-intel-pipeline/scripts/bootstrap.py
…doc fixes - ci.yml: reset PATH/CODE_INTEL_HOME persisted state before the packaged install runs, so the persistence assertion can only pass because bootstrap.py's release-artifact install path did the persisting, not because the earlier from-source "Install portable pipeline" step already left it there. - README.md: lead the macOS/Linux quick start with the packaged CLI (Release ZIP, no Rust toolchain needed), keep source build as an explicitly labeled fallback. - README.md: give real per-platform checksum verification commands (certutil/shasum/sha256sum) instead of naming three tools but only showing one command. - README.md: state the beta/rc exclusion as an explicit suffix rule instead of ambiguous "not ending in -beta./-rc." prose that could be misread against tags like v0.7.0-beta.2.
1 participant
Summary
Closes the remaining gaps before cutting an official (non-beta) release: #59 proposal 6 (cross-platform-smoke never actually exercised the real release-artifact install path) and #158 (release provenance — attestation already existed, signed tags and verification docs did not).
release.ymlfails closed on unsigned GA (non-beta./-rc.) tags viagit verify-tagagainst.github/allowed_signers; beta cadence is unaffected.docs/RELEASE_SIGNING.mdcovers maintainer setup.gh attestation verify+ SHA-256 + tag signature).bootstrap.py: add--local-asset, a CI-only opt-in bypass around the GitHub API so a freshly built local zip can be driven through the real download-verify-install code path. Real (non-flag) installs are untouched.cross-platform-smoke(ci.yml): package the build the wayrelease.ymldoes, install it viabootstrap.py --local-asset, and assert PATH /CODE_INTEL_HOMEactually persist (Windows: User registry scope; POSIX: a genuinely fresh interactive shell after the documented profile edit) instead of only proving$env:GITHUB_PATHwas appended for this job.Heads up for reviewers
.github/allowed_signersships intentionally empty — the next non-beta tag will fail-closed at the new "Verify GA tag signature" step until a maintainer adds a real key via a follow-up PR (seedocs/RELEASE_SIGNING.md). This is expected, not a bug.~/.bashrc/~/.zshrcevery run — runner is ephemeral so it doesn't accumulate, but flagging since it's a dotfile mutation in a "read-only" smoke job.cross-platform-smokenow does a real package + install + shell-persistence check on top of what it already did, so this job runs a bit longer on all 3 matrix legs.Test plan
python tests/test_repository_layout.py -v— 5/5 passpython tests/test_skill_package.py -v— 18/18 pass (bootstrap.py change didn't break existing coverage)yaml.safe_load)[System.Management.Automation.Language.Parser]::ParseFilewith zero errors--local-assetpath end-to-end (package → install → doctor) against a real build of this branch, withrepowisehidden from PATH to emulate a clean CI runner:status: installed, installer exit 0, doctor exit 0CODE_INTEL_HOMEand the bin dir actually land in the Windows User environment scope after that install