Repository navigation
chore: rolling promotion dev -> main (consolidated release-chain fix) - #2650
Merged
Merged
Conversation
The generic SLSA provenance embeds the workflow_run that TRIGGERED the release, whose head is the commit CI ran on — one before the [auto-version] bump the tarballs are built from. Nothing asserted that this value is actually threaded through version.yml -> release.yml -> sign-attest.yml + release-publish.yml, so dropping it from any single 'with:' block would silently re-break exact verification (or hard-fail on an empty TRIGGER_SHA) exactly as it did on 2026-07-25. Pins the full chain, the verifier comparing the trigger commit rather than source_sha, and the per-channel descriptor comparison.
The previous fix wired trigger_sha into sign-attest.yml's native-predicate step (line 340), whose script never reads it, while the step that actually runs 'release-generic-provenance.sh verify-exact' had no TRIGGER_SHA at all. verify_automated_event requires a well-formed one on dev/homolog and exits 2 without it — so the next dev release would have died at the same place with the same silent exit, a fourth consecutive broken release. The wiring test did not catch it because it used a whole-file toContain(), which the misplaced value satisfied. It now resolves the step that consumes each value and asserts the env of THAT step; verified to fail against the misplacement and pass once corrected. - CRITICAL: TRIGGER_SHA into the 'Verify SLSA provenance (self-check)' env; dead assignment removed from the native-predicate step - dead TRIGGER_SHA removed from release-publish prepare-delivery-evidence (no consumer); the live consumer in the security gate is untouched - dev version derivation uses max+1 instead of count+1, so a burned build number cannot collide, and a tag collision is now a hard error instead of being reported as a benign race that drops the release with a green run
fix(release): deliver TRIGGER_SHA to the verifying step + consolidated chain fixes
Contributor
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
📝 WalkthroughWalkthroughUpdates Genie version metadata, improves dev tag allocation and collision handling, and corrects ChangesRelease updates
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant workflow_run
participant sign-attest.yml
participant release-generic-provenance.sh
participant release-publish.yml
workflow_run->>sign-attest.yml: pass trigger_sha
sign-attest.yml->>release-generic-provenance.sh: verify-exact with TRIGGER_SHA
release-generic-provenance.sh-->>sign-attest.yml: compare run.head_sha
sign-attest.yml->>release-publish.yml: pass verified SHA inputs
release-publish.yml->>release-publish.yml: evaluate generic_expected_sha
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/version.yml:
- Around line 183-190: Update the build-number calculation near HIGHEST and
BUILD_NUMBER so the emitted dev suffix never exceeds 9999, capping the next
value at the promotion limit before VERSION is constructed. Parse matching tag
suffixes explicitly as decimal to avoid leading-zero values being interpreted
unexpectedly, while preserving the highest-existing-suffix behavior.
- Around line 322-329: Restrict the collision check in the atomic push failure
handling to evidence involving the specific tag refs, rather than any generic
“cannot lock ref” message. Update the grep condition near the push_output
handling to match refs/tags/v${VERSION} or explicit existing-tag messages, while
allowing branch-side refs/heads/dev lock failures to follow the normal path.
In `@scripts/release-docs.test.ts`:
- Around line 504-506: Strengthen the test around verifyStep in
scripts/release-docs.test.ts by asserting the exact TRIGGER_SHA environment
assignment to inputs.trigger_sha, rather than relying on separate substring
checks. Also verify that TRIGGER_SHA is absent from the native-predicate step,
using the existing stepEnvFor helper and relevant step identifiers.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 2df15850-3661-43c8-8e58-581df9786148
📒 Files selected for processing (10)
.claude-plugin/marketplace.json.github/workflows/release-publish.yml.github/workflows/sign-attest.yml.github/workflows/version.ymlpackage.jsonplugins/genie/.claude-plugin/plugin.jsonplugins/genie/.codex-plugin/plugin.jsonplugins/genie/package.jsonplugins/hermes-genie/plugin.yamlscripts/release-docs.test.ts
💤 Files with no reviewable changes (1)
- .github/workflows/release-publish.yml
namastex888
approved these changes
Jul 25, 2026
namastex888
approved these changes
Jul 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes the consolidated release-chain fix (#2648,
58500117) tomain.This is the promotion that matters. The release chain executes from
main—sign-attest.yml,release-publish.ymland friends are always read fromrefs/heads/main, never fromdev. So the fix has no effect until this lands, and the dev release firing right now will still fail.What it carries
TRIGGER_SHAreaches the env of the step that actually runsrelease-generic-provenance.sh verify-exact. The prior fix put it in the native-predicate step, whose script never reads it;verify_automated_eventrequires it on dev/homolog andexit 2s silently without it. Without this, the next dev release dies at the same place for the fourth time.TRIGGER_SHAremoved fromrelease-publish.ymlprepare-delivery-evidence(no consumer); the live consumer in the security gate is untouched.max+1instead ofcount+1, and a tag collision is now a hard error rather than being reported as a benign race that drops a release with a green run.mainagain.Audit basis
A full static audit of the chain at
main@93243cf0covered secrets, environment gates, verification-script satisfiability, permissions, the App-token push path, previous-release state and orphaned tags: 1 must-fix for dev (fixed here), 0 for stable.Known risk after merge
PR #2624 grew
release-publish.ymlfrom 3 jobs to 10. Seven publish-side jobs have never executed — the last run to reach publish used the old 3-job workflow. The next dev release is their first production run, including a 4-platform native Codex dogfood. Static analysis found no unsatisfiable assertion in them, but treat that run as a shakeout of unexercised surface, not as verification of this fix.Summary by CodeRabbit
Release
Bug Fixes
Tests