fix(release): defer prerelease tag until publication - #70
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe prerelease workflow now revalidates protected-main source provenance on Windows x64 and macOS arm64. Contract validation enforces exact fail-closed commands, while tests cover tagless pre-publication checks and broader before-publish state acceptance. ChangesPrerelease provenance validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Comment |
coderabbitai
Bot
added
the
ready-to-merge
55d9c14 to
952d3f2
Compare
coderabbitai
Bot
removed
the
ready-to-merge
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
|
Tick the box to add this pull request to the merge queue (same as
|
1 participant
Summary
Why
Release run 29876040712 failed safely before packaging because the Windows lane required
super-v0.5.5-super.9even though the workflow intentionally creates that tag only during the final atomic draft publication.Verification
bun run --cwd scripts test lib/super-synara-workflow-contract.test.ts lib/super-synara-release-state.test.tsnode scripts/verify-workflow-contracts.tsgit diff --checkSummary by cubic
Defer the prerelease tag until atomic draft publication so preflight, Windows, and macOS builds validate against the exact protected-main commit without the immutable tag. Post-publication builds still require the exact immutable tag.
github-unsigned-prerelease falseinpreflight,windows_x64, andmacos_arm64.VERSION/TAG/SOURCE_COMMITenv vars before publication; pin the shell to bash; reject conditional or error-ignored runs; normalize continued shell commands.Written for commit 33c6beb. Summary will update on new commits.
Summary by CodeRabbit
Greptile Summary
This PR fixes a real release failure (run 29876040712) by deferring the prerelease tag requirement from the build phase until atomic draft publication. Windows and macOS builds now validate against the protected-main source commit without needing the immutable tag pre-created; the tag is only required after publication.
super-synara-prerelease.yml): renames both native-lane steps to "Revalidate protected-main source provenance" and flipsgithub-unsigned-prereleasefromtrue→false, matching the new tagless contract.super-synara-workflow-contract.ts): addsverifyPrereleaseSourceProvenanceStepswhich enforces the exact step name,shell: bash, env bindings, normalized run command (handling line continuations), noifcondition, and nocontinue-on-errorfor all three pre-publication lanes.before-publishphase without a preexisting tag.Confidence Score: 5/5
Safe to merge — the change corrects the pre-publication provenance step in both native lanes and backs it with exhaustive contract checks and mutation tests.
The workflow fix is a one-line flag flip in each lane, directly reproducing the documented failure mode. The new contract validator is precise — it checks step name, shell, every env binding, the normalized command, conditional flags, and continue-on-error — leaving no known bypass surface. The mutation test suite covers all three lanes and every env key individually. Post-publication tag enforcement is unchanged.
No files require special attention.
Important Files Changed
Sequence Diagram
%%{init: {'theme': 'neutral'}}%% sequenceDiagram participant RD as release-drafter participant DA as draft_admission participant PF as preflight participant WIN as windows_x64 participant MAC as macos_arm64 participant PUB as publish RD->>DA: dispatch (version, tag, source_sha, draft_id) DA->>DA: authenticate owner + validate draft DA->>PF: trigger (needs: draft_admission) PF->>PF: Validate source provenance (github-unsigned-prerelease false) PF-->>WIN: outputs (version, tag, source_commit) PF-->>MAC: outputs (version, tag, source_commit) WIN->>WIN: Revalidate protected-main source provenance (github-unsigned-prerelease false) WIN->>WIN: build + qualify installer MAC->>MAC: Revalidate protected-main source provenance (github-unsigned-prerelease false) MAC->>MAC: build + sign WIN-->>PUB: artifacts MAC-->>PUB: artifacts PUB->>PUB: adopt owned draft PUB->>PUB: gh api PATCH - atomic publish (creates immutable tag HERE) PUB->>PUB: verify after-publish state (requires immutable tag)%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%% sequenceDiagram participant RD as release-drafter participant DA as draft_admission participant PF as preflight participant WIN as windows_x64 participant MAC as macos_arm64 participant PUB as publish RD->>DA: dispatch (version, tag, source_sha, draft_id) DA->>DA: authenticate owner + validate draft DA->>PF: trigger (needs: draft_admission) PF->>PF: Validate source provenance (github-unsigned-prerelease false) PF-->>WIN: outputs (version, tag, source_commit) PF-->>MAC: outputs (version, tag, source_commit) WIN->>WIN: Revalidate protected-main source provenance (github-unsigned-prerelease false) WIN->>WIN: build + qualify installer MAC->>MAC: Revalidate protected-main source provenance (github-unsigned-prerelease false) MAC->>MAC: build + sign WIN-->>PUB: artifacts MAC-->>PUB: artifacts PUB->>PUB: adopt owned draft PUB->>PUB: gh api PATCH - atomic publish (creates immutable tag HERE) PUB->>PUB: verify after-publish state (requires immutable tag)Reviews (3): Last reviewed commit: "fix(release): bind provenance gate envir..." | Re-trigger Greptile