fix(release): keep Release Please lineage current

[myagentdojo]

Summary

Release maintenance no longer stalls on a release that was already published by the custom workflow. After publication or repair completes all immutable tag, asset, and attestation checks, the workflow now marks the provenance-bound Release Please PR as autorelease: tagged and removes autorelease: pending.

The reconciliation is idempotent and fail-closed. Its executable regression covers the actual label payload, first-run convergence, retry behavior, permission-style DELETE failure, and stale final state.

Validation

• bun test: 524 passed, 3 explicit manual/hosted skips, 0 failed
• bun test scripts/release-validate.test.ts: 41 passed
• actionlint .github/workflows/release.yml: clean
• git diff --check: clean
• Multi-lens review: no remaining P0/P1/P2 findings after fixes

Hosted qualification after merge: run the existing v0.1.1 repair lane to reconcile PR #18, then run maintenance and confirm Release Please opens the expected 0.2.0 release PR.

---

Summary by CodeRabbit

• Chores

  • Improved release automation so release status labels remain accurate after publishing.
  • Added safeguards that detect inconsistent release metadata and prevent completion until the status is corrected.
  • Repeated release updates now converge safely without creating additional changes.

• Tests

  • Expanded validation for release permissions, status reconciliation, repeated execution, unauthorized changes, stale labels, and expected failure scenarios.
  • Added coverage to confirm release automation behaves consistently across successful and unsuccessful workflows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b8fad1aa-262f-46f7-a5ef-7fa8a8212c09

📥 Commits

Reviewing files that changed from the base of the PR and between bb76f13 and 5a694a6.

📒 Files selected for processing (1)

• scripts/release-validate.test.ts

💤 Files with no reviewable changes (1)

• scripts/release-validate.test.ts

---

📝 Walkthrough

Walkthrough

The release workflow now reconciles Release Please labels for the admitted pull request. Integration tests validate permissions, idempotent updates, deletion failures, and stale-label convergence failures.

Changes

Release lineage reconciliation

Layer / File(s)	Summary
Workflow permissions and label reconciliation .github/workflows/release.yml	The release job can write issues and read pull requests. A new step updates Release Please labels and fails when the final state does not converge.
Reconciliation integration validation scripts/release-validate.test.ts	Tests parse the workflow and execute the reconciliation command with a fake gh CLI. Cases cover idempotent success, deletion failures, forbidden responses, stale labels, and cleanup.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseJob
  participant GhCLI
  participant AdmittedPullRequest
  ReleaseJob->>GhCLI: identify admitted pull request
  ReleaseJob->>GhCLI: add autorelease: tagged
  ReleaseJob->>GhCLI: remove autorelease: pending
  GhCLI->>AdmittedPullRequest: read final labels
  AdmittedPullRequest-->>ReleaseJob: return label state

Loading

Possibly related PRs

• myagentdojo/agent-plugin-template#11: Both changes modify Release Please label handling in the release workflow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the release workflow change that keeps Release Please lineage labels current.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-release-lineage-labels

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/release-validate.test.ts`:
- Around line 417-438: Update the fake GitHub CLI fixture handling POST requests
in the stale_labels branch so it still records the requested label, allowing
autorelease: tagged to be added alongside the existing autorelease: pending
label. Keep the stale_labels DELETE path as a successful no-op, preserving the
non-convergent state with both labels present.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 741cb989-a0f9-49f8-a8ee-7fb2baa103f2

📥 Commits

Reviewing files that changed from the base of the PR and between e927c24 and bb76f13.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• scripts/release-validate.test.ts