fix(release): validate planned source before tag publication - #73
Merged
Conversation
📝 WalkthroughWalkthroughNative release jobs now verify the exact admitted draft source before native builds. The workflow contract enforces planned-source checkout, provenance-command, environment, and ordering requirements, while tests cover tag conflicts and invalid tagless-source configurations. ChangesNative planned-source validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant NativeJob as Native build job
participant PlannedSource as Planned source checkout
participant Provenance as verify-release-source-provenance.ts
participant Build as Native build
NativeJob->>PlannedSource: Check out exact planned source
PlannedSource->>Provenance: Revalidate planned-source provenance
Provenance->>Build: Continue only after successful proof
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Comment |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 4 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
…tag-revalidation # Conflicts: # .github/workflows/super-synara-prerelease.yml # scripts/lib/super-synara-workflow-contract.test.ts
There was a problem hiding this comment.
slashdevcorpse has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
coderabbitai
Bot
added
the
ready-to-merge
Merge Queue Status
This pull request spent 29 seconds in the queue, including 3 seconds running CI. Required conditions to merge
ReasonPull request #73 has been merged manually at 5900bc5 HintYou were too fast! Tick the box to put this pull request back in the merge queue (same as
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Failure addressed
Controller run 29876040712 admitted the exact empty draft and checked out the intended commit, but the Windows lane still used the obsolete reserved-tag proof from the former pre-build tag reservation flow. The native jobs remain gated on the write-scoped exact-draft admission job, while the release-state checks fail closed on moved or annotated tags and revalidate state immediately before publication.
Verification
bun run --cwd scripts test lib/super-synara-workflow-contract.test.ts lib/super-synara-release-state.test.ts(34 passed)node scripts/verify-workflow-contracts.tsbunx oxfmt --checkandbunx oxlintd4b3d64940737627a7a5014346df1d0bcdc7e37aSummary by cubic
Validate the admitted draft’s planned source before tag publication to prevent drift and conflicting-tag releases. Tag creation happens only in the final publish step; native lanes no longer rely on reserved tags.
github-unsigned-prerelease false.Written for commit 0eff73b. Summary will update on new commits.
Summary by CodeRabbit
Bug Fixes
Tests
Chores
Greptile Summary
This PR removes the pre-publication tag reservation requirement from the native build lanes. Previously, both Windows and macOS jobs called
verify-release-source-provenance.tswithgithub-unsigned-prerelease true, which required the release tag to already exist on GitHub at build time; the flag is nowfalseso the source is validated against the admitted draft commit without needing a pre-created tag.verifyNativePlannedSource()function in the contract verifier enforces the exact checkout ref, proof command, and ordering (proof before native build) for both lanes.Confidence Score: 4/5
The workflow change is safe to merge; the contract verifier and its tests lock down the new behavior end-to-end.
The core logic and contract enforcement are correct and well-tested. The two observations are test-quality issues: the new workflow contract mutations only exercise the Windows lane (not macOS), and the new release-state test duplicates two assertions already present in an existing test. Neither affects production behavior.
scripts/lib/super-synara-workflow-contract.test.ts — the three new mutation checks only mutate the first occurrence in the YAML, leaving the macOS lane's enforcement untested in isolation.
Important Files Changed
Sequence Diagram
%%{init: {'theme': 'neutral'}}%% sequenceDiagram participant RD as release-drafter.yml participant DA as draft_admission participant PF as preflight participant WX as windows_x64 participant MA as macos_arm64 participant PB as publish RD->>DA: dispatch (version, tag, source_sha, draft_id) DA->>DA: Authorize exact protected-main owner DA->>DA: Checkout admitted source (SHA pin) DA->>DA: Validate exact owned draft visibility Note over DA: writes source_commit output DA-->>WX: needs: [draft_admission, preflight] DA-->>MA: needs: [draft_admission, preflight] PF->>PF: bun install + cleanliness checks PF->>PF: preflight.outputs.source_commit WX->>WX: Checkout exact planned source (source_commit) WX->>WX: bun install WX->>WX: Revalidate exact planned source (github-unsigned-prerelease false) Note over WX: No pre-publication tag required WX->>WX: Native Windows build + tests MA->>MA: Checkout exact planned source (source_commit) MA->>MA: bun install MA->>MA: Revalidate exact planned source (github-unsigned-prerelease false) Note over MA: No pre-publication tag required MA->>MA: Native macOS build + tests WX-->>PB: artifact MA-->>PB: artifact (if windows-and-macos scope) PB->>PB: Adopt exact Release Drafter draft PB->>PB: Atomic gh PATCH creates immutable tag and publishes%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%% sequenceDiagram participant RD as release-drafter.yml participant DA as draft_admission participant PF as preflight participant WX as windows_x64 participant MA as macos_arm64 participant PB as publish RD->>DA: dispatch (version, tag, source_sha, draft_id) DA->>DA: Authorize exact protected-main owner DA->>DA: Checkout admitted source (SHA pin) DA->>DA: Validate exact owned draft visibility Note over DA: writes source_commit output DA-->>WX: needs: [draft_admission, preflight] DA-->>MA: needs: [draft_admission, preflight] PF->>PF: bun install + cleanliness checks PF->>PF: preflight.outputs.source_commit WX->>WX: Checkout exact planned source (source_commit) WX->>WX: bun install WX->>WX: Revalidate exact planned source (github-unsigned-prerelease false) Note over WX: No pre-publication tag required WX->>WX: Native Windows build + tests MA->>MA: Checkout exact planned source (source_commit) MA->>MA: bun install MA->>MA: Revalidate exact planned source (github-unsigned-prerelease false) Note over MA: No pre-publication tag required MA->>MA: Native macOS build + tests WX-->>PB: artifact MA-->>PB: artifact (if windows-and-macos scope) PB->>PB: Adopt exact Release Drafter draft PB->>PB: Atomic gh PATCH creates immutable tag and publishesPrompt To Fix All With AI
Reviews (1): Last reviewed commit: "fix(release): validate planned source be..." | Re-trigger Greptile