release: prepare v18.1.1 automation#675
Merged
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis PR adds release-runbook guidance, release/tag automation, versioned release signposts, and updates operations documentation links to the consolidated docs layout. ChangesRelease automation and documentation topology
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Release Preflight
If this PR is from a |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-autotag.yml:
- Around line 83-87: The release-autotag workflow is still using the generic
final-local preflight path instead of the tag-aware release guard. Update the
Final release preflight step in the release-autotag workflow to call the same
explicit preflight/guard flow used by release.yml, passing the release stage and
steps.metadata.outputs.tag before git tag rather than relying on npm run
release:preflight. Refer to the Final release preflight step and the
release-preflight.sh / release guard wiring to locate the change.
- Around line 22-30: The workflow setup in the release-autotag job should not
leave the checkout token persisted and should avoid floating action versions.
Update the actions/checkout and actions/setup-node usages in this workflow to
pinned commit SHA references, and set persist-credentials to false on the
checkout step so later install or preflight steps cannot reuse the repo write
token.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b11eb802-8119-4ff8-b73e-d1e72e14e28a
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (23)
.github/CONTRIBUTING.md.github/RELEASE.md.github/workflows/release-autotag.yml.github/workflows/release-pr.ymlAGENTS.mdARCHITECTURE.mdCHANGELOG.mdREADME.mddocs/operations/README.mddocs/topics/README.mddocs/topics/cli.mddocs/topics/content-and-cas.mddocs/topics/git-substrate.mddocs/topics/strands.mddocs/topics/troubleshooting.mdjsr.jsonpackage.jsonpackages/warp-adapters/package.jsonpackages/warp-kernel/package.jsonpackages/warp-orset/package.jsonscripts/check-docs-topology.shscripts/release-guard.shscripts/release-preflight.sh
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/release-autotag.yml (2)
84-88: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winPass the tag through an env var to avoid template-injection into the shell.
${{ steps.metadata.outputs.tag }}is expanded directly into theruncommand, so any shell metacharacters in the value execute in the runner context. Although the tag derives frompackage.json's version, binding it to anenvvalue and referencing"$TAG"removes the injection surface (zizmortemplate-injection).🔒 Proposed fix
- name: Final release preflight if: steps.release_pr.outputs.should_release == 'true' && steps.metadata.outputs.tag_exists != 'true' env: GH_TOKEN: ${{ github.token }} - run: bash scripts/release-preflight.sh --stage final-local --tag "${{ steps.metadata.outputs.tag }}" + TAG: ${{ steps.metadata.outputs.tag }} + run: bash scripts/release-preflight.sh --stage final-local --tag "$TAG"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-autotag.yml around lines 84 - 88, The Final release preflight step is expanding the tag directly inside the shell command, which creates a template-injection risk. Update the release-autotag workflow job to pass the metadata tag through an env variable on the same step, then reference that variable in the bash invocation instead of interpolating steps.metadata.outputs.tag directly. Keep the fix scoped to the Final release preflight step and preserve the existing release-preflight.sh arguments and GH_TOKEN setup.Source: Linters/SAST tools
90-100: 🩺 Stability & Availability | 🔴 CriticalAuthenticate the tag push after disabling checkout credentials.
persist-credentials: falseremoves the token from.git/config, sogit push origin "refs/tags/$TAG"has no auth and will fail. Re-add credentials for this step or push the tag throughgh/the GitHub API.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-autotag.yml around lines 90 - 100, The release tag creation step is pushing a tag without authentication because checkout credentials are disabled, so update the Create release tag job to restore auth before the git push or switch the push to use GitHub CLI/API. Use the existing tag flow around steps.release_pr.outputs.should_release, steps.metadata.outputs.tag_exists, and the git tag/git push commands, and ensure the tag push has valid credentials available even when persist-credentials is false.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/release-autotag.yml:
- Around line 84-88: The Final release preflight step is expanding the tag
directly inside the shell command, which creates a template-injection risk.
Update the release-autotag workflow job to pass the metadata tag through an env
variable on the same step, then reference that variable in the bash invocation
instead of interpolating steps.metadata.outputs.tag directly. Keep the fix
scoped to the Final release preflight step and preserve the existing
release-preflight.sh arguments and GH_TOKEN setup.
- Around line 90-100: The release tag creation step is pushing a tag without
authentication because checkout credentials are disabled, so update the Create
release tag job to restore auth before the git push or switch the push to use
GitHub CLI/API. Use the existing tag flow around
steps.release_pr.outputs.should_release, steps.metadata.outputs.tag_exists, and
the git tag/git push commands, and ensure the tag push has valid credentials
available even when persist-credentials is false.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9f7fe4b1-100a-4877-ae2e-2336ad045cdd
📒 Files selected for processing (2)
.github/workflows/release-autotag.ymlscripts/release-preflight.sh
Release Preflight
If this PR is from a |
Release Preflight
If this PR is from a |
This was referenced Jun 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v18.1.1as the provenance-correct patch release from currentmaindocs/topics/todocs/operations/.github/RELEASE.mdas the contributor/maintainer release runbookRelease Autotagso mergedrelease/*PRs run final preflight, create the tag onmain, and dispatchrelease.yml18.1.1Closes #673
Validation
npm run release:guard -- --stage prep-pr --tag v18.1.1npm run release:prepnpm run lintnpm run lint:mdnpm run lint:md:codenpm run lint:docs-topologynpm run typecheck:srcnpm run typecheck:policynpm run typecheck:consumernpm run typecheck:surfacenpx vitest run test/unit/scripts/repository-standard-docs.test.ts test/unit/scripts/dependency-hygiene.test.ts test/unit/scripts/markdownlint-config.test.tsRelease behavior
When this PR merges to
main,.github/workflows/release-autotag.ymlshould detect the mergedrelease/v18.1.1branch, runnpm run release:preflight, createv18.1.1at the merge commit, and dispatchrelease.ymlwith that tag.Summary by CodeRabbit
New Features
release/*branches, with a PR-time release-prep guard.Bug Fixes
@git-stunts/alfredtimeout fix.Chores
docs/operations/; updated and validated required release docs and strengthened release-preflight/guard checks.