Skip to content

Code Tribunal 2.1.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Oct 20:32
· 18 commits to main since this release
v2.1.0
This tag was signed with the committer’s verified signature.
seanleecoder Sean Lee
SSH Key Fingerprint: XzgC228E9yEpmr6y+Gj5M7N8fCzlMTKbXsv2kHJHvNE
Verified
Learn about vigilant mode.
a965da6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Review health in the summary comment (SPEC-66). Every published run now
    creates or refreshes the summary comment, including a clean run with no
    findings. Its first section shows a full, degraded or re-run recommended
    grade, the completed review and critique jobs, panel-wide finding counts, each
    failed job with its redacted error, and one action line. Collapsed run details
    give each job's model, effort, outcome and duration. A failed panel is still
    not published; the consensus job log now prints the same health report
    before exiting 3. Consensus reads the adapter status files through a new
    --status-dir argument, which both canonical templates pass, and writes the
    record as run_health, an optional property of consensus.v2. Health never
    changes a decision, panel_status or an exit code. Post refuses a consensus
    artifact without run_health, which means one from an earlier release. Each
    existing summary comment is refreshed once on the next run.

Changed

  • Inline threads hash only their rendered text (N12), as the summary comment
    already did. The marker's source= is no longer read and is written as 64
    zeros, so 2.0.3 can still read 2.1.0 markers after a rollback; markers with
    or without it remain valid. Each existing bot-authored inline thread surfaced on
    its next run is edited once in place, with the same issue ID and state record;
    its visible text is unchanged. group.body_hash in consensus.json is now
    always 64 zeros: posting computes the hash from the body it publishes, and the
    field is removed in consensus.v3.
  • Consensus no longer re-checks values the adapter runner computes: a finding
    batch's counts, its usable_for_resolution flag, and its model (N15). The
    schema still bounds the counts, and the config-digest binding covers the
    model. A critique whose duplicate_of_source_finding_id names no finding in
    the run now counts as a dispute, like any other unusable duplicate link,
    instead of failing consensus.
  • Contributor tooling: Renovate keeps the npm, Python, image-digest and action
    pins current, and make quality runs zizmor's pinning audits over the GitHub
    Actions workflows. The in-repo pin checker keeps only the checks neither tool
    makes, and now requires every Dockerfile FROM to be digest-pinned. Nothing
    changes for consumers.
  • Release process (ADR-0004):
    a release is the SSH-signed tag whose canonical templates pin both images by
    digest, published only after a cited Candidate Canary run on those digests is
    verified. The release body is the version's CHANGELOG section followed by its
    identity: runtime source, release commit, both image references, the canary
    verdicts, and the gh attestation verify command. Releases no longer attach a
    release manifest or checksum asset, release/<version>.md notes and
    release/release-inputs.json are no longer published, and tags carry a
    Canary-run: trailer instead of Release-manifest-sha256. Releases up to 2.0.3
    are unchanged. The generated evidence records are gone from docs/evidence/;
    each earlier release's records remain at its tag.
  • Upgraded reviewer CLIs to Claude Code 2.1.303, Codex 0.163.0, OpenCode
    1.19.3, and Cursor Agent 2026.10.18-ea085cb; refreshed the Python, Node builder
    and Debian base image digests, Node to 26.12.0, certifi to 2026.10.18, rpds-py
    to 2026.9.1, and Ruff to 0.17.1. OpenCode remains paired with its expected
    ripgrep 15.1.0.

Release identity

  • Runtime source (R): 6ca538106d1eef7f449e5227408c99013c75aedc
  • Release commit (P): a965da627ac866461bdcf6630f0897d00e4d28c9
  • Base image: ghcr.io/seanleecoder/code-tribunal/ai-review-base:2.1-6ca538106d1eef7f449e5227408c99013c75aedc@sha256:d855b177b4bfcd109f7cf1c8d86908a98dc22e83c4fbce911fdad4a68ccdaa52
  • Reviewer image: ghcr.io/seanleecoder/code-tribunal/ai-review-reviewer:2.1-6ca538106d1eef7f449e5227408c99013c75aedc@sha256:280c858d58ceee662c95f02455bb6da3846802a5d19234dc28872c02df8fa985
  • Candidate Canary: https://github.com/seanleecoder/code-tribunal/actions/runs/39315351495
    • panel / github: full panel, 7 threads posted, cleanup succeeded
    • panel / gitlab: full panel, 2 threads posted, cleanup succeeded
    • lifecycle / github: 7/7 steps passed
    • lifecycle / gitlab: 6/6 steps passed
    • hostile / gitlab: 5/5 steps passed
  • Publication: https://github.com/seanleecoder/code-tribunal/actions/runs/39320078400

Verify an image's build provenance, for example the reviewer image:

gh attestation verify oci://ghcr.io/seanleecoder/code-tribunal/ai-review-reviewer:2.1-6ca538106d1eef7f449e5227408c99013c75aedc@sha256:280c858d58ceee662c95f02455bb6da3846802a5d19234dc28872c02df8fa985 \
  --repo seanleecoder/code-tribunal \
  --predicate-type https://slsa.dev/provenance/v1 \
  --source-ref refs/heads/main --source-digest 6ca538106d1eef7f449e5227408c99013c75aedc \
  --cert-identity https://github.com/seanleecoder/code-tribunal/.github/workflows/publish-ai-review-images.yml@refs/heads/main
Assets 2
Loading