fix(release): revalidate main and package modes - #236
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThe release process now uses a reusable package-tree comparator and a Bash guard for current-main validation. Payload verification compares modes, links, types, and contents. Publishing validates the current commit before release actions. ChangesRelease integrity
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 217-219: Update the publish step containing npm publish to pass
github.event.inputs.tag through the step’s env configuration, then reference
that environment variable as a quoted shell variable in the command. Remove
direct expression interpolation from the Bash command while preserving the
existing provenance, access, and publish-tag options.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 3fb8d298-90d5-4872-b1bd-d0b5e5425c4e
📒 Files selected for processing (5)
.github/workflows/publish.ymlscripts/compare-package-trees.mjsscripts/require-current-main.shscripts/verify-release-payload.shsrc/release-state.test.ts
|
Addressed CodeRabbit's publish-shell finding in 4b5933f: the workflow now passes the selected npm dist-tag through |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found and verified against the latest diff
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="scripts/require-current-main.sh">
<violation number="1" location="scripts/require-current-main.sh:9">
P2: The new revalidation hard-blocks the workflow's documented recovery path. The tag/publish steps are designed to be resumable for a missing tag with an already-published, matching npm payload (see release-state.mjs's 'recover-missing-tag' state and the 'safely resumable' comment at the Create release tag step). But a re-run reuses the original triggering GITHUB_SHA, and require-current-main.sh now requires that SHA to equal the current origin/main. If any commit lands on main between the original partial failure and the recovery rerun, the revalidation fails and the tag can no longer be restored even though the published payload already matches the checkout. Consider scoping the main-current revalidation only to the fresh 'new-release' path so that recovery of an already-published equivalent payload is not permanently blocked.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
|
Addressed both Cubic findings in f7fc299: package-tree comparison now includes setuid/setgid/sticky bits with a regression test, and current-main SHA validation is limited to the fresh |
There was a problem hiding this comment.
All reported issues were addressed across 4 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
require-current-main.sh --ref-only extra silently exited 0 instead of failing, because the --ref-only check ran before argument validation. Move the count check first so misuse (extra/unknown args) is caught. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
4 participants
Summary
GITHUB_SHAis still currentorigin/mainimmediately before release tag creation and immediately before npm publishContext
Follow-up to #235 for Cubic findings posted on head 708c177 shortly before that PR was merged externally. This PR contains only those two review fixes. It does not publish, tag, or change version 0.1.58.
Verification