ci: bind release writeback to verified source - #52
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🔵 Needs a closer look
It changes the repository’s release/writeback and CI concurrency behavior in ways that are correct-looking but high-impact and dependent on external GitHub API semantics.
Pull request overview
This PR hardens the release pipeline so the signed “writeback” commit and eventual tag are bound to the verified workflow event SHA (immutable), preventing races with a moving main and avoiding workflow-wide cancellations interrupting an active release.
Changes:
- Replace the third-party semantic-release “GitHub commit” plugin with a custom
release-commit.tsprepare step that atomically writes back via GraphQL usingexpectedHeadOid, then fetches and validates the returned commit before proceeding. - Add a regression test suite covering multiple branch-movement and corruption scenarios for the signed writeback flow.
- Adjust CI concurrency to only cancel superseded PR checks (not pushes) and pin the release checkout to
${{ github.sha }}; update docs and typechecking coverage accordingly.
File summaries
| File | Description |
|---|---|
| packages/react-json-logic/tsconfig.json | Include scripts/ so the new release plugin is typechecked. |
| packages/react-json-logic/tests/release-commit.test.ts | Adds regression tests for signed writeback invariants and failure modes. |
| packages/react-json-logic/scripts/release-commit.ts | New semantic-release prepare plugin implementing atomic writeback + fetch/validation. |
| CONTRIBUTING.md | Documents the new release writeback mechanics and recovery guidance. |
| .releaserc.json | Switches semantic-release from @jno21/semantic-release-github-commit to the local plugin. |
| .github/workflows/ci.yml | Prevents push-to-main runs from being canceled mid-release and pins release checkout to the event SHA. |
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Problem
Release writeback could combine a verified package manifest with newer main-branch source and tag a moving branch. Workflow-wide cancellation could also interrupt the release job despite its own non-cancellable group.
Solution
Bind release checkout and signed writeback to the verified event commit, then fetch and validate the returned immutable commit before tagging. Only the nested package version may change. Cancel superseded PR checks while allowing an active release to finish; preserve npm's publishing identity.
Proof
Thirteen real-Git/synthetic-API regressions cover branch movement, preparation and response corruption, and accepted-write/readback failure. Simulating the old moving-main reset fails the regression.
pnpm verifypasses 124 tests, coverage thresholds, library/demo checks and builds. Native Node plugin import, actionlint, zizmor and Astra/medium slopguard pass.No new release was forced; live signed preparation and publication remain unexercised. Recovery is documented for an accepted version commit followed by failed readback.