fix(cua-driver-rs): bake release version via API

[f-trycua]

Summary

Fixes #2121.

Updates the cua-driver-rs release bake-back step so it does not directly push to protected main after publishing release assets.

What changed

• Sets release checkout persist-credentials: false so the default GITHUB_TOKEN does not linger in checkout auth state.
• Keeps the release GitHub App token for bake-back writes.
• Commits baked installer version changes on a temporary branch.
• Fast-forwards main via the GitHub refs API using the release App token.
• Deletes the temporary branch after the API update.
• Adds no-op handling when installers already contain the release version.
• Adds clearer error messages for App permission/ruleset failures.

Validation

• git diff --check
• YAML parse of .github/workflows/cd-rust-cua-driver.yml
• Extracted bake-back shell block passed bash -n

Note: did not trigger an actual release. This mirrors the temp-branch/API update pattern that succeeded in the prior bump workflow with the same release App identity.

Summary by CodeRabbit

• Bug Fixes
  • Improved the release process to make version updates more reliable and reduce the chance of failed or incomplete releases.
  • Strengthened how release changes are published so the main branch stays in sync more safely during release automation.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a3ed035a-7270-49cb-a869-3cfe9b89a30b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The Release job in cd-rust-cua-driver.yml was updated to disable persisted checkout credentials and to replace the direct push of the bake-version commit to main with a safer flow: pushing to a temporary branch, then fast-forwarding main via the GitHub API, with error handling and temp-branch cleanup.

Changes

Release workflow bake-back push fix

Layer / File(s)	Summary
Checkout credential hardening .github/workflows/cd-rust-cua-driver.yml	Adds persist-credentials: false to the checkout step in the Release job.
Temp-branch push and fast-forward flow .github/workflows/cd-rust-cua-driver.yml	Updates comments explaining the ruleset bypass constraints, re-authenticates origin with the GitHub App token, resets the bake-version branch from origin/main, pushes the bake commit to a uniquely named temporary branch, fast-forwards main via gh api PATCH with force=false, and adds an EXIT trap to clean up the temp branch along with explicit error handling.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• trycua/cua#1128: Both PRs use a GitHub App token for authenticated Git operations in release workflows.
• trycua/cua#1517: Both PRs implement the bake-and-push flow for the tracked install script version on main.
• trycua/cua#1770: The main PR's push/fast-forward fix underpins the baked version updates made in this related PR.

Poem

A rabbit hops through YAML lines,
Fixing pushes, dodging signs 🚧,
No more 403s to fear,
Temp branch push, then fast-forward clear,
Main branch safe another year! 🐇✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the workflow change: it describes baking the release version via API instead of pushing directly to main.
Linked Issues check	✅ Passed	The workflow now avoids direct protected-main pushes and uses an App token plus API fast-forward, matching issue #2121's bake-back fix.
Out of Scope Changes check	✅ Passed	All changes stay within the release bake-back workflow and support the linked issue's release automation goal.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/2121-cua-driver-rs-release-bake-back

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/cd-rust-cua-driver.yml (1)

706-719: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Retry the fast-forward update on 422 conflicts. force=false will reject this PATCH with Update is not a fast forward if main advances after the fetch, so this release can still fail on a race. Re-fetch/rebase onto the latest origin/main and retry before failing, and make the error message distinguish that conflict from a ruleset or permission denial.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/cd-rust-cua-driver.yml around lines 706 - 719, The
fast-forward update in the release workflow can still fail on a race because the
current gh api PATCH to update main only tries once with force=false. Update the
release step around the main-branch ref patch to detect a 422 “Update is not a
fast forward” conflict, then re-fetch/rebase against the latest origin/main and
retry the fast-forward before giving up; keep the existing cleanup_temp_branch
trap behavior intact. Also adjust the failure message in this section so it
clearly distinguishes a fast-forward conflict from a ruleset or permission
denial, using the main update logic and TEMP_BRANCH cleanup path as the key
symbols to locate the change.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/cd-rust-cua-driver.yml:
- Around line 706-719: The fast-forward update in the release workflow can still
fail on a race because the current gh api PATCH to update main only tries once
with force=false. Update the release step around the main-branch ref patch to
detect a 422 “Update is not a fast forward” conflict, then re-fetch/rebase
against the latest origin/main and retry the fast-forward before giving up; keep
the existing cleanup_temp_branch trap behavior intact. Also adjust the failure
message in this section so it clearly distinguishes a fast-forward conflict from
a ruleset or permission denial, using the main update logic and TEMP_BRANCH
cleanup path as the key symbols to locate the change.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1672aee0-123d-441e-8722-1afaf4baa660

📥 Commits

Reviewing files that changed from the base of the PR and between 5c40ccf and e8bc8c8.

📒 Files selected for processing (1)

• .github/workflows/cd-rust-cua-driver.yml