bugfix: release calendar logic

[transphorm]

Summary by CodeRabbit

• Chores
  • Enhanced internal release workflow security by implementing authenticated git operations for automated release branch creation and pushing.

[coderabbitai]

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

The PR modifies the GitHub Actions release calendar workflow to enable authenticated git operations. It adds PAT-based authentication by sourcing a token from secrets.SELFXYZ_INTERNAL_REPO_PAT and configuring the git remote URL to use this token for pushes when creating release branches.

Changes

Cohort / File(s)	Change Summary
Release Workflow Authentication .github/workflows/release-calendar.yml	Added GH_TOKEN environment variable sourced from secrets.SELFXYZ_INTERNAL_REPO_PAT in the "Create release branch from dev" step. Integrated git remote set-url configuration using PAT-based URL format for authenticated repository access.

Sequence Diagram

sequenceDiagram
    participant GH as GitHub Actions
    participant Git as Git Remote
    participant Repo as Repository
    
    rect rgb(245, 245, 245)
    Note over GH,Repo: Previous Flow (GITHUB_TOKEN)
    GH->>Git: git push (default token)
    Note over Git: May fail if insufficient permissions
    end
    
    rect rgb(240, 248, 255)
    Note over GH,Repo: New Flow (PAT Authentication)
    GH->>GH: Load GH_TOKEN from secrets.SELFXYZ_INTERNAL_REPO_PAT
    GH->>Git: git remote set-url origin<br/>(PAT-based URL)
    GH->>Git: git push (authenticated via PAT)
    Git->>Repo: Push release branch
    Repo-->>Git: ✓ Success
    end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Requires careful review of PAT token usage, conditional logic gating, and verification that authentication only triggers during release branch creation to avoid unnecessary token exposure.

Possibly related PRs

• code rabbit feedback for staging auto deploy logic #1255: Directly related—both modify .github/workflows/release-calendar.yml to switch GH_TOKEN sourcing to secrets.SELFXYZ_INTERNAL_REPO_PAT and adjust PAT-based authentication behavior.
• staging: update release calendar logic (#1256) #1257: Related—both change the "create release branch from dev" flow; this PR adds PAT-based git configuration while the related PR introduces release branch creation and BRANCH_NAME outputs.
• update release calendar logic #1256: Related—both modify release branch creation/push flow; this PR adds authenticated git remote setup for the branch-push operation.

Suggested labels

codex

Poem

🔐 A token appears, secure and refined,
Git remotes configured, authentication aligned,
PAT-based pushes now flow with grace,
Release branches find their rightful place! 🚀

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title "bugfix: release calendar logic" is directly related to the changeset, as the changes are contained within .github/workflows/release-calendar.yml and address workflow execution logic. However, the title is quite broad and doesn't convey the specific nature of the fix—namely, the introduction of PAT-based authentication for authenticated git pushes in the release workflow. While the title accurately references the affected component, it lacks specificity about what aspect of the release calendar logic was fixed, making it somewhat generic for code history scanning purposes.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch justin/fix-release-calendar-logic

---

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 14b7583 and 65e6b08.

📒 Files selected for processing (1)

• .github/workflows/release-calendar.yml (1 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (AGENTS.md)

.github/workflows/**/*.{yml,yaml}: In GitHub workflows, use the shared composite actions in .github/actions for dependency caching instead of calling actions/cache directly
Use the cache-yarn composite action for Yarn dependency caching in workflows
Use the cache-bundler composite action for Ruby gems caching in workflows
Use the cache-gradle composite action for Gradle caching in workflows
Use the cache-pods composite action for CocoaPods caching in workflows

Files:

• .github/workflows/release-calendar.yml

🔇 Additional comments (1)

.github/workflows/release-calendar.yml (1)

148-205: Verify GH_TOKEN usage consistency across PAT-authenticated steps.

The "Create dev to staging release PR" step (line 150) also uses secrets.SELFXYZ_INTERNAL_REPO_PAT for the gh pr create command. Ensure this token has appropriate permissions (contents: write, pull-requests: write) as declared in the workflow permissions. The GitHub token at line 312 in the production job should also be verified.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on November 17

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Bug: Hardcoded Repository Path Causes Workflow Failures

The Create release branch from dev step hardcodes the repository path selfxyz/self in the git remote URL. This makes the workflow non-portable, causing it to fail if the repository is renamed, moved, or reused in a different repository.

 

[transphorm]

seems like opening pull requests works as expected.

example:
#1313