ci: add coverage, security, and weekly prereleases - #59
Merged
Conversation
…-automated-bots # Conflicts: # .github/workflows/super-synara-prerelease.yml # scripts/lib/super-synara-workflow-contract.test.ts # scripts/lib/super-synara-workflow-contract.ts
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe PR adds CI reporting, dependency review, CodeQL, merge queuing, Release Drafter scheduling, exact-source prerelease publication, stricter GitHub state validation, asset consistency checks, and workflow contract tests. ChangesCI, security, and workflow governance
Release Drafter planning and dispatch
Exact prerelease publication and state admission
Release workflow contract enforcement
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
Comment |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Welcome to Codecov 🎉Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests. Thanks for integrating Codecov - We've got you covered ☂️ |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review completed against the latest diff
Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.
Re-trigger cubic
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
107-128: 🩺 Stability & Availability | 🔵 TrivialCodecov fork-PR uploads are fine on this repo. Public repositories can upload tokenlessly from fork PRs, so the missing same-repo fork guard isn’t a blocker here. Keep the fail-closed merge gating only if blocking the quality job during a Codecov/Mergify outage is intentional.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 107 - 128, Review the Codecov upload steps for the intended failure policy: retain the existing fail-closed merge gating via fail_ci_if_error only if blocking the quality job during Codecov or Mergify outages is deliberate; otherwise adjust that setting in both “Upload coverage reports to Codecov” and “Upload test results to Codecov” consistently.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 107-128: Review the Codecov upload steps for the intended failure
policy: retain the existing fail-closed merge gating via fail_ci_if_error only
if blocking the quality job during Codecov or Mergify outages is deliberate;
otherwise adjust that setting in both “Upload coverage reports to Codecov” and
“Upload test results to Codecov” consistently.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 8a3fd37c-f8bb-4e10-b4e8-752490718664
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (20)
.github/release-drafter.yml.github/workflows/ci.yml.github/workflows/codeql.yml.github/workflows/dependency-review.yml.github/workflows/release-drafter.yml.github/workflows/super-synara-prerelease.yml.gitignore.mergify.ymldocs/downstream/workflow-policy.jsonpackage.jsonscripts/lib/super-synara-release-drafter.test.tsscripts/lib/super-synara-release-drafter.tsscripts/lib/super-synara-release-state.test.tsscripts/lib/super-synara-release-state.tsscripts/lib/super-synara-workflow-contract.test.tsscripts/lib/super-synara-workflow-contract.tsscripts/lib/workflow-contracts.test.tsscripts/lib/workflow-contracts.tsscripts/plan-super-synara-release-drafter.tsscripts/verify-super-synara-github-state.ts
There was a problem hiding this comment.
Review completed against the latest diff
Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.
Re-trigger cubic
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/lib/gh-cli.ts`:
- Around line 57-60: Update the error mapping in the gh CLI execution flow
around spawn and GhCliStartError so an ETIMEDOUT result is surfaced as
GhCliRequestError, preserving the release-state retry path; continue mapping
other process-start failures to GhCliStartError.
In `@scripts/lib/super-synara-release-drafter.ts`:
- Around line 15-28: Remove the local SuperSynaraTagRef and
SuperSynaraDraftRelease interface declarations and reuse the shared definitions
from super-synara-github-payload.ts (or a common shared module) in
resolveSuperSynaraDraftPlan and its related code. Update imports and ensure
parseSuperSynaraMatchingTagRefs and parseSuperSynaraReleasePages continue
flowing through the shared contract without duplicating type shapes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: a1252ec2-fae2-4fca-b203-da6429c1b396
📒 Files selected for processing (25)
.github/workflows/ci.yml.github/workflows/release-drafter.yml.github/workflows/super-synara-prerelease.yml.gitignore.mergify.ymldocs/downstream/workflow-policy.jsonscripts/lib/gh-cli.test.tsscripts/lib/gh-cli.tsscripts/lib/git-sha.test.tsscripts/lib/git-sha.tsscripts/lib/super-synara-github-payload.test.tsscripts/lib/super-synara-github-payload.tsscripts/lib/super-synara-release-admission.tsscripts/lib/super-synara-release-drafter.tsscripts/lib/super-synara-release-identity.test.tsscripts/lib/super-synara-release-identity.tsscripts/lib/super-synara-release-state.test.tsscripts/lib/super-synara-release-state.tsscripts/lib/super-synara-workflow-contract.test.tsscripts/lib/super-synara-workflow-contract.tsscripts/lib/workflow-contracts.test.tsscripts/lib/workflow-contracts.tsscripts/plan-super-synara-release-drafter.tsscripts/verify-super-synara-github-state.tsscripts/verify-workflow-contracts.ts
🚧 Files skipped from review as they are similar to previous changes (11)
- .mergify.yml
- .gitignore
- docs/downstream/workflow-policy.json
- .github/workflows/ci.yml
- scripts/plan-super-synara-release-drafter.ts
- .github/workflows/release-drafter.yml
- scripts/lib/super-synara-workflow-contract.test.ts
- scripts/lib/workflow-contracts.ts
- scripts/verify-super-synara-github-state.ts
- scripts/lib/workflow-contracts.test.ts
- scripts/lib/super-synara-workflow-contract.ts
There was a problem hiding this comment.
All reported issues were addressed across 23 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
slashdevcorpse
added
the
ready-to-merge
|
Queued — the merge queue status continues in this comment ↓. |
Owner
Author
|
@Mergifyio queue |
Merge Queue Status
Waiting for
All conditions
|
This was referenced Jul 21, 2026
This was referenced Jul 21, 2026
This was referenced Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release-engine decision
Release Drafter fits the repository's existing platform build, byte-validation, provenance, and GitHub artifact publication flow. semantic-release would take ownership of version, tag, registry, and publication semantics that this repository already controls, so it is intentionally not installed or configured.
Verification
The full cross-workspace CI suite is delegated to GitHub's Ubuntu runner because the local Windows checkout has existing platform-sensitive assumptions.
Summary by cubic
Adds coverage reporting, security scans, and weekly unsigned Super Synara prereleases via
Release Drafter. Hardens release reads with bounded GitHub CLI calls and strict payload decoding; CI fails closed onMergifyInsights upload.New Features
test:ciwith V8 coverage and JUnit; upload toCodecovandMergifyCI Insights.CodeQLon PRs, pushes, and weekly.Release Drafterto keep one owned draft; publisher runs viaworkflow_call; require exact draft ID, tag, and source SHA; enforce marker + title; add after-publish visibility check; no-op when no changes; bound GitHub reads with timeouts/retries and strict tag/release payload decoding.Mergifymerge queue onmain.Migration
MERGIFY_TOKEN(for CI Insights) andCODECOV_TOKENrepository secrets.Written for commit a718f44. Summary will update on new commits.
Summary by CodeRabbit
New Features
Quality Improvements
Chores
main.Greptile Summary
This PR adds Codecov LCOV/JUnit coverage reporting, CodeQL and dependency-review security workflows, a Mergify serial merge queue, and a weekly Release Drafter–driven unsigned Super Synara prerelease pipeline. The release automation is wired through a strict contract-validation layer that enforces actor identity, draft ownership, commit pinning, atomic tag creation, and byte-level payload verification.
test:cinow emits V8 coverage and JUnit XML that upload to both Codecov and Mergify CI Insights; the verify step fails closed if Mergify upload is unconfirmed (fork PRs are excluded to protect secrets).release-drafter.ymlscheduler runs onmainpushes (draft only), weekly cron, and manual dispatch; thedispatchjob calls the refactoredsuper-synara-prerelease.yml(nowworkflow_call–only) with the exact draft ID, tag, source SHA, and an explicitconfirm_unsigned: true— the planner, GitHub state verifier, and contract tests all updated accordingly.codeql.ymlanddependency-review.ymlare added with commit-pinned actions and least-privilege permissions;verifySuperSynaraWorkflowContractswas extended to validate the new Release Drafter scheduler and planner scripts.Confidence Score: 5/5
Safe to merge — all publication phases are fail-closed, contract tests cover the full pipeline shape, and the previous review findings have been addressed.
The retry loop in
verify-super-synara-github-state.tsnow correctly wraps bothrunGhcalls (the prior concern), the dead-code!reservedTag &&guard is absent from the new drafter, and theCI_CODECV_*typo is fixed. The one remaining observation is a type-system mismatch oncurrentRunDraftIdthat does not affect runtime behavior. The new Release Drafter scheduler, planner, and state-verifier are all guarded by thorough contract tests.No files require special attention;
scripts/lib/super-synara-release-state.tshas a minor type annotation inconsistency worth cleaning up but no behavioral risk.Important Files Changed
runGhcalls are now inside thetry/catchblock (addressing the prior review comment); all 30-attempt retry + bounded delay logic is correct and the contract test enforces the ordering.!reservedTag &&dead-code guard is not present in this version.validateSuperSynaraGitHubPolicysplit and visibility-retry error class.currentRunDraftIdis typed as optional in bothSuperSynaraGitHubStateInputand thePick-derivedSuperSynaraGitHubPolicyInput, but the function uses a!non-null assertion; safe at runtime but slightly misleading.should_releaseand calls the prerelease publisher. Actor normalization, rerun authorization, no-change gate, and race-reject step are all in place and enforced by contract tests.workflow_call–only; addsrelease_draft_idinput, newbefore-draft/after-draft/after-publishphase validations, and a post-publish visibility check. TheverifySuperSynaraWorkflowTextcontract exhaustively guards the new shape.verifySuperSynaraReleaseDrafterTextandverifySuperSynaraReleasePlannerScriptText; previously flaggedCI_CODECV_*typo is fixed toCI_CODECOV_*.GhCliStartError(binary missing) is not retryable — correct.bun run testwithtest:ci(V8 + JUnit); adds Mergify CI Insights upload with fail-closed verify step and two Codecov uploads (coverage + test results). Fork-PR paths correctly excluded from secret-bearing steps.mainrequiring all status checks to pass.Sequence Diagram
%%{init: {'theme': 'neutral'}}%% sequenceDiagram participant Schedule as schedule / push / workflow_dispatch participant Drafter as release-drafter.yml (draft job) participant Planner as plan-super-synara-release-drafter.ts participant RD as release-drafter action participant Verifier as verify-super-synara-github-state.ts participant Publisher as super-synara-prerelease.yml participant GH as GitHub API Schedule->>Drafter: trigger Drafter->>GH: GET /git/ref/heads/main (bind source SHA) Drafter->>Planner: resolve owned draft plan Planner->>GH: GET matching-refs/tags/super-v… Planner->>GH: GET releases (paginated) Planner-->>Drafter: version, tag, existingDraftId Drafter->>Drafter: gate on new commits (should_release) Drafter->>RD: create/update draft (publish:false, prerelease:true, latest:false) RD->>GH: PATCH/POST draft release Drafter->>Verifier: --phase preflight (30-attempt retry loop) Verifier->>GH: GET tag ref + releases (retries transient errors) Drafter->>GH: verify main SHA unchanged Note over Drafter: push events stop here (draft only) Drafter-->>Publisher: "dispatch (schedule/manual only, should_release==true)" Publisher->>Publisher: preflight (checkout, build, test, validate) Publisher->>Verifier: --phase before-draft Publisher->>Publisher: adopt owned draft, upload artifacts, redownload+compare Publisher->>Verifier: --phase after-draft Publisher->>Verifier: --phase before-publish Publisher->>GH: "PATCH draft to published (atomic tag creation, make_latest=false)" Publisher->>Verifier: --phase after-publish (visibility retry) Publisher->>GH: verify not GitHub Latest%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%% sequenceDiagram participant Schedule as schedule / push / workflow_dispatch participant Drafter as release-drafter.yml (draft job) participant Planner as plan-super-synara-release-drafter.ts participant RD as release-drafter action participant Verifier as verify-super-synara-github-state.ts participant Publisher as super-synara-prerelease.yml participant GH as GitHub API Schedule->>Drafter: trigger Drafter->>GH: GET /git/ref/heads/main (bind source SHA) Drafter->>Planner: resolve owned draft plan Planner->>GH: GET matching-refs/tags/super-v… Planner->>GH: GET releases (paginated) Planner-->>Drafter: version, tag, existingDraftId Drafter->>Drafter: gate on new commits (should_release) Drafter->>RD: create/update draft (publish:false, prerelease:true, latest:false) RD->>GH: PATCH/POST draft release Drafter->>Verifier: --phase preflight (30-attempt retry loop) Verifier->>GH: GET tag ref + releases (retries transient errors) Drafter->>GH: verify main SHA unchanged Note over Drafter: push events stop here (draft only) Drafter-->>Publisher: "dispatch (schedule/manual only, should_release==true)" Publisher->>Publisher: preflight (checkout, build, test, validate) Publisher->>Verifier: --phase before-draft Publisher->>Publisher: adopt owned draft, upload artifacts, redownload+compare Publisher->>Verifier: --phase after-draft Publisher->>Verifier: --phase before-publish Publisher->>GH: "PATCH draft to published (atomic tag creation, make_latest=false)" Publisher->>Verifier: --phase after-publish (visibility retry) Publisher->>GH: verify not GitHub LatestReviews (4): Last reviewed commit: "fix(ci): harden bounded release reads" | Re-trigger Greptile