fix: Action as brand color + release deploy race condition

[jackgranatowski]

Summary

Two post-release fixes.

1. Action is a brand color, not a status color

The Colors panel grouped action under "Status colors" alongside success/warning/error/info/danger. But action is the interactive/CTA accent — a brand color. Moved it:

• brandColors.js: action.group → 'brand'
• DomainPanel.svelte: action now lives in the "Extended brand colors" accordion (with Secondary/Tertiary); Status section is now success/warning/error/info/danger only.

2. Release deploy race condition (configurator showed stale version)

Symptom: after releasing v0.6.7, the deployed configurator still showed v0.6.6.

Root cause: the sync-main job pushes the version-bump commit to main, then immediately dispatches deploy-configurator.yml and publish-dist.yml via gh workflow run --ref main. GitHub's API lags a few seconds behind a just-completed push, so the dispatch resolved main to the pre-bump HEAD. Both downstream workflows built from the old commit and baked the previous version (the configurator version pill is stamped at Vite build time from package.json).

Fix:

• release.yml: capture git rev-parse HEAD as deploy_ref right after the push, pass it as -F git_ref=<sha> to both dispatches.
• deploy-configurator.yml + publish-dist.yml: new optional git_ref workflow_dispatch input; checkout uses ${{ inputs.git_ref || github.sha }}. Release-dispatched runs now build the exact version-bumped commit. Push-triggered runs are unchanged (empty input → github.sha).

Note on the current v0.6.7 deployment

This fix prevents recurrence. To correct the already-deployed v0.6.7 configurator, re-run deploy-configurator.yml from the Actions tab (leave git_ref blank — main now points at the v0.6.7 sync commit).

Test plan

• action appears under Extended brand colors, not Status
• Workflow YAML wiring verified (git_ref plumbed through all three files)
• Next release deploys the correct version (validated on next npm run release)

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fg7U9rTiqBgbsPuz9kdWea

---

Generated by Claude Code

---

Summary by cubic

Reclassifies the action color as a brand color in the configurator UI. Fixes a release deploy race so downstream builds use the correct versioned commit and ensures dist provenance is stamped with the actual built SHA.

• Bug Fixes

  • Colors panel: move action to Extended brand colors with Secondary/Tertiary; Status now only success/warning/error/info/danger.
  • CI: release.yml captures the post-push SHA and passes it as git_ref to deploy-configurator.yml and publish-dist.yml; both workflows accept optional git_ref and check out ${{ inputs.git_ref || github.sha }}.
  • CI: publish-dist.yml resolves the checked-out SHA after checkout and uses it for SOURCE.txt and the dist commit message, so provenance matches the built tree when a custom git_ref is used.

• Migration

  • To correct the existing v0.6.7 deploy, re-run deploy-configurator.yml from Actions with git_ref left blank.

^{Written for commit cf80a88. Summary will update on new commits.}

Summary by CodeRabbit

• Improvements
  • The action color now appears in the "Extended brand colors" section of the Colors panel, providing better color organization in the configurator.

[coderabbitai]

📝 Walkthrough

Walkthrough

Two independent changes: the CI release pipeline is updated so release.yml captures the exact post-sync commit SHA and passes it as a git_ref input when dispatching deploy-configurator.yml and publish-dist.yml, which are updated to accept and use that input at checkout. Separately, the configurator reclassifies the action color key from the status group to the brand group.

Changes

CI/CD: Pin downstream deploys to exact post-sync SHA

Layer / File(s)	Summary
Add git_ref input and checkout logic to downstream workflows .github/workflows/deploy-configurator.yml, .github/workflows/publish-dist.yml	Both workflows gain an optional workflow_dispatch input git_ref and update their checkout step to use inputs.git_ref || github.sha.
Capture post-sync SHA and dispatch with it in release.yml .github/workflows/release.yml	The sync-main job captures the post-push commit SHA into steps.commit_push.outputs.deploy_ref and both downstream gh workflow run calls are updated to pass that SHA via -F git_ref="$DEPLOY_REF", removing reliance on main HEAD resolution at dispatch time.

Configurator: Reclassify action color to brand group

Layer / File(s)	Summary
Move action from status to brand and update panel filter configurator/src/lib/brandColors.js, configurator/src/components/DomainPanel.svelte	BRAND_COLOR_KEYS entry for action changes group from status to brand; DomainPanel.svelte extends the BRAND_SECONDARY filter to include action, placing it under the Extended brand colors section.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• codeslash-dev/SLASHED#320: Adds manual downstream dispatching after sync-main push to the same deploy-configurator.yml and publish-dist.yml targets — directly overlaps with this PR's dispatch timing and git_ref plumbing.
• codeslash-dev/SLASHED#353: Also modifies release.yml to alter when and how deploy-configurator.yml and publish-dist.yml are dispatched, touching the same dispatch logic this PR updates.
• codeslash-dev/SLASHED#369: Modifies DomainPanel.svelte brand/status color disclosure logic at the same code path where this PR moves the action token into the brand/secondary set.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The pull request title accurately summarizes both main changes: the action color categorization fix and the release deploy race condition fix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/configurator-v2-redesign-yk7qno

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish-dist.yml:
- Around line 52-54: The workflow uses github.sha which refers to the
workflow_dispatch trigger commit, not the actual checked-out ref. When git_ref
is provided and checkout occurs at that ref on line 54, the github.sha variable
still points to the wrong commit. Capture the actual commit SHA that was checked
out (either from the actions/checkout action output or by running git rev-parse
HEAD after checkout) and store it as a variable, then use that variable instead
of github.sha when creating SOURCE.txt around line 82 and in the commit message
around line 111 to ensure correct provenance tracking.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d9cafe4a-d393-41b0-a106-f6223dad4e37

📥 Commits

Reviewing files that changed from the base of the PR and between 89c46a5 and 69d1a55.

📒 Files selected for processing (5)

• .github/workflows/deploy-configurator.yml
• .github/workflows/publish-dist.yml
• .github/workflows/release.yml
• configurator/src/components/DomainPanel.svelte
• configurator/src/lib/brandColors.js

[cubic-dev-ai]

1 issue found and verified against the latest diff

_{You’re at about 91% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/publish-dist.yml">

<violation number="1" location=".github/workflows/publish-dist.yml:54">
P2: Build can run from `inputs.git_ref` but still records `GITHUB_SHA`, causing incorrect source-commit metadata. This can mislabel the published dist as built from a different commit than the one actually checked out.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Build can run from inputs.git_ref but still records GITHUB_SHA, causing incorrect source-commit metadata. This can mislabel the published dist as built from a different commit than the one actually checked out.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/publish-dist.yml, line 54:

<comment>Build can run from `inputs.git_ref` but still records `GITHUB_SHA`, causing incorrect source-commit metadata. This can mislabel the published dist as built from a different commit than the one actually checked out.</comment>

<file context>
@@ -44,6 +49,9 @@ jobs:
           persist-credentials: false
+          # When dispatched from release.yml, git_ref is the exact post-sync SHA
+          # so the dist bundles are always stamped with the released version.
+          ref: ${{ inputs.git_ref || github.sha }}
 
       # No dependency cache on the publish path: a poisoned cache could be
</file context>