Repository navigation
chore: rolling promotion dev -> main - #2644
Merged
Merged
Conversation
The manifest job has failed every release since 2026-07-20, freezing the channel pointers: stable at 5.260720.10 and dev at 5.260723.8, while v5.260724.1 published 12 assets that no channel can reach and the v5.260724.2 promotion tag has no release at all. Root cause is not the credential's scope. The 'main' ruleset (id 9203218) carries a pull_request rule with an EMPTY bypass_actors list, so every direct push to main is rejected GH013 no matter how the pusher authenticates. The deploy key failed that way (deploy keys are also disabled org-wide), and the fine-grained PAT that replaced it failed the same way — the preflight passed on 07-24 and the push still 403'd. An App is the narrowest identity that can hold a ruleset bypass; granting it to a RepositoryRole would hand every admin direct push to main and undo the least-privilege posture F16-F18 established. So the job now mints a short-lived App token per run (expires ~1h, nothing long-lived can push to main) and checks out with it. - release-publish.yml: preflight requires RELEASE_MANIFESTS_APP_ID and RELEASE_MANIFESTS_APP_PRIVATE_KEY, mints via create-github-app-token pinned to fee1f7d6 (v3.2.0), checkout uses the minted token; HUMAN SETUP header rewritten with the App + ruleset-bypass provisioning steps and the exact gh api bypass command - push-rejection diagnostic now names the ruleset bypass, not just scope - release.yml / version.yml: secrets-inherit comments follow the rename - release-docs.test.ts: the contract test pinned the PAT model; it now pins the App model and asserts the PAT wiring is gone Requires one-time provisioning before the next release: create the App, store its credentials in the release-manifests environment, and add it as an Integration bypass actor on ruleset 9203218.
…token fix(release): authenticate the manifest push as a GitHub App
Contributor
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
📝 WalkthroughWalkthroughThe release manifests workflow now authenticates pushes with a short-lived GitHub App token instead of a PAT. Related workflow comments and tests are updated, and package and plugin manifests are bumped to version ChangesRelease manifest authentication
Package and plugin version refresh
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant manifests_job
participant GitHub_App
participant actions_checkout
participant protected_main
manifests_job->>GitHub_App: Provide App ID and private key
GitHub_App-->>manifests_job: Return short-lived installation token
manifests_job->>actions_checkout: Use minted token
actions_checkout->>protected_main: Push channel manifests
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6c96f9d06d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-publish.yml:
- Around line 1096-1103: Update the create-github-app-token step identified by
id manifest_app_token to explicitly declare only the GitHub App permissions
required for the manifest push, using the action’s permission-<name> inputs. Do
not rely on the installation’s out-of-band permission scope, and preserve the
existing app credentials, owner, and repository configuration.
- Around line 1096-1103: Update the actions/create-github-app-token reference in
the manifest_app_token step so the pinned commit SHA matches the documented
v3.2.0 release, or change the version comment to match the existing SHA. Keep
the action configuration unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: fdff8540-9498-4843-bb51-1494bbd6f637
📒 Files selected for processing (10)
.claude-plugin/marketplace.json.github/workflows/release-publish.yml.github/workflows/release.yml.github/workflows/version.ymlpackage.jsonplugins/genie/.claude-plugin/plugin.jsonplugins/genie/.codex-plugin/plugin.jsonplugins/genie/package.jsonplugins/hermes-genie/plugin.yamlscripts/release-docs.test.ts
automagik-genie
approved these changes
Jul 25, 2026
This was referenced Jul 25, 2026
lirazsiri
pushed a commit
to lirazsiri/genie
that referenced
this pull request
Jul 28, 2026
The org-wide deploy-key ban made the ssh model unusable, and the fine-grained PAT that replaced it still could not push: the 'main' ruleset carried a pull_request rule with an empty bypass_actors list, so every direct push was rejected GH013 regardless of token scope. That froze the channel pointers from 2026-07-20 onward. Resolved without touching the deploy-key policy: PR automagik-si#2643 (promoted in automagik-si#2644 as 73bd48a) mints a per-run GitHub App token — genie-release-bot, app id 4393439, contents:write + metadata:read only, installed on this repository alone, sole ruleset bypass actor Integration:4393439:always. No user, role, or Actions bypass was added, and the token expires in ~1h so no long-lived credential can push to main. The dev/homolog criterion stays UNCHECKED until a post-merge dev release actually advances a channel manifest — this commit is that release's trigger.
lirazsiri
pushed a commit
to lirazsiri/genie
that referenced
this pull request
Jul 28, 2026
…onstration Codex P2 on PR automagik-si#2702 caught the closure commit leaving the wish internally contradictory: the G2 acceptance criterion, the QA criterion, two Review Results closure sentences, and INDEX's pr-2545 line still said no live two-maintainer run had been captured / stable promotion remained BLOCKED. All five sites now record the evidence: stable run 30240023804 (v5.260727.5) — automagik-genie dispatched, independent maintainer approved (prevent_self_review), 36 immutable assets, all three manifests advanced; credential half landed as the genie-release-bot App (automagik-si#2643/automagik-si#2644).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rolling promotion
dev→main, carrying two commits:6c96f9d0—fix(release): authenticate the manifest push as a GitHub App(fix(release): authenticate the manifest push as a GitHub App #2643). This must reachmainto take effect at all:release-publish.yml's admit job binds the caller toversion.yml@refs/heads/main/release.yml@refs/heads/main, so every release executes the workflow copy frommain. While the fix sits only ondev, releases keep running the old PAT path and keep failingGH013.7fc29c7e—docs(wish): close pr-2545-ultra-release-gate(docs only).Context
The manifest push has failed on every release since 2026-07-20, freezing the channel pointers (stable
5.260720.10, dev5.260723.8) whilev5.260724.1published 12 assets no channel can reach andv5.260724.2has no release at all.Root cause is the
mainruleset (9203218): apull_requestrule with an emptybypass_actorslist rejects every direct push regardless of credential. #2643 replaces the unusable PAT with a per-run GitHub App token.Still required after this merges
This promotion alone does not fix the release. The one-time App provisioning is still outstanding:
RELEASE_MANIFESTS_APP_ID+RELEASE_MANIFESTS_APP_PRIVATE_KEYto therelease-manifestsenvironment.9203218.RELEASE_MANIFESTS_TOKEN.Until then the manifest job fails fast at its new preflight with an explicit message, instead of the previous misleading "token lacks contents:write" diagnostic.
Summary by CodeRabbit
Release
Improvements
Tests