Fix auto-release recovery workflow - #44
Conversation
|
Warning Review limit reached
More reviews will be available in 28 minutes and 31 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (5)
WalkthroughThe release-tag workflow now supports manual dispatch alongside the existing CI-triggered path, validates the supplied commit against main, and publishes tags through an authenticated Git remote. Related policy, runbook, and test updates describe and verify the manual recovery path. ChangesManual release tag recovery
Sequence Diagram(s)sequenceDiagram
participant workflow_dispatch as "workflow_dispatch"
participant identify_release_pr as "identify-release-pr"
participant create_release_tag as "create-release-tag"
participant origin_main as "origin/main"
workflow_dispatch->>identify_release_pr: tag, sha inputs
identify_release_pr->>origin_main: fetch tags and verify SHA ancestry
identify_release_pr-->>create_release_tag: release=true, tag, pr=manual, sha
create_release_tag->>origin_main: ls-remote, fetch, push tag via AUTHENTICATED_ORIGIN
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f5e0c10d5d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/auto-release-tag.yml:
- Around line 57-89: The manual dispatch path in the auto-release workflow is
too permissive because it trusts INPUT_TAG after only a SemVer check, allowing
arbitrary release tags to be minted for any origin/main-reachable SHA. Update
the workflow logic around the workflow_dispatch branch to reuse the existing
commit-to-PR lookup used elsewhere in this job, derive the expected release-prep
tag from that PR, and require it to match INPUT_TAG (or set TAG directly from
the PR data). Keep the release notes file check, but ensure the TAG/sha pairing
cannot be manually mismatched before writing to GITHUB_OUTPUT.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 5120a2b7-38e3-4b7f-b967-67baff0eb34f
📒 Files selected for processing (4)
.github/workflows/auto-release-tag.ymldocs/topics/release-process/policy.tomldocs/topics/release-process/runbook.mdxtask/src/main.rs
📜 Review details
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
**: # AGENTSGit Rules
NEVER amend git commits. Make a new commit instead.
NEVER use
git rebaseunless the user explicitly approves a rare exception.
Use regular merge commits.NEVER force any git operation. If a force operation appears necessary, stop and
explain what happened and what options remain.NEVER create draft pull requests.
NEVER use a
codexprefix in branch names, PR titles, or commit messages.Pull request bodies for issue work MUST include GitHub auto-close text such as
Closes#123`` for every issue the PR is intended to close.Think
Think is durable memory for cross-session coordination.
- Use
codex-think --remember --jsonwhen starting a new session, changing into
this repository, or regaining context after a context shift.- Use
codex-think "..." --jsonwhen a cycle closes or a significant event
should survive across turns.- Treat Think as memory, not repo truth. Anchor strong claims back to files,
commits, commands, issues, or pull requests.- Claude memories are read-only. Use
claude-think --remember --jsononly for
additional context.Topic Shelves
docs/topics/contains the living contract graph for landed behavior. Topic
shelves are not proposals, retrospectives, or design archaeology.Each shelf may contain:
README.md: what is true in HEAD.test-plan.md: how those truths are verified, including requirements, cases,
fixtures, oracles, implemented evidence, planned cases, and known gaps.architecture.md: optional structure or dataflow notes when the machinery
earns a separate page.rationale.md: optional still-relevant tradeoffs and rejected approaches.When To Update Topic Shelves
For every nontrivial behavior, contract, workflow, release, schema, validation,
or public-surface change:
- Identify the owning topic shelf before editing code.
- If no shelf owns durable behavior, create one.
- Update
test-plan.mdbefore or alongside tests with requirement IDs, case
IDs,...
Files:
docs/topics/release-process/policy.tomldocs/topics/release-process/runbook.mdxtask/src/main.rs
|
@codex please confirm this review-response pass. Activity Summary
RED/GREEN EvidenceRED observed before the fix:
GREEN after the fix:
The actual recovery inputs were also probed against GitHub: merge commit |
Review-response confirmationConfirmed: the review-response pass is valid on the current branch. I did not make any code changes, so I did not create a commit or PR. Findings checked
Testing
|
1 participant
Summary
Fixes the release automation failure observed after PR #43 merged by making the Auto Release Tag workflow manually recoverable and idempotent for a verified
tag + sha.Changes:
workflow_dispatchinputs to.github/workflows/auto-release-tag.ymlfor explicittagand verified mainsharecovery.origin/mainbefore tag creation.extraheaderauth path with an explicit authenticated remote used only forls-remote,fetch, andpush.RED
cargo test -p xtask auto_release_tag_manual_dispatch_checks_verified_main_shafailed beforeworkflow_dispatchrecovery existed.cargo test -p xtask auto_release_tag_uses_ephemeral_push_credentialsfailed before the workflow used an authenticated remote for Git network operations.cargo test -p xtask auto_release_tag_workflow_is_guardedfailed before manual recovery was represented in the workflow/policy contract.GREEN / VERIFY
cargo test -p xtask auto_release_tag_manual_dispatch_checks_verified_main_shacargo test -p xtask auto_release_tag_uses_ephemeral_push_credentialscargo test -p xtask auto_release_tag_workflow_is_guardedcargo test -p xtask release_actionlint .github/workflows/auto-release-tag.ymlnpx markdownlint-cli2 docs/topics/release-process/runbook.mdcargo xtask verifyRelease Recovery
After this PR lands, run:
Then watch Auto Release Tag and Release workflows.