ci: reconcile dev by merge instead of rebase#2453
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughChanges update release promotion validation and docs: ff_target selection for current-line hotfixes now uses the hotfix merge commit's second parent, a dev reconciliation merge path is added for dev-source promotions, the hotfix-staging rebase-reconcile step was removed, and release-note deduplication was added. ChangesRelease workflow and docs
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related issues
Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 actionlint (1.7.12).github/workflows/release-semantic.yamlcould not read ".github/workflows/release-semantic.yaml": open .github/workflows/release-semantic.yaml: no such file or directory 🔧 zizmor (1.25.2).github/workflows/release-semantic.yamlINFO zizmor: 🌈 zizmor v1.25.2 🔧 YAMLlint (1.38.0).github/workflows/release-semantic.yaml[Errno 2] No such file or directory: '.github/workflows/release-semantic.yaml' 🔧 Checkov (3.2.530).github/workflows/release-semantic.yaml2026-06-02 13:53:23,735 [MainThread ] [ERROR] Template file not found: .github/workflows/release-semantic.yaml ... [truncated 9250 characters] ... ess file .github/workflows/release-semantic.yaml Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
SkrubbySkrubInAShrub
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release-semantic.yaml (1)
110-134:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRequire dev-source promotions to use the current
origin/devtip.Any ancestor of
origin/devis accepted here as a dev-sourceff_target, but the latergit push --force-with-lease ... "${TARGET}:refs/heads/dev"will then rewritedevto the reconciliation merge. If a newer commit lands ondevafter the selected RC, that push drops those intervening commits and breaks the new "never rewrite dev" invariant.Suggested fix
if [[ -z "${SOURCE}" ]]; then echo "::error::ff_target ${FF_TARGET} is not an ancestor of dev or any origin/hotfix/* branch — refusing to promote an unreviewed SHA." exit 1 fi - # hotfix-staging sources must be a clean fast-forward of main - # (no reconcile pre-step runs for them). dev sources may have a - # diverged main; the reconcile step merges it in first. - if [[ "${SOURCE}" != "dev" ]]; then + # dev-source promotions must target the current dev tip; using + # an older ancestor would rewrite dev during reconciliation. + if [[ "${SOURCE}" == "dev" ]]; then + CURRENT_DEV="$(git rev-parse origin/dev)" + if [[ "${FF_TARGET}" != "${CURRENT_DEV}" ]]; then + echo "::error::dev-source ff_target must equal the current origin/dev tip (${CURRENT_DEV}), not an older ancestor." + exit 1 + fi + else if ! git merge-base --is-ancestor origin/main "${FF_TARGET}"; then echo "::error::hotfix-staging ff_target ${FF_TARGET} is not a fast-forward of main." exit 1 fi fiIf you keep that guard, the later dev update can also be a plain
git pushso the server enforces the fast-forward invariant instead of relying on--force-with-lease.Also applies to: 225-226
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-semantic.yaml around lines 110 - 134, The current check accepts any ancestor of origin/dev as a dev-source, which allows pushing a reconciliation merge that can rewrite newer dev commits; update the guard so dev-source FF_TARGET must match the current origin/dev tip exactly: replace the git merge-base --is-ancestor "${FF_TARGET}" origin/dev test with a direct equality check using git rev-parse origin/dev (e.g. [ "$(git rev-parse origin/dev)" = "${FF_TARGET}" ]), set SOURCE="dev" only when they match, and apply the same exact-tip check to the other equivalent occurrence of the dev-source guard in the workflow.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/release-semantic.yaml:
- Around line 110-134: The current check accepts any ancestor of origin/dev as a
dev-source, which allows pushing a reconciliation merge that can rewrite newer
dev commits; update the guard so dev-source FF_TARGET must match the current
origin/dev tip exactly: replace the git merge-base --is-ancestor "${FF_TARGET}"
origin/dev test with a direct equality check using git rev-parse origin/dev
(e.g. [ "$(git rev-parse origin/dev)" = "${FF_TARGET}" ]), set SOURCE="dev" only
when they match, and apply the same exact-tip check to the other equivalent
occurrence of the dev-source guard in the workflow.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: a5a0b668-352b-47de-8445-03ddd6653d5c
📒 Files selected for processing (2)
.claude/CLAUDE.md.github/workflows/release-semantic.yaml
2 participants
Replace the destructive rebase-reconcile of
devafter a hotfixpromotion with a non-destructive merge-at-promotion approach, so
mainbecomes an ancestor ofdevwithout ever rewritingdev.The old rebase-reconcile force-pushed
dev(rewriting history andforcing every open PR to rebase) and was incompatible with
dev'sprotection (force-push disabled), so it had never run successfully.
Changes to
release-semantic.yaml:main, mergemainintodevfirst (ancestry-only, fast-forward push, no force),resolving version-bump files to
devand hard-failing on anynon-dev-sourced divergence; then retarget the FF to that merge commit.
dev; it is reconciled at thenext minor/major promotion via the merge above.
mainis now expected).the new release's draft notes.
Docs:
and the App PR-bypass prerequisite for
mainanddev; drop thestale auto-rebase reference.
Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Summary by CodeRabbit
Summary by CodeRabbit
Documentation
Chores