ci: publish meaningful nightly release notes

[teamleaderleo]

Problem

The nightly release page only said Automated nightly build for <sha>, so the app's View Release Notes link gave users no useful change summary.

Fix

The serialized nightly publisher now reads the exact cmux-published-sha marker from the live nightly release, compares it with the built SHA, and collects merged PRs whose merge commits are in that range. It writes up to 40 newest product PRs grouped as Fixes, New, and Changed defaults. Conventional titles and the default call / needs a call labels drive grouping. CI-only, docs-only, and test-only changes collapse to one Infrastructure count, with a compare link for overflow.

The existing DMG and feed links remain below the change summary. The four signed nightly appcasts receive a plain-text teaser containing the five newest product titles. Stable release.yml is untouched.

Validation

• python3 tests/test_nightly_release_notes.py (23 tests)
• bash tests/test_nightly_universal_build.sh
• python3 tests/test_nightly_publication_marker.py
• python3 tests/test_ci_workflow_run_sources.py
• python3 scripts/ci/validate_test_execution_registry.py
• actionlint -no-color .github/workflows/nightly.yml .github/workflows/ci-guards.yml
• git diff --check
• ./scripts/localize-changes --base upstream/main (no localization keys changed)

The next successful published nightly will be the live release-page verification.

Summary by CodeRabbit

• New Features
  • Nightly releases now include automatically generated notes highlighting fixes, new features, and other changes since the previous published build. Notes include links to relevant changes, while infrastructure updates are kept out of the product summary.
  • Nightly appcast entries now include channel-specific download details and a concise summary of changes for the build.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 968b31d3-bce4-4c5d-8540-fcaadb89c049

📥 Commits

Reviewing files that changed from the base of the PR and between 4febb5c and c26495c.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2a1a148c-a7c0-48ec-b6c4-bf43c29c4f91

📥 Commits

Reviewing files that changed from the base of the PR and between f601467 and 4febb5c.

📒 Files selected for processing (5)

• .github/workflows/ci-guards.yml
• .github/workflows/nightly.yml
• scripts/ci/nightly_release_notes.py
• tests/test-execution.toml
• tests/test_nightly_release_notes.py

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The nightly publishing workflow now generates release notes from merged pull requests, updates the current build descriptions in four appcasts, and uses generated files for release metadata. New tests cover the script’s collection, summary, and appcast behavior.

Changes

Nightly release notes

Layer / File(s)	Summary
Read publication baseline and collect pull requests scripts/ci/nightly_release_notes.py, tests/test_nightly_release_notes.py	The script reads a publication SHA marker and collects merged pull requests whose merge commits fall within the built commit range and target the specified branch. Tests cover marker validation, pagination, deduplication, and invalid or incomplete metadata.
Classify and summarize pull requests scripts/ci/nightly_release_notes.py, tests/test_nightly_release_notes.py	The script classifies product pull requests, filters infrastructure changes from product notes, and generates Markdown and plain-text summaries. Tests cover grouping, sorting, filtering, title escaping, and output limits.
Update appcasts and write release outputs scripts/ci/nightly_release_notes.py, tests/test_nightly_release_notes.py	The command-line workflow writes release-note files and updates the matching build description in each required appcast. Tests cover feed matching, preserved item data, and failures that leave feeds unchanged.
Wire nightly publishing and test execution .github/workflows/nightly.yml, .github/workflows/ci-guards.yml, tests/test-execution.toml	The nightly workflow runs the generator and uses its output files for release metadata. The workflow adds pull-requests: read; the CI guard and test registry run the new tests.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Workflow as nightly.yml
  participant Script as nightly_release_notes.py
  participant GitHub as GitHub API
  participant Feeds as Sparkle appcasts
  participant Notes as Generated note files
  participant ReleaseAction as Release metadata action
  Workflow->>Script: Run with release tag, commit, branch, appcast directory, and build
  Script->>GitHub: Read release marker and collect pull request data
  GitHub-->>Script: Return release and pull request metadata
  Script->>Notes: Write release notes and published notes
  Script->>Feeds: Update current build descriptions
  Workflow->>ReleaseAction: Read generated release note files

Loading

Merge Risk: ⚪ Minimal · up to 4febb

The change generates nightly release notes from merged PRs and adds teasers to the appcasts. No concrete merge-blocking risk was identified. The author notes that live release-page verification is still pending the next nightly.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 4febb

The new release-note step rejects non-descendant commits even though release-candidate publishing supports transitions between divergent branches. This can block replacement RC builds and recovery. The publishing controls remain substantially intact, but appcast title rendering still needs end-to-end validation.

Retained concerns

• Medium · reliability · observed: The mandatory notes generator accepts only ahead or identical comparisons. Once the shared RC marker names a commit that is not ancestral to the next RC build, publication aborts before assets, feeds, or the completion record advance. This newly blocks cross-branch rollout and non-descendant recovery that the existing RC publisher explicitly supports, leaving clients on the previous channel publication.

Security review details

Security Blast Radius

• inferred — Control of a selected merged product PR's title can influence published release text and the current-build description in all four feeds for the selected nightly or RC channel. These values do not select credentials, publication destinations, or enclosure attributes in the inspected generator.

Trust Boundaries and Controls

• observed — GitHub metadata crosses into a privileged publisher, but titles are used as output data rather than commands. Publication checks out the selected build SHA without persisted checkout credentials. Existing release authority remains separate from the elevated app token used for the final tag move.
• observed — XML serialization escapes title content without changing update-enclosure attributes. This establishes XML structural containment, not downstream plain-text presentation. The inspected appcast generation command also supplies a full-release-notes URL; its interaction with description rendering was not verified.

Resilience and Maintainability Implications

• observed — Publisher jobs are serialized per release tag with automatic in-progress cancellation disabled. Feed uploads follow asset publication and place thin feeds before the legacy feed. These controls contain ordinary concurrent publication, but do not make the release body and four remote feed objects one atomic transition.

Hardening Proposals

• proposed — Make the intended plain-text description contract explicit and validate it against supported updater consumers, including markup-like titles. This is a boundary-hardening proposal, not a verified HTML-injection finding.
• proposed — Retain the previous verified baseline in a durable recovery record until publication commits, so an interrupted release-body update cannot erase the range needed to reconstruct recovery notes.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Cmux Full Internationalization	❌ Error	The PR adds user-facing release metadata and rendered markdown in English without locale-specific sources. scripts/ci/nightly_release_notes.py:122-147 hard-codes headings and explanatory copy such a…	Use locale-specific message sources for generated release-note and appcast copy. Add matching translated entries to every supported locale file under web/messages/ for all 20 locales in web/i18n/routing.ts, and generate locale-appropria…
Docstring Coverage	⚠️ Warning	Docstring coverage is 2.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 43 functions across 2 files. (3 skipped: 3…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (23 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: publishing meaningful release notes for nightly builds.
Description check	✅ Passed	The description explains the problem, the resulting behavior, and the validation performed. It does not include the required Changelog section or the checklist; the demo video section is also absent, …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Cmux Cloud Persistent Session And Early Input	✅ Passed	The check does not apply to this diff. The changed files add nightly release-note generation and tests, and update release workflows. None changes Cloud terminal creation, persistent transport, manual…
Cmux Swift Actor Isolation	✅ Passed	The reviewed diff changes two workflow files, a Python release-notes script, and two test files. The changed-file inventory contains no Swift files, so this pull request does not introduce or worsen S…
Cmux Swift Blocking Runtime	✅ Passed	The reviewed diff changes two workflow files, a Python script, and two test files. It contains no Swift files, so it introduces no production Swift blocking or timing-based synchronization.
Cmux Browser Automation Off-Main	✅ Passed	The PR does not change browser socket automation. The authoritative changed-file list contains only CI workflows, the nightly release-notes script, and release-notes tests. It does not include `Source…
Cmux Expensive Synchronous Load	✅ Passed	The check applies to production Swift changes. The reviewed diff changes two workflow files and adds a Python script and Python tests; it contains no changed Swift files. Therefore, the pull request d…
Cmux Cache Substitution Correctness	✅ Passed	The check applies to production Swift, TypeScript, and JavaScript changes. The reviewed diff changes only workflow YAML, Python scripts, and a TOML test registry. It contains no changes in the covered…
Cmux No Hacky Sleeps	✅ Passed	The added Python release-notes script is within scope, but its only timing control is subprocess.run(..., timeout=90) for a GitHub API command. This bounds a potentially hung request; it does not ad…
Cmux Algorithmic Complexity	✅ Passed	The added runtime code in scripts/ci/nightly_release_notes.py does not introduce a prohibited complexity pattern. collect_prs processes commits in fixed batches of 25 and uses a set for membership…
Cmux Swift Concurrency	✅ Passed	The pull request changes only workflow YAML, Python scripts, and a TOML test registry. The reviewed diff contains no Swift files, so it does not introduce or materially expand Swift concurrency patter…
Cmux Swift @Concurrent	✅ Passed	The pull request changes only workflow, Python script, and test-registry files. The diff contains no Swift files or Swift code changes, so it introduces none of the annotation or actor-isolation failu…
Cmux Swift Package Boundaries	✅ Passed	The pull-request diff changes two workflow files, one Python script, and two test files. It changes no .swift files. The production Swift package-boundary check does not apply.
Cmux Swiftpm Lockfiles	✅ Passed	The PR changes two workflows, but it changes no Package.swift, Package.resolved, .gitignore, or Xcode project file. The workflow additions run Python release-note tests and generate release notes; the…
Cmux Swift Logging	✅ Passed	The pull request changes two workflow files, one Python script, and two test files. The authoritative diff contains no changed Swift files. The Swift logging check therefore does not apply.
Cmux User-Facing Error Privacy	✅ Passed	No explicit privacy violation is introduced. The changed workflow publishes release summaries and appcast descriptions, but those are normal product change notes, not user-facing errors, alerts, or re…
Cmux Swiftui State Layout	✅ Passed	The PR changes only workflow files, a Python script, and test files. The diff contains no Swift or SwiftUI source changes, so it introduces none of the state or layout patterns covered by the check.
Cmux Architecture Rethink	✅ Passed	The check applies to Swift architecture changes. The reviewed diff changes two workflow files, adds a Python script and test, and updates a test registry; it contains no changed Swift files. Therefore…
Cmux Swift Auxiliary Window Close Shortcuts	✅ Passed	The pull request changes two workflow files, adds one Python script and one Python test, and updates the test registry. The reviewed diff contains no Swift files or standalone cmux window changes, so …
Cmux Source Artifacts	✅ Passed	No source-control artifacts were added. The changed paths are workflow configuration, the nightly release-notes script, test execution configuration, and behavioral tests. The script and tests directl…
Cmux No Test Or Debug Seam In Production Source	✅ Passed	The pull request changes only workflow YAML, Python scripts, and a TOML test registry. It changes no Swift files under a production Sources/ path, so it introduces none of the specified test or debu…

Full details: Docstring Coverage

Explanation

Docstring coverage is 2.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 43 functions across 2 files. (3 skipped: 3 unsupported.)

Full details: Cmux Full Internationalization

Explanation

The PR adds user-facing release metadata and rendered markdown in English without locale-specific sources. scripts/ci/nightly_release_notes.py:122-147 hard-codes headings and explanatory copy such as “What changed,” “Fixes,” and “Infrastructure” in both the release markdown and appcast teaser; main writes them to the release body and feeds (:198-202). The workflow also creates English download copy (.github/workflows/nightly.yml:2096-2103). web/i18n/routing.ts:3-24 lists 20 supported locales, but the PR changes no web/messages/ or locale-routing files. This matches the rule for rendered markdown, metadata, and user-facing data. The separate tests and workflow edits do not alter that result.

Resolution

Use locale-specific message sources for generated release-note and appcast copy. Add matching translated entries to every supported locale file under web/messages/ for all 20 locales in web/i18n/routing.ts, and generate locale-appropriate published content (or include all locale variants) instead of emitting only the hard-coded English text. Keep dynamic PR titles and links as source content while localizing generated headings, labels, and explanatory copy.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI failure attribution

CI passes on c26495c963 (run 37374887362 attempt 1).

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's.

[github-actions]

CI fast guards passes on c26495c963 (https://github.com/manaflow-ai/cmux/actions/runs/37374886743). This covers only the fast guards, not CI: CI's result is the ci-status check, and the CI failure attribution comment names any failing test.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Merge receipt for c26495c963: every check was green at merge (15 verified; 16 skipped by policy). Full suite runs on main after merge.