feat(release): pinned-version report — Safe Release SC8 (#502) - #724
Conversation
The Safe Release epic (#495) had drift detection (ring-pins.sh, canary-rings lint, template_stub_drift.sh) but no single 'who is on what version' surface (SC8). Add scripts/pinned-version-report.sh + a weekly workflow: for each fleet repo x ring reusable it finds the caller-stub uses: pin, resolves the @<agent>/<channel> tag to the immutable <agent>/vX.Y.Z release it points at (matching tag SHAs on the host repo), reports ring tier / pinned channel / resolved version, and flags ring-tier drift. Read-only. Live run already surfaces real drift (e.g. a SHA-pinned feature-ideation stub that never resolved to a release). Closes the SC8 residual of #502 (rollback half already shipped via cut-release). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Juznz5V6su81ffSND8fg7s
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 36 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (5)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new Bash script, scripts/pinned-version-report.sh, which generates a Markdown report detailing each ring consumer's currently-pinned channel and its resolved immutable version. The code review feedback provides several actionable improvements to enhance performance and robustness: replacing expensive sed subshells inside the nested loop with built-in Bash parameter expansion and regex matching, handling potential missing trailing newlines and carriage returns when reading TSV data, storing regular expressions in variables for safer matching, and using .content // empty in jq to prevent the literal string "null" from bypassing empty checks.
There was a problem hiding this comment.
Pull request overview
Adds an org-wide reporting surface to answer “who is pinned to what version” for ring-released reusable workflows, by scanning fleet repos’ workflow stubs, resolving each pinned channel to an immutable release version, and publishing the results on a weekly schedule (and on-demand).
Changes:
- Introduces
scripts/pinned-version-report.shto scan fleet repos, detect each reusable’s pinned ref, resolve it to avX.Y.Zrelease tag (when possible), and render a Markdown report (including drift flags and a version fan-out summary). - Adds a scheduled GitHub Actions workflow to run the report weekly and publish it to the run step summary.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| scripts/pinned-version-report.sh | New Bash reporter that enumerates org repos, extracts pinned uses: refs for ring reusables, resolves channel→release versions, and renders a Markdown summary. |
| .github/workflows/pinned-version-report.yml | Weekly + manual workflow to execute the report in CI and write output to the step summary. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 4f2149768edab90af1c91a334f90be5c798c1cfc
Review mode: triage-approved (single reviewer)
Summary
Adds a read-only weekly pinned-version report (scripts/pinned-version-report.sh + workflow) for Safe Release SC8, with a bats suite, gh stub, and a dedicated CI test workflow. Purely additive (5 new files, 383+/0-), all CI green, triage assessment confirmed.
Linked issue analysis
Linked work item is petry-projects/.github-private#502 ([Phase 2] One-action rollback + per-version observability report, targets SC4/SC8). The rollback half (SC4) already shipped via cut-release.sh --promote; this PR delivers the SC8 residual — a per-version observability report showing each consumer's pinned channel and the immutable release it resolves to, plus ring-tier drift flags. Done-when criterion ('a which-version report shows tag→commit per ring/consumer') is substantively met. Note: the PR body's bare '#502' resolves to an unrelated item in the .github repo — the reference is cross-repo, not missing.
Findings
Security (no blockers):
- New scheduled workflow consumes the org PAT (GH_PAT_WORKFLOWS) — usage is read-only (GET-only script), triggers are schedule/workflow_dispatch (not attacker-controllable), permissions are contents: read, actions are SHA-pinned with persist-credentials: false, and no untrusted input is interpolated into run blocks. PAT usage drives the MEDIUM classification but follows this repo's established pattern.
- MCP secret scanning tool unavailable in this run; the gitleaks CI check passed and no secret-like content appears in the diff.
Correctness (minor, non-blocking):
- printf '%b' "$rows" would interpret backslash escapes in repo names — cosmetic only, org repo names are controlled.
- Drift case pattern *"$tier" is a suffix match; an unconventional channel name (e.g. 'unstable' vs tier 'stable') could false-negative — report-only impact, covered channels follow the vN-ringN/stable convention.
Review threads: 9 of 10 threads resolved. The one UI-unresolved thread (Copilot: add bats tests + CI wiring) is substantively resolved — the requested bats suite, gh stub, and test workflow are all in this PR, the author replied in detail, and the 'Lint and bats' check passes. The bot cannot resolve its own thread.
CI status
All required checks green at 4f21497: CI (Lint, ShellCheck, Agent Security Scan, gitleaks), Pinned-version-report Tests (Lint and bats), CodeQL, SonarCloud (Quality Gate passed, 0 new issues / 0 hotspots), AgentShield, Dependency audit, CodeRabbit. Skipped checks are conditional ecosystem audits (pip/pnpm/cargo/govulncheck) — expected. Branch is BEHIND main but MERGEABLE.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: eeaf55f1fe4ad6009e089fb8cfd2bec4be17573b
Review mode: triage-approved (single reviewer)
Summary
Adds a read-only pinned-version reporting surface (SC8 residual of #502): scripts/pinned-version-report.sh scans fleet repos' caller stubs, resolves each @/ pin to its immutable vX.Y.Z release via tag-SHA matching, and flags ring-tier drift. Shipped with a weekly scheduled workflow (Mondays 08:00 UTC + workflow_dispatch, contents: read, SHA-pinned checkout), a bats test suite covering resolution/drift/fan-out paths, and a PATH-stubbed gh binary so tests need no live API. Confirms the triage assessment: the script is strictly GET-only, the org PAT (GH_PAT_WORKFLOWS) is guarded and used only for cross-repo reads, and no mutation paths exist. Since the prior automated approval at 4f21497, only main-branch merges landed (README/LICENSE/SECURITY.md/workflow-permissions); none touch this PR's files.
Linked issue analysis
No closing-issue link, by design: the PR closes the SC8 residual of #502 (rollback half already shipped via cut-release.sh --promote). The body documents live-fleet validation including two real drift findings, so the reporting goal of SC8 is substantively addressed.
Findings
- No blocking findings. All 10 prior review threads (gemini, copilot) are resolved — dev-lead fix-reviews commits addressed the sed-subshell, --limit 500, error-suppression, trailing-space fan-out, and PAT-guard items, with regression tests added (e.g. the #502 trailing-space bats test).
- Security: workflows use least-privilege permissions (contents: read), actions pinned by SHA, persist-credentials: false; the report script performs only GET calls; markdown output goes to the step summary (no workflow-command injection surface). Gitleaks and Agent Security Scan are green; the tests' GH_TOKEN is an explicit dummy. The run_secret_scanning MCP tool was unavailable in this session — gitleaks CI + manual inspection found no secrets.
- Minor (non-blocking): printf '%b' on repo-derived row content would interpret backslash escapes in odd repo/channel names (cosmetic rendering only); ref_regex in resolve_version is not declared local.
CI status
All required checks green at eeaf55f: ShellCheck, Lint and bats (new suite), CodeQL, SonarCloud quality gate, Agent Security Scan, Secret scan (gitleaks), npm audit, agent-shield. Two CANCELLED dev-lead dispatch/ci-relay entries are superseded duplicates of later SUCCESS runs.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Closes the SC8 residual of #502 (the rollback half already ships via
cut-release.sh --promote).What
scripts/pinned-version-report.sh+ a weekly workflow that publishes who is on what version across the fleet. For each repo × ring reusable it:uses:pin,@<agent>/<channel>tag to the immutable<agent>/vX.Y.Zrelease it points at (matching tag SHAs on the host repo),Read-only (GET-only, no mutation). Runs Mondays 08:00 UTC +
workflow_dispatch, writing to the run's step summary.Live output (real fleet, today)
Renders a full repo×reusable table with resolved versions (e.g.
dev-lead → v1.5.4,auto-rebase → v2.1.1) plus a per-reusable version fan-out. It already surfaces 2 real drifts — includingbroodly/feature-ideationpinned to a raw SHA that resolves to no release.Validation
bash -n+ shellcheck (0 findings); workflow YAML valid; executed live against the fleet.🤖 Generated with Claude Code
https://claude.ai/code/session_01Juznz5V6su81ffSND8fg7s