ci(cmt): trigger CMT on RC tag cut (v*-rc*) instead of release-branch push - #3846
Merged
Conversation
The previous trigger was `push: branches: [release-v*]`, but actual release branches are named `release-X.Y` (e.g. `release-6.2`) — no `v` prefix — so the glob never matched and the trigger was effectively dead. The release team cuts an RC tag (e.g. `v6.2.0-rc.1`) as part of every RC, which is the right moment to run compatibility-matrix testing against the multi-version server set. Switch to `push: tags: [v*-rc*]`. The tag glob filters out GA tags (`v6.2.0`) and any non-RC pre-releases at the GitHub layer; Matterwick re-validates with a strict regex (`shouldTriggerCMT` / `isRCTag`) as defense-in-depth. Manual `workflow_dispatch` from the Actions tab still works against any ref.
|
@yasserfaraazkhan: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it. DetailsI understand the commands that are listed here |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughGitHub Actions workflows now broaden CMT RC-tag matching, remove the ChangesCMT and E2E workflows
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
The release team treats RCs as the go/no-go test gate and re-cuts on failures. Per-commit signal on master is already covered by Matterwick's push-event handler (E2EAutoTriggerOnMaster), and the multi-version matrix is owned by CMT at each RC tag cut. The scheduled nightly run (Thu+Fri midnight UTC) added no signal that those two flows don't already provide, so drop it. Matterwick's nightly handler code (handleNightlyE2ETrigger) becomes inert since no workflow with name "E2E Nightly Trigger" fires anymore. Left in place for now; can be cleaned up in a follow-up if mobile also removes its nightly workflow.
github-actions
Bot
added
E2E/Run
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
QA Report — Manual Verification
Verdict: APPROVE
This PR is CI-only (two workflow YAML files, no src/** changes). I validated workflow structure, tag-glob semantics against release.sh RC naming (vX.Y.Z-rc.N), confirmed e2e-nightly-trigger.yml removal leaves no dangling references, and ran an Electron Playwright smoke launch to ensure the build still starts. No regressions observed in testable scope. End-to-end CMT/Matterwick trigger behavior on a real RC tag push cannot be verified in this environment.
What was tested
| # | Scenario | Risk | Build | Verdict | Evidence |
|---|---|---|---|---|---|
| S1 | cmt-provisioner.yml trigger config: push.tags: v*-rc*, workflow_dispatch retained |
R1, R2 | test | Pass | S1_workflow_validation.png |
| S2 | Electron app smoke launch (empty config, welcome flow) | — (regression guard) | test | Pass | S2_app_main_window.png |
| S3 | e2e-nightly-trigger.yml deleted; nightly-builds.yaml schedule intact; no repo references to deleted workflow |
R3 | test | Pass | S1_workflow_validation.png |
| S4 | CMT workflow fires on RC tag cut (live GitHub Actions) | R1, R4 | — | Blocked | Cannot push RC tags in QA env |
| S5 | Matterwick receives workflow_run and provisions CMT matrix |
R4 | — | Blocked | External system; companion PRs not deployed here |
| S6 | Server-backed desktop login/session | — | — | Blocked | No Server for Cursor Automation: URL in PR description; MM_TEST_USER_NAME / MM_TEST_PASSWORD unset |
Findings
No Fail findings. Notable observations:
S1 — Tag glob semantics
- Canonical RC tags from
scripts/release.sh(e.g.v6.2.0-rc.1) matchv*-rc*as intended (grep-verified at.github/workflows/cmt-provisioner.yml:25-26). - GA tag
v6.2.0and nightly-stylev6.2.0-nightly.1do not match.
S3 — Nightly E2E trigger removal
e2e-nightly-trigger.ymlabsent on PR head; grep finds zero references in.github/.nightly-builds.yamlretains its ownschedule:cron (grep-verified at.github/workflows/nightly-builds.yaml:5).- Deleted workflow comment states Matterwick push handler is now canonical for push-triggered E2E — aligns with removal intent.
Adversarial pass
- Mechanism attacked: Over-broad
v*-rc*glob — can it fire CMT on unintended tags? - Result:
v6.2.0-rc.1-betaandv6.2.0-rc(no.N) both match the GitHub glob. PR documents matterwick defense-in-depth viashouldTriggerCMT/isRCTagstrict regex.release.shalways cuts-rc.Ntags, sov6.2.0-rcis unlikely in practice. Not a blocker given downstream validation. - Screenshot: S3_adversarial_tag_glob.png (captured locally at
/tmp/qa-screenshots/)
Risks not tested
| Risk | Reason |
|---|---|
| R4 | Live RC tag push → GitHub Actions trigger → Matterwick workflow_run handler (requires tag push + deployed matterwick) |
| R5 | Thu/Fri e2e-nightly-trigger cron removal reduces nightly E2E frequency unless Matterwick has alternate schedule (intentional per PR; not runtime-verifiable here) |
Threat model (Step 1)
| Risk | Description | Citation |
|---|---|---|
| R1 | Old release-v* branch glob never matched real release-X.Y branches; new tag trigger must match actual RC tags |
.github/workflows/cmt-provisioner.yml:24-26 |
| R2 | Tag glob v*-rc* could match non-RC tags |
.github/workflows/cmt-provisioner.yml:25-26 |
| R3 | Deleting e2e-nightly-trigger.yml breaks scheduled nightly E2E signaling |
deleted .github/workflows/e2e-nightly-trigger.yml |
| R4 | CMT only works when matterwick companion changes are deployed | PR description (untrusted data, cross-checked against diff scope) |
Suspicious inputs
None.
Screenshot evidence (local paths)
/tmp/qa-screenshots/S1_workflow_validation.png/tmp/qa-screenshots/S2_app_main_window.png/tmp/qa-screenshots/S3_adversarial_tag_glob.png
Automated manual QA — 2026-06-11 21:42:58 UTC start / 2026-06-11 21:45:40 UTC end — read-only, zero commits
Sent by Cursor Automation: Desktop QA Agent | Linux
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
Matterwick's nightly handler is gone (no workflow with name "E2E Nightly
Trigger" can fire it anymore, and the handleNightlyE2ETrigger function
has been removed). Matterwick was the only caller that ever set
nightly=true on this workflow; PR-label dispatches don't send it
(defaults to false). The downstream `if inputs.nightly` block in the
template that built `desktop-nightly-${OS}` build IDs was therefore
unreachable.
- e2e-functional.yml: drop `nightly` input + `nightly: ${{ inputs.nightly }}`
pass-through to the template.
- e2e-functional-template.yml: drop `nightly` input (twice in the file
— workflow_call inputs section + the duplicate `with:` block); drop
the `if inputs.nightly` block in the BUILD_SUFFIX / TYPE setup.
Also simplify the TYPE expression in e2e-functional.yml:
before: ${{ inputs.run_type != '' && inputs.run_type || startsWith(inputs.version_name, 'release-') && 'RELEASE' || 'PR' }}
after: ${{ inputs.run_type || 'PR' }}
The `startsWith(version_name, 'release-') && 'RELEASE'` fallback was for
matterwick's release-branch push case (which dispatched with
version_name=release-X.Y). That trigger is removed; matterwick now
always sets run_type explicitly (MASTER for master pushes; PR-label runs
intentionally leave it blank to default to PR). Manual dispatch can
still pass run_type=RELEASE directly.
github-actions
Bot
added
E2E/Run
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
devinbinnie
approved these changes
Jun 12, 2026
Resolves conflict in cmt-provisioner.yml by keeping the detailed comments and simpler glob pattern from this branch (v*-rc*) which relies on matterwick's strict regex validation as defense-in-depth.
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/cmt-provisioner.yml (1)
3-27: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winRestrict the RC tag glob This can still match tags like
v1.2.3-rcfooorv1-rc-branch, so it’s broader than the intendedvX.Y.Z-rc.Nshape. Tighten it if only canonical RC cuts should trigger CMT.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cmt-provisioner.yml around lines 3 - 27, The RC tag trigger in the workflow is too broad and can match non-canonical tags. Tighten the tag glob under the push/tags trigger in cmt-provisioner.yml so it only matches the intended vX.Y.Z-rc.N pattern, and keep the strict validation in Matterwick as the secondary check. Refer to the on: push tags configuration and the RC tag cut comment to locate the trigger.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/cmt-provisioner.yml:
- Around line 3-27: The RC tag trigger in the workflow is too broad and can
match non-canonical tags. Tighten the tag glob under the push/tags trigger in
cmt-provisioner.yml so it only matches the intended vX.Y.Z-rc.N pattern, and
keep the strict validation in Matterwick as the secondary check. Refer to the
on: push tags configuration and the RC tag cut comment to locate the trigger.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 8633944a-80d1-4f42-95c3-6dc99a39be2c
📒 Files selected for processing (3)
.github/workflows/cmt-provisioner.yml.github/workflows/e2e-functional-template.yml.github/workflows/e2e-functional.yml
🚧 Files skipped from review as they are similar to previous changes (2)
- .github/workflows/e2e-functional.yml
- .github/workflows/e2e-functional-template.yml
yasserfaraazkhan
added
release-note-none
and removed
do-not-merge/release-note-label-needed
labels
|
@yasserfaraazkhan: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it. DetailsI understand the commands that are listed here |
mm-cloud-bot
added
do-not-merge/release-note-label-needed
and removed
release-note-none
labels
mm-cloud-bot
added
release-note-none
and removed
do-not-merge/release-note-label-needed
labels
yasserfaraazkhan
added
CherryPick/Candidate
6 tasks
amyblais
pushed a commit
that referenced
this pull request
Aug 12, 2026
#3944) release-6.2 CMT Provisioner only had workflow_dispatch (no RC tag push), so v6.2.3-rc.* never auto-triggered Matterwick. Port the RC-tag trigger from #3846, the Bash 3.2 Zephyr env fix needed for macos-26 CMT legs, and update matrix schema comments for Matterwick ≥ v0.4.16 (#3920). Automated cherry-picks conflicted; same approach as #3934 on release-6.3. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Switches the CMT Provisioner trigger from
push: branches: [release-v*](which never matched, since real release branches arerelease-X.Ywith novprefix) topush: tags: [v*-rc*]— fires when the release team cuts an RC tag likev6.2.0-rc.1. Manualworkflow_dispatchis retained.This is the desktop counterpart to ongoing matterwick / mobile changes that wire CMT (Compatibility Matrix Testing) to release-candidate events: a webhook-driven model where Matterwick listens for
workflow_run, provisions one Mattermost server per CMT version, dispatchescompatibility-matrix-testing.yml, and tears the servers down on completion.Release Note
Change Impact: 🟡 Medium
Regression Risk: CI/workflow-only wiring changes: CMT now triggers on RC tags via
push.tags: v*-rc*(and still supportsworkflow_dispatch), plus related E2E workflow/input adjustments and removal of the scheduled nightly trigger. No application runtime/auth/data logic is touched, but downstream automation (Matterwick →workflow_run/CMT + cleanup) and expected CI coverage for nightly runs can change immediately, creating a moderate risk of missed/duplicate or delayed provisioning/testing.QA Recommendation: Do light validation focused on trigger behavior: (1) run the CMT workflow manually (
workflow_dispatch) to confirm the dispatch and downstream handoff work; (2) create a test RC tag matchingv*-rc*(e.g.,vX.Y.Z-rc.N) on a safe branch/commit and verify the CMT provisioner →compatibility-matrix-testing.ymlflow; (3) confirm scheduled nightly runs are intentionally gone (no replacement needed) and that E2E template dispatch still sets required variables for bothworkflow_dispatchand call sites.Generated by CodeRabbitAI