feat(maint): batch canonical dev-tool updates - #2902
Merged
Conversation
stranske
added
agent:codex
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
📝 WalkthroughWalkthroughThe PR consolidates shared dev-tool updates into a weekly source-proposal workflow. It adds policy checks and security overrides, makes Maint 50 read-only, records the canonical source commit in Maint 52, and updates documentation and tests. ChangesCanonical dev-tool updates
Estimated code review effort: 4 (Complex) | ~45 minutes Suggested labels: Sequence Diagram(s)sequenceDiagram
participant Scheduler
participant SourceWorkflow
participant PolicyTool
participant WeeklyBranch
participant SourcePR
Scheduler->>SourceWorkflow: Trigger Monday run or security_override dispatch
SourceWorkflow->>PolicyTool: Evaluate timestamp and override
PolicyTool-->>SourceWorkflow: Return proposal decision and reason
SourceWorkflow->>WeeklyBranch: Reset or create weekly branch
SourceWorkflow->>WeeklyBranch: Force-push with lease protection
SourceWorkflow->>SourcePR: Edit existing PR or create source PR
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Owner
Author
|
Runner dispatch state for autofix on PR #2902. Do not edit. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
stranske
temporarily deployed
to
agent-high-privilege
August 2, 2026 18:09 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
|
Runner dispatch state for codex on PR #2902. Do not edit. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR consolidates shared dev-tool version updates into a single canonical “source proposal” workflow lane (weekly batching + explicit security override), makes Maint 50 read-only for freshness evidence, and ensures Maint 52 propagation records the settled canonical source commit for traceability.
Changes:
- Refactors
maint-auto-update-pypi-versions.ymlinto a weekly (Monday UTC) single-writer PR lane with asecurity_overridedispatch input. - Removes issue-creation behavior from
maint-50-tool-version-check.yml, leaving it as read-only PyPI freshness reporting. - Records and threads a
canonical_source_shathrough Maint 52 outputs, delivery marker, and PR body; adds tests/docs to lock in the contract.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
tests/workflows/test_dev_tool_source_lane.py |
Adds workflow-contract assertions for the single-writer lane (Maint Auto-Update), read-only Maint 50, and canonical source SHA propagation. |
tests/scripts/test_dev_tool_update_policy.py |
Adds unit coverage for weekly-window vs security-override gating logic. |
scripts/dev_tool_update_policy.py |
Introduces a small policy helper/CLI to gate whether the source lane may propose updates. |
docs/ops/CONSUMER_REPO_MAINTENANCE.md |
Documents the new single-writer ownership model and the canonical-source SHA traceability expectation. |
docs/ci/TOOL_VERSION_MANAGEMENT.md |
Updates the documented tool-version management flow to reflect the new lane ownership and cadence. |
.github/workflows/maint-auto-update-pypi-versions.yml |
Moves from daily proposals to a weekly batch window + security override; reuses one mutable weekly PR branch. |
.github/workflows/maint-52-sync-dev-versions.yml |
Captures and propagates the settled Workflows source commit SHA into outputs and PR body/marker. |
.github/workflows/maint-50-tool-version-check.yml |
Removes issue-creation permissions and steps; emits freshness evidence only. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7f2107331c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/maint-52-sync-dev-versions.yml (1)
279-283: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winPass
canonical_source_shathroughenv:instead of interpolating it directly.Lines 358, 378, and 421 interpolate
${{ needs.prepare.outputs.canonical_source_sha }}directly intorun:script bodies. zizmor flags all three as template-expansion injection risk. The "Create sync PR" step already avoids this pattern for other dynamic values: it threadsDELIVERY_PLAN_ID,DELIVERY_GENERATION,DELIVERY_REPOSITORY, andmatrix.repothrough theenv:block at Lines 279-283 and references them as shell variables. Apply the same pattern tocanonical_source_shaat all three sites.Today
canonical_source_shais agit rev-parse HEADoutput (hex SHA) from a trusted checkout, so it is not currently attacker-controllable free text. Fix this anyway to close the flagged injection class and keep the pattern consistent within the file.As per path instructions, "Flag template-injection, unpinned third-party actions, and spoofable bot-actor checks — this workflow YAML is synced across the consumer repos, so one bug replicates fleet-wide."
🔧 Proposed fix: thread the SHA through env at each site
env: GH_TOKEN: ${{ env.REPO_TOKEN }} DELIVERY_PLAN_ID: dev-tool-${{ needs.prepare.outputs.versions_hash }} DELIVERY_GENERATION: ${{ needs.prepare.outputs.versions_hash }} DELIVERY_REPOSITORY: ${{ matrix.repo }} + CANONICAL_SOURCE_SHA: ${{ needs.prepare.outputs.canonical_source_sha }}- --arg source_commit "${{ needs.prepare.outputs.canonical_source_sha }}" \ + --arg source_commit "$CANONICAL_SOURCE_SHA" \- **Settled source commit:** \`${{ needs.prepare.outputs.canonical_source_sha }}\` + **Settled source commit:** \`$CANONICAL_SOURCE_SHA\`For the
summaryjob (Line 421), addCANONICAL_SOURCE_SHA: ${{ needs.prepare.outputs.canonical_source_sha }}to that step'senv:and reference$CANONICAL_SOURCE_SHAinstead.Also applies to: 358-358, 378-378, 421-421
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/maint-52-sync-dev-versions.yml around lines 279 - 283, Update the three run steps that currently interpolate needs.prepare.outputs.canonical_source_sha directly in their scripts, including the summary step, by adding CANONICAL_SOURCE_SHA to each step’s env block and referencing it as a shell variable. Preserve the existing SHA usage and apply the same environment-variable pattern already used by DELIVERY_PLAN_ID and related values.Sources: Path instructions, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/maint-auto-update-pypi-versions.yml:
- Around line 166-176: Remove the stale references to the central maintenance
workflows from the consumer template documentation, updating the workflow
entries in WORKFLOW_USER_GUIDE.md rather than adding or duplicating workflow
files. Ensure both template references accurately reflect that these workflows
have no consumer-template counterparts.
- Around line 124-131: The existing weekly branch flow must establish an
explicit push lease when an open PR is found. Update the branch handling around
existing_pr, git fetch, and git checkout -B to check out FETCH_HEAD, capture its
SHA as the expected revision, and pass
--force-with-lease="refs/heads/$branch:$expected_sha" to the later push;
preserve the current behavior for branches without an existing PR.
In `@docs/ci/TOOL_VERSION_MANAGEMENT.md`:
- Around line 72-73: Insert a blank line after the “Canonical Source Proposal
(`maint-auto-update-pypi-versions.yml`)" heading and before its first list item
to satisfy Markdown heading-spacing requirements.
- Around line 69-70: Update the Maint 50 documentation in
TOOL_VERSION_MANAGEMENT.md and the corresponding references in WORKFLOWS.md to
describe only the canonical source PR flow. Remove instructions to create or
close update issues, create separate competing PRs, or otherwise use the
issue-based proposal path, while preserving the read-only freshness-evidence
behavior.
In `@scripts/dev_tool_update_policy.py`:
- Around line 23-34: Add test coverage for the CLI output contract by invoking
scripts.dev_tool_update_policy.main with the specified UTC timestamp and
capturing stdout via capsys. Assert the exact should_propose= and reason= lines,
including a separate invocation with --security-override, while preserving the
existing argument parsing and output format.
---
Outside diff comments:
In @.github/workflows/maint-52-sync-dev-versions.yml:
- Around line 279-283: Update the three run steps that currently interpolate
needs.prepare.outputs.canonical_source_sha directly in their scripts, including
the summary step, by adding CANONICAL_SOURCE_SHA to each step’s env block and
referencing it as a shell variable. Preserve the existing SHA usage and apply
the same environment-variable pattern already used by DELIVERY_PLAN_ID and
related values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 013fb5b8-0491-45e6-8ac1-642e03643871
📒 Files selected for processing (8)
.github/workflows/maint-50-tool-version-check.yml.github/workflows/maint-52-sync-dev-versions.yml.github/workflows/maint-auto-update-pypi-versions.ymldocs/ci/TOOL_VERSION_MANAGEMENT.mddocs/ops/CONSUMER_REPO_MAINTENANCE.mdscripts/dev_tool_update_policy.pytests/scripts/test_dev_tool_update_policy.pytests/workflows/test_dev_tool_source_lane.py
Contributor
🤖 Bot Comment Handler
The agent has been assigned to this PR to address the bot review comments. Instructions for agent
The bot comment handler workflow has prepared context in the artifacts. |
stranske
temporarily deployed
to
agent-high-privilege
August 2, 2026 18:31 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Owner
Author
|
Addressed the current review set in
Validation: 9 focused tests passed; Actionlint, YAML parsing, |
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/ci/TOOL_VERSION_MANAGEMENT.md`:
- Line 181: Update the troubleshooting step for the missing canonical source PR
to reference maint-auto-update-pypi-versions.yml and its 03:00 UTC Monday
schedule (0 3 * * 1), replacing the Maint 50 freshness-report schedule.
In `@docs/ci/WORKFLOW_SYSTEM.md`:
- Line 713: Update the Maint 52 entry in docs/ci/WORKFLOW_SYSTEM.md at line 713
to describe post-source-commit propagation instead of Sunday and push triggers.
Update docs/ci/WORKFLOWS.md at line 125 to remove “weekly or on version changes”
and state that Maint 52 consumes the validated canonical source commit.
In `@templates/consumer-repo/WORKFLOW_USER_GUIDE.md`:
- Around line 1118-1120: Update the Maint 50 checklist near the central
freshness-audit purpose and trigger so it matches the canonical PyPI freshness
contract for the central developer-tool pin set; remove unrelated runtime and
CLI version checks, or explicitly separate and document them if the workflow
validates both scopes.
In `@tests/scripts/test_dev_tool_update_policy.py`:
- Line 4: Add a boundary test alongside the existing tests for
should_propose_update that supplies a timestamp whose local date is Sunday but
whose UTC conversion falls on Monday, then assert the policy evaluates the
weekday using the converted UTC value. Keep the test focused on the UTC day
boundary and use the existing test conventions and policy inputs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 94a0336f-40a0-477f-a2b8-2a747ff3f90a
📒 Files selected for processing (10)
.github/workflows/maint-52-sync-dev-versions.yml.github/workflows/maint-auto-update-pypi-versions.ymldocs/WORKFLOW_GUIDE.mddocs/ci/TOOL_VERSION_MANAGEMENT.mddocs/ci/WORKFLOWS.mddocs/ci/WORKFLOW_SYSTEM.mdscripts/dev_tool_update_policy.pytemplates/consumer-repo/WORKFLOW_USER_GUIDE.mdtests/scripts/test_dev_tool_update_policy.pytests/workflows/test_dev_tool_source_lane.py
Align Maint 50/52 docs with the settled-source contract, correct the source-lane troubleshooting schedule, and cover UTC weekday boundary evaluation. Co-authored-by: Cursor <cursoragent@cursor.com>
Owner
Author
Closer review recovery (cursor) — second passAddressed the 4 remaining non-outdated CodeRabbit threads on head
Validation: |
stranske
temporarily deployed
to
agent-high-privilege
August 2, 2026 18:38 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
|
Autofix updated these files:
|
stranske
added
the
agent:retry
stranske
temporarily deployed
to
agent-high-privilege
August 2, 2026 19:02 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
stranske
temporarily deployed
to
agent-high-privilege
August 2, 2026 19:23 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
Provider Comparison ReportProvider Summary
📋 Full Provider Details (click to expand)openai
anthropic
Agreement
DisagreementNo major disagreements detected. Unique Insights
🔍 LangSmith Traces |
This was referenced Aug 2, 2026
Owner
Author
Closer disposition — verifier CONCERNS follow-up openedDurable Provider Comparison Report on this PR is CONCERNS (2026-08-02T19:30:48Z; openai + anthropic agreed). Human-disposition audit against current main:
Source issue #2882 was reopened for sequencing until #2903 verifies. |
This was referenced Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2882
Automated Status Summary
Scope
Shared developer-tool pins are currently checked and propagated by several scheduled surfaces:
.github/workflows/maint-auto-update-pypi-versions.yml:11-15,45-141,.github/workflows/maint-50-tool-version-check.yml:6-9,43-149, Maint 52, andmaint-sync-env-from-pyproject.yml. The repository documentation indocs/ci/TOOL_VERSION_MANAGEMENT.mdstill describes a partly manual Maint 50 flow even though a daily updater can open source PRs.This is a current churn source: the same upstream version movement can be detected, commented on, proposed, and propagated by different workflows before the canonical source state settles. That creates extra source PRs, consumer waves, and agent decisions.
Context for Agent
Related Issues/PRs
Tasks
.github/workflows/autofix-versions.env,pyproject.toml, consumer/integration template env files, andrequirements.lock..github/workflows/maint-auto-update-pypi-versions.ymlinto the sole source proposal lane with a weekly batch window and a documented security override..github/workflows/maint-50-tool-version-check.yml; retain only a bounded policy/freshness audit if it adds unique evidence..github/workflows/maint-52-sync-dev-versions.ymlpropagation-only: it must consume a settled canonical source commit and must not independently decide newer versions..github/workflows/maint-sync-env-from-pyproject.ymlas a deterministic source-consistency check or replace it with a named equivalent; prevent it from racing the source proposal lane.docs/ci/TOOL_VERSION_MANAGEMENT.md,docs/ops/CONSUMER_REPO_MAINTENANCE.md, and contributor guidance with ownership, cadence, emergency handling, and supersession rules.Acceptance criteria
tests/workflows/test_maint52_sync_dev_versions_pr_body.pyproves Maint 52 reports the canonical source commit and never proposes an upstream version independently.tests/workflows/test_sync_dev_dependencies.pyproves env, pyproject, template, and lockfile pins move together for every managed tool.python scripts/dev_check.py --action testand the workflow-validation suite successfully.Summary by CodeRabbit
New Features
Documentation
Tests