fix: recover guarded maintenance release

[loadinglucian]

Summary

• verify recaptured authoritative evidence without treating runtime-only plan records as external captures
• retain failure diagnostics and create a deduplicated release incident on every failed guarded release
• notify success only after the durable event PR is merged
• suppress redundant automatic approval-gated CI for generated maintenance state/event PRs while retaining exact-head dispatched gates

Verification

• scripts/test.sh
• exact replay of the July 31 investigation and failed-release evidence artifacts
• full A00–A20 cross-repository verifier (digest sha256:9d9c1315ce23411c111310a47a28ff45121bc35868ee7aece900517e6569a537)
• no credentials or generated build artifacts committed

Summary by CodeRabbit

• New Features

  • Added validation for recaptured release evidence, including manifests, schemas, health statuses, digests, and completeness.
  • Added a command to run recaptured-evidence validation.

• Bug Fixes

  • Improved release failure handling with structured diagnostics and critical failure notifications.
  • Ensured notifications are sent only after final event changes are merged.

• Workflow Improvements

  • Maintenance-only changes no longer trigger standard pull request checks.

[coderabbitai]

Warning

Review limit reached

@loadinglucian, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 54 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 29867e21-1299-4cbf-a22f-e76e08bcc6a2

📥 Commits

Reviewing files that changed from the base of the PR and between 0487215 and f70516e.

📒 Files selected for processing (4)

• .github/workflows/maintenance-release.yml
• .github/workflows/protected-controls.yml
• maintenance/control.py
• tests/test_maintenance.py

📝 Walkthrough

Walkthrough

The change validates recaptured release evidence, separates completion notifications from event creation, adds structured release-failure handling, and excludes maintenance state and event paths from selected pull-request workflows.

Changes

Maintenance release controls

Layer / File(s)	Summary
Recaptured evidence validation maintenance/control.py, tests/test_maintenance.py	Adds manifest, capture, digest, and plan-evidence validation through validate_recaptured_evidence and its CLI command. Tests cover runtime evidence and digest changes.
Release completion and failure handling .github/workflows/maintenance-release.yml, tests/test_maintenance.py	The release workflow validates recaptured evidence, notifies the owner after the final event merge, and creates and sends structured failure events when the release fails.
Maintenance path trigger filtering .github/workflows/ci.yml, .github/workflows/protected-controls.yml, tests/test_maintenance.py	Adds paths-ignore filters for maintenance-state/** and maintenance-events/** and verifies the workflow configuration.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MaintenanceReleaseWorkflow
  participant ValidateRecapturedEvidenceCLI
  participant GitHub
  MaintenanceReleaseWorkflow->>ValidateRecapturedEvidenceCLI: Validate recaptured evidence
  ValidateRecapturedEvidenceCLI-->>MaintenanceReleaseWorkflow: Return verification result
  MaintenanceReleaseWorkflow->>GitHub: Merge final event record
  GitHub-->>MaintenanceReleaseWorkflow: Return merge result
  MaintenanceReleaseWorkflow->>GitHub: Notify owner after completion
  MaintenanceReleaseWorkflow->>GitHub: Create critical failure event on release failure

Loading

Possibly related PRs

• Bigpixelrocket/php-bin#7: Adds the maintenance control framework that this change extends.
• Bigpixelrocket/php-bin#32: Modifies the same CI and protected-controls workflows and related automation checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: recovery of the guarded maintenance release.
Description check	✅ Passed	The description includes a clear summary and verification details, but it omits the dedicated Security and licensing section.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/release-failure-recovery

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/maintenance-release.yml:
- Around line 348-360: Update the shell steps at
.github/workflows/maintenance-release.yml lines 348-360 and 386-404 to expose
inputs.action_key, inputs.version, inputs.exact_commit, and
inputs.investigation_run_id through step-level environment variables with
explicit schema validation, then replace direct GitHub expressions in shell
commands with quoted environment-variable references. Apply the same
input-handling pattern to both the failure diagnostic step and its sibling step,
while leaving releaseRunId and runUrl based on GitHub context.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 89f12ff7-5441-4c0c-93fb-99a15f763eb4

📥 Commits

Reviewing files that changed from the base of the PR and between 1cbae3c and 0487215.

📒 Files selected for processing (5)

• .github/workflows/ci.yml
• .github/workflows/maintenance-release.yml
• .github/workflows/protected-controls.yml
• maintenance/control.py
• tests/test_maintenance.py