ci: reconstruct release provenance on current main - #167
Conversation
📝 WalkthroughWalkthrough릴리스 버전 계약과 태그 일치 검증을 추가했습니다. 플랫폼별 산출물을 시도별로 업로드합니다. 태그 실행은 허용 목록, 체크섬, provenance attestation을 검증한 뒤 GitHub Release에 게시합니다. 재시도 동시성과 GPU 빌드 설정도 갱신했습니다. Changes릴리스 게이트
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related issues
Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow as Release workflow
participant VersionCheck as release-version.mjs
participant BuildJobs as Platform build jobs
participant AttestRelease as attest-release
participant GitHubRelease as GitHub Release
ReleaseWorkflow->>VersionCheck: validate manifest versions and release tag
VersionCheck-->>ReleaseWorkflow: validation result
ReleaseWorkflow->>BuildJobs: checkout exact source SHA and build artifacts
BuildJobs-->>ReleaseWorkflow: upload attempt-scoped artifacts
ReleaseWorkflow->>AttestRelease: download and validate artifacts
AttestRelease->>AttestRelease: verify allowlist and SHA-256 values
AttestRelease->>GitHubRelease: create provenance attestation
GitHubRelease-->>AttestRelease: attestation success
AttestRelease->>GitHubRelease: publish verified artifacts
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
scripts/ci/release-version.mjs (1)
135-151: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value직접 실행 엔트리포인트를 추가하십시오.
이 모듈에는 CLI 엔트리포인트 가드가 없습니다. 따라서
node scripts/ci/release-version.mjs는 아무 것도 검증하지 않고 종료 코드 0으로 끝납니다. 현재는package.json이--input-type=module --eval로main()을 호출해 이 제약을 우회합니다. 엔트리포인트 가드를 추가하면 스크립트 호출이 단순해지고, 향후 다른 워크플로가 파일을 직접 실행할 때 조용한 통과를 방지합니다.♻️ 제안 변경
+import { argv } from 'node:process'; + export function main({파일 끝에 실행 가드를 추가합니다:
+if (resolve(argv[1] ?? '') === fileURLToPath(import.meta.url)) { + main(); +}
node:url의fileURLToPathimport도 함께 추가합니다. 이후package.json의 스크립트를node scripts/ci/release-version.mjs로 단순화할 수 있습니다.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/ci/release-version.mjs` around lines 135 - 151, Add a direct-execution guard for the module using node:url's fileURLToPath, and invoke main() only when release-version.mjs is run directly. Preserve the existing exported main behavior while enabling package scripts and other workflows to execute the file directly.src/lib/releaseProvenanceContract.test.ts (1)
30-101: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win두 릴리스 계약 테스트가 워크플로 파싱 헬퍼와 픽스처 생성 코드를 중복합니다. 근본 원인은 공용 테스트 헬퍼 모듈이 없다는 점입니다. 워크플로의 단계 이름, 들여쓰기, 또는 필수 아티팩트 목록이 바뀌면 두 파일을 함께 수정해야 합니다.
src/lib/releaseProvenanceContract.test.ts#L30-L101:extractWorkflowJob,extractWorkflowRunScript,runReleaseArtifactVerifier,createReleaseArtifactFixture,operationalAssetNames를 공용 헬퍼 모듈로 이동하고 그 모듈에서 import하십시오.src/lib/releaseArtifactAllowlistContract.test.ts#L31-L106: 중복 정의를 삭제하고 동일한 공용 헬퍼 모듈에서 import하십시오.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/releaseProvenanceContract.test.ts` around lines 30 - 101, The workflow parsing and release-artifact fixture helpers are duplicated across two contract tests. Create a shared test helper module containing extractWorkflowJob, extractWorkflowRunScript, runReleaseArtifactVerifier, createReleaseArtifactFixture, and operationalAssetNames, then import and use those symbols in src/lib/releaseProvenanceContract.test.ts (lines 30-101) and remove their local definitions; likewise remove the duplicate definitions from src/lib/releaseArtifactAllowlistContract.test.ts (lines 31-106) and import the shared helpers there.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 36: Update the `@types/node` dependency to align with the supported Node.js
runtime declared by engines.node, preferably reverting it to the Node 20.19.x
type definitions; alternatively, raise the documented runtime minimum to Node 26
or newer if Node 26 support is intentional.
In `@src/lib/releaseVersionContract.test.ts`:
- Around line 115-122: Update the final verifyReleaseVersion() assertion in the
test to derive its expected version from the repository manifest instead of
hardcoding 0.1.0, and explicitly inject a controlled process.env/GITHUB_REF
environment for that call. Keep the existing fixture-based assertion and
readText call-count expectations intact.
---
Nitpick comments:
In `@scripts/ci/release-version.mjs`:
- Around line 135-151: Add a direct-execution guard for the module using
node:url's fileURLToPath, and invoke main() only when release-version.mjs is run
directly. Preserve the existing exported main behavior while enabling package
scripts and other workflows to execute the file directly.
In `@src/lib/releaseProvenanceContract.test.ts`:
- Around line 30-101: The workflow parsing and release-artifact fixture helpers
are duplicated across two contract tests. Create a shared test helper module
containing extractWorkflowJob, extractWorkflowRunScript,
runReleaseArtifactVerifier, createReleaseArtifactFixture, and
operationalAssetNames, then import and use those symbols in
src/lib/releaseProvenanceContract.test.ts (lines 30-101) and remove their local
definitions; likewise remove the duplicate definitions from
src/lib/releaseArtifactAllowlistContract.test.ts (lines 31-106) and import the
shared helpers there.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 3d65aef0-18ba-44cb-b728-dff52fdeac90
⛔ Files ignored due to path filters (2)
package-lock.jsonis excluded by!**/package-lock.jsonsrc-tauri/Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (11)
.github/workflows/release.ymlCHANGELOG.mddocs/doctoring/release-artifact-provenance.mddocs/doctoring/release-version-contract.mdpackage.jsonscripts/ci/release-version.mjssrc-tauri/Cargo.tomlsrc/lib/releaseArtifactAllowlistContract.test.tssrc/lib/releaseProvenanceContract.test.tssrc/lib/releaseVersionContract.test.tssrc/lib/releaseWorkflowRetryContract.test.ts
|
@coderabbitai review |
✅ Action performedReview finished.
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headdc8371095f833378d52b342905c41af9a6356df4. -
Head SHA:
dc8371095f833378d52b342905c41af9a6356df4 -
Workflow run: 31426258530
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: release.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: release.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (9 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (9 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: release-version.mjs"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: release-version.mjs"]
R4 --> V4["bash -n plus Strix self-test"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: release.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: release.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (6 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (6 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: release-version.mjs"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: release-version.mjs"]
R4 --> V4["bash -n plus Strix self-test"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head1bee8c9e25e7b2a29a6604128fc006d317e0d9ca. -
Head SHA:
1bee8c9e25e7b2a29a6604128fc006d317e0d9ca -
Workflow run: 31514279662
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 2
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: release.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: release.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (11 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (11 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: release-version.mjs"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: release-version.mjs"]
R4 --> V4["bash -n plus Strix self-test"]
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head2e7e54255d8361604a36dcb4a0be176df52aec88. -
Head SHA:
2e7e54255d8361604a36dcb4a0be176df52aec88 -
Workflow run: 31528307990
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: release.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: release.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (6 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (6 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: release-version.mjs"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: release-version.mjs"]
R4 --> V4["bash -n plus Strix self-test"]
1 participant
Purpose
Clean current-main successor for stale/non-mergeable #154. This line preserves the release-provenance/version/concurrency concern without importing unrelated coverage or canonical-documentation work. No predecessor check, review, approval, or synthetic merge evidence transfers.
Exact current state
2e7e54255d8361604a36dcb4a0be176df52aec88.main:2b891d2c5c50073b75e8a3099b5f58021d0a4806.main -> headcomparison provesbehind_by = 0, merge base equals current protected main, and exactly ten release-owned paths remain in the live delta.src-tauri/src/llm/parse.rs; the merge preserves that shipped parser repair without changing the release-owned file set.Preserved implementation
Seven independent #154 paths remain canonical on this line:
docs/doctoring/release-artifact-provenance.mddocs/doctoring/release-version-contract.mdscripts/ci/release-version.mjssrc/lib/releaseArtifactAllowlistContract.test.tssrc/lib/releaseProvenanceContract.test.tssrc/lib/releaseVersionContract.test.tssrc/lib/releaseWorkflowRetryContract.test.tsThree shared paths preserve the concern on the live base:
.github/workflows/release.yml: exact-head checkout, retry-safe concurrency, read-only platform builds, tag-only attestation, bounded artifact admission, checksum binding, unflattened artifact namespaces, attest-before-publish authority separation, and current immutable action pins;package.json: release-version verifier integrated into build while preserving current dependency/toolchain state;CHANGELOG.md: release-version, retry-concurrency, and provenance history reconciled with current Unreleased history.Every valuable unique #154 semantic/file delta is represented here; #154 remains superseded. No #154 evidence transfers.
Review-finding disposition
The predecessor direct-execution finding is addressed:
scripts/ci/release-version.mjsinvokesmain()only when run directly. The predecessor hard-coded-version test finding is addressed. The prior@types/nodefinding was resolved against protected-main dependency state rather than by creating PR-owned divergence. Any fresh current-head finding must be validated independently.Release boundary
contents: readonly;contents: read,id-token: write, andattestations: write;contents: writeand depends on successful attestation;Required before merge
Do not merge until the unchanged exact head has passing native Test/Release/Security/SAST plus every live required workflow, zero valid unresolved findings, and fresh live-base proof that it still descends from protected main. Pending, queued, skipped-required, stale-head, predecessor, diagnostic-only, status-only, model-only, rate-limited, or synthetic evidence is not passing.