Back-merge v2.1.0 into develop - #839
Merged
Merged
Conversation
…lished The v2.0.1 release produced a green build.yml run that built nothing: the build jobs were guarded on github.event.base_ref, which is empty for a tag pushed to a branch-protected main, so all three reported skipped while the run stayed green. The guard is fixed, but nothing in our process would have caught it, and the same class of failure can recur silently. This records the checks that prove a release shipped: assert per-job conclusions rather than the run's, resolve the manifest digest for all five registry coordinates, confirm latest matches the release and that ghcr and Docker Hub carry the same build, and read the version baked into the image so a tag placed on a pre-bump commit is caught. Includes the reconstructed v2.0.1 sequence and the rules it produced, plus the open risk that main's hardened build.yml has never yet run on a GA tag.
Release 2.1.0
Ahmath-Gadji
approved these changes
Jul 31, 2026
📝 WalkthroughWalkthroughThe project version advances to 2.1.0. Helm and Compose image references use the new release tags. The chart version advances to 0.6.1. A release checklist documents image, registry, workflow, tag, and deployment verification. ChangesVersion 2.1.0 release
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
coderabbitai
Bot
added
the
chore
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/RELEASING.md:
- Around line 169-176: Update the release validation commands in the documented
checks to compare each extracted value exactly against $VER, rather than merely
matching version-like strings. Validate chart appVersion and version, Ray, admin
UI, and OpenRAG image tags in values.yaml, plus every relevant Compose image
reference, and ensure any mismatch causes the checks to fail.
- Around line 124-128: Update the release verification instructions around the
docker image inspect command and the “PASS” check to extract the sha256 digest
suffix from the returned repository digest, then compare that extracted value
with the registry digest from step 2. Keep the existing image pull and digest
verification flow unchanged.
- Around line 61-66: Update the job-conclusion check in the release instructions
to capture the count returned by gh run view and explicitly exit non-zero when
that count is not zero. Preserve the existing filter for non-successful jobs so
both failed and skipped jobs block the release.
- Line 16: Update the dg helper to propagate failure from docker buildx
imagetools inspect, preventing sha256sum from hashing empty output and ensuring
no digest is emitted when lookup fails. Update every documented caller in the
release steps to check dg’s non-zero status and stop with an appropriate failure
instead of continuing comparisons or accepting missing images.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: b20629c1-bc15-400a-8ff9-7a417ed7faaa
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (5)
.github/RELEASING.mdinfra/charts/openrag-stack/Chart.yamlinfra/charts/openrag-stack/values.yamlinfra/compose/docker-compose.yamlpyproject.toml
ewan102
pushed a commit
to ewan102/openrag
that referenced
this pull request
Aug 31, 2026
Four checks in .github/RELEASING.md looked like gates but could not fail, which is the exact defect the document was written to prevent. Found in review of linagora#839. - dg() piped a failed registry lookup into sha256sum, which hashes empty input and returns sha256:e3b0c442... — a real-looking digest. Step 2 then reported a missing image as present, and two missing tags compared equal so steps 3 and 4 printed OK. It now captures the manifest first and returns non-zero on an empty or failed lookup. Step 4 gained -n guards: with the helper fixed, two missing tags are both empty and would still have compared equal. - The job-conclusion check only printed the count of non-success jobs and exited 0 regardless, so a release could continue past a skipped build. It now exits non-zero. - Step 5 compared RepoDigests (repo@sha256:...) against a bare sha256:..., which can never match literally. It now strips the repository prefix. - Step 8 matched any version-shaped tag rather than comparing to $VER, so a pin left at the previous release satisfied it. It now checks each OpenRag repository's tag by name. Counting version-shaped tags instead would have been wrong: values.yaml also pins vllm, milvus and infinity, whose versions are unrelated to the release. Every snippet was executed rather than reasoned about: the job gate was run against the v2.0.1 run that built nothing (correctly fails) and against the v2.1.0 run (passes), and the rest against the live v2.1.0 registries.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Returns the v2.1.0 release commits from
maintodevelop, closing the release cycle.Brings back three commits:
4cb7e7ff— version bump to 2.1.0 (pyproject, uv.lock, Chart.yaml, values.yaml, docker-compose.yaml)184153ad— adds.github/RELEASING.mdbc30c6a0— the release merge commitdevelophad no commits missing frommainat the time this was cut, so there is nothing to reconcile.Release status
v2.1.0 is published and verified: all three images are live on ghcr (plus api and admin-ui on Docker Hub),
latestmatches the release digest on all five coordinates, ghcr and Docker Hub carry the same build, and the image reportsversion = "2.1.0".Summary by CodeRabbit
Release
Documentation