feat(scripts): add policy release status and dispatch tooling - #261

scripts/policy-release/release_policies.py (2)

200-212: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Concurrent gh run watch output may interleave.

watch() streams directly to the console (capture=False) from multiple threads at once; output from concurrent runs can interleave in the terminal. Cosmetic only — final per-policy status is still printed correctly afterward.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/policy-release/release_policies.py` around lines 200 - 212, Update
the concurrent watch flow around watch() and ThreadPoolExecutor so each run’s gh
output is captured or otherwise synchronized before being written to the
console, preventing interleaved output from multiple threads. Preserve the
existing results mapping and final per-policy status behavior.

---

108-115: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

watch() conflates infra errors with workflow failure.

Any non-zero exit from gh run watch (including transient network/auth issues) is reported as "failure", which halts subsequent waves the same as a genuine workflow failure. This matches the documented fail-safe intent, but distinguishing gh CLI errors from an actual failed run conclusion (e.g., via gh run view --json conclusion) would avoid unnecessarily blocking releases on transient tooling issues.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/policy-release/release_policies.py` around lines 108 - 115, Update
watch() so non-zero gh run watch exits are distinguished from genuine workflow
failures: query the completed run’s conclusion using gh run view --json
conclusion, and only return "failure" when the workflow conclusion indicates
failure. Preserve the existing (run_id, conclusion) return contract while
representing transient gh CLI or infrastructure errors separately so they do not
get treated as workflow failures.

scripts/policy-release/policy_release_status.py (1)

99-114: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider real parsers instead of hand-rolled regex extraction.

read_yaml_name_version and read_pyproject_version extract values via line-anchored regex rather than yaml.safe_load/tomllib. This works for the simple unquoted scalars in this repo today, but is fragile against quoted strings, inline comments, or non-top-level indentation — any of which would silently corrupt policy_name/yaml_version/pyproject_version and cascade into wrong release-readiness computations.

♻️ Sketch using standard parsers

import tomllib

def read_pyproject_version(policy_dir: Path):
    pyproject = policy_dir / "pyproject.toml"
    if not pyproject.exists():
        return None
    with open(pyproject, "rb") as f:
        data = tomllib.load(f)
    return data.get("project", {}).get("version")

Also applies to: 149-159

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/policy-release/policy_release_status.py` around lines 99 - 114,
Replace the hand-rolled regex parsing in read_yaml_name_version and
read_pyproject_version with real parsers: use the repository’s YAML parser with
safe loading for policy-definition.yaml and tomllib.load for pyproject.toml.
Read only the intended top-level YAML name/version and project.version TOML
fields, preserve the existing missing-file/absent-value behavior, and return
parsed values without corruption from quoting, comments, or indentation.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes