ci: make releases manually dispatched - #106
Merged
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe release process changes from repository-dispatch approval to manual workflow dispatch. It validates a Release Please PR, runs CI, rechecks repository state, merges the PR, and uses workflow outputs for release verification and publishing. Contributor guidance is updated. ChangesRelease orchestration
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Maintainer
participant ReleaseWorkflow
participant ReleasePleasePR
participant CIWorkflow
Maintainer->>ReleaseWorkflow: manually dispatch from main
ReleaseWorkflow->>ReleasePleasePR: discover and validate release PR
ReleaseWorkflow->>CIWorkflow: dispatch ci.yml and monitor completion
ReleaseWorkflow->>ReleasePleasePR: merge validated release PR
ReleaseWorkflow->>ReleaseWorkflow: validate released version and publish
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (4)
.github/workflows/release.yml (4)
35-40: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winPaginate the PR listing. With more than 100 open PRs against
main, the release-please PR can fall off page 1 and the run fails with a misleading "found 0".♻️ Use
--paginateand flattenpulls="$( - gh api --method GET "repos/${GITHUB_REPOSITORY}/pulls" \ + gh api --paginate --slurp --method GET "repos/${GITHUB_REPOSITORY}/pulls" \ -f state=open \ -f base=main \ -F per_page=100 )" candidates="$( - jq -c --arg repo "${GITHUB_REPOSITORY}" '[ - .[] | select( + jq -c --arg repo "${GITHUB_REPOSITORY}" '[ + (.[] | .[]) | select(🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 35 - 40, Update the gh api invocation assigned to pulls to use pagination and flatten the returned page arrays into one PR collection. Preserve the existing open-state and main-branch filters so release-please can find matching PRs beyond the first 100 results.
90-103: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin the watched CI run to the validated commit, and bound the wait.
The dispatch targets a branch ref, so the run may execute a commit other than
candidate.outputs.head_sha. Asserting the run'sheadShacloses that gap directly instead of inferring it from the later PR check. Atimeout-minuteson the job also avoids a stuck CI run holding the release for the 6h default.♻️ Assert the run commit
ci_run_id="$(jq -er '.workflow_run_id' <<< "${dispatch}")" + run_head="$(gh run view "${ci_run_id}" --repo "${GITHUB_REPOSITORY}" --json headSha --jq '.headSha')" + if [[ "${run_head}" != "${{ steps.candidate.outputs.head_sha }}" ]]; then + echo "::error::CI run ${ci_run_id} is for ${run_head}, not the validated candidate commit" + exit 1 + fi gh run watch "${ci_run_id}" --repo "${GITHUB_REPOSITORY}" --exit-status🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 90 - 103, Update the “Run checks” workflow job to assert that the dispatched CI run’s headSha matches candidate.outputs.head_sha, and add a timeout-minutes limit to bound waiting for the run. Keep the existing dispatch and gh run watch --exit-status behavior while ensuring the watched run is the one for the validated commit.
104-136: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winExtract the repeated candidate-invariant check. The same
mainSHA compare,jq -ePR predicate, andpackage.jsonversion compare are duplicated across both jobs, differing only in error strings — a future tightening of the predicate has to be applied in two places.
.github/workflows/release.yml#L104-L136: move this logic into a shared script (e.g..github/scripts/verify-release-candidate.sh) invoked with a context label, and call it here..github/workflows/release.yml#L159-L187: replace this block with a call to the same shared script (keeping the numericRELEASE_PRguard in the workflow).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 104 - 136, Extract the duplicated candidate-invariant validation from the “Verify release candidate” block at .github/workflows/release.yml:104-136 and the corresponding block at .github/workflows/release.yml:159-187 into a shared script such as .github/scripts/verify-release-candidate.sh, parameterized by a context label for error messages. Move the main SHA check, PR jq predicate, and package.json version check into that script, then invoke it from both workflow sites with their existing environment values; retain the numeric RELEASE_PR guard in the later workflow block.
188-199: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winPin the merge to the validated head commit. The
mainrecheck leaves a gap beforegh pr merge; passneeds.prepare.outputs.head_shaand use--match-head-commitso a push to the release PR can’t slip in.♻️ Pass the expected head commit
env: EXPECTED_MAIN_SHA: ${{ needs.prepare.outputs.main_sha }} + EXPECTED_HEAD_SHA: ${{ needs.prepare.outputs.head_sha }} GH_TOKEN: ${{ github.token }} @@ - gh pr merge "${RELEASE_PR}" --repo "${GITHUB_REPOSITORY}" --merge + gh pr merge "${RELEASE_PR}" --repo "${GITHUB_REPOSITORY}" --merge \ + --match-head-commit "${EXPECTED_HEAD_SHA}"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 188 - 199, Update the “Merge release PR” step to pass needs.prepare.outputs.head_sha as the expected pull-request head commit, and add gh pr merge’s --match-head-commit option using that value. Preserve the existing main SHA validation and merge behavior while ensuring the merge is pinned to the validated PR head.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 58-71: Replace the base.sha checks in the release PR update flow
with a comparison between the current main branch and the PR head, using the
repository compare API and its behind_by value. Update the polling loop and
final failure check to treat behind_by == 0 as current, while preserving the
existing rebase, retry, error, and exit behavior.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 35-40: Update the gh api invocation assigned to pulls to use
pagination and flatten the returned page arrays into one PR collection. Preserve
the existing open-state and main-branch filters so release-please can find
matching PRs beyond the first 100 results.
- Around line 90-103: Update the “Run checks” workflow job to assert that the
dispatched CI run’s headSha matches candidate.outputs.head_sha, and add a
timeout-minutes limit to bound waiting for the run. Keep the existing dispatch
and gh run watch --exit-status behavior while ensuring the watched run is the
one for the validated commit.
- Around line 104-136: Extract the duplicated candidate-invariant validation
from the “Verify release candidate” block at
.github/workflows/release.yml:104-136 and the corresponding block at
.github/workflows/release.yml:159-187 into a shared script such as
.github/scripts/verify-release-candidate.sh, parameterized by a context label
for error messages. Move the main SHA check, PR jq predicate, and package.json
version check into that script, then invoke it from both workflow sites with
their existing environment values; retain the numeric RELEASE_PR guard in the
later workflow block.
- Around line 188-199: Update the “Merge release PR” step to pass
needs.prepare.outputs.head_sha as the expected pull-request head commit, and add
gh pr merge’s --match-head-commit option using that value. Preserve the existing
main SHA validation and merge behavior while ensuring the merge is pinned to the
validated PR head.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 7d1f0b67-7d55-4f2a-a6bb-bd1d34a14def
📒 Files selected for processing (3)
.github/workflows/ci.yml.github/workflows/release.ymlCONTRIBUTING.md
💤 Files with no reviewable changes (1)
- .github/workflows/ci.yml
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
7-9: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueThe concurrency settings do not cancel stale runs.
The pull request description states that the workflow cancels stale waiting approvals.
cancel-in-progress: falsequeues a second run instead of cancelling the first. Align the setting with the intended behavior, or update the description.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 7 - 9, Update the release workflow’s concurrency configuration to cancel stale runs by changing cancel-in-progress to true, aligning it with the documented behavior while preserving the release concurrency group.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 55-66: Update the jq validation in the release workflow to stop
comparing `.base.sha` with `$main`, since that value may be stale on reused
Release Please pull requests. Instead, validate that the pull request head is
current by requiring `.behind_by == 0`, while preserving the existing open,
main-target, repository, and bot-author checks.
- Around line 42-51: Update the Release Please PR filter in the candidate query
to match the default single-package branch name release-please--branches--main,
while preserving support for component-specific branch names when present. Keep
the exactly-one candidate validation in the surrounding candidate_count check
unchanged.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 7-9: Update the release workflow’s concurrency configuration to
cancel stale runs by changing cancel-in-progress to true, aligning it with the
documented behavior while preserving the release concurrency group.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: ac017e58-b545-4c9a-aee0-ecdf0b854982
📒 Files selected for processing (1)
.github/workflows/release.yml
This was referenced Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Safety
Testing
Summary by CodeRabbit
New Features
Documentation