[Xuepoo]

Priority: P2 | Area: ci | Labels: chore, P2 | Milestone: v0.1.0 | RFC: none | Task: AI-0346

Refs bitty-ai#543.

Summary

Re-vendors the hardened scripts/workflow-publish.sh from bitty-ai main 03e7d3b (bitty-ai#550) byte-identically. The script now verifies HEAD against a freshly fetched origin/main for every checkout (including branch main), parses the top-level redacted JSON boolean, pins the validated snapshot commit through push, and fails closed before export/push.

Only the script changed; just workflow-publish already invokes it. Canonical SHA-256: 6b67579c9499d24c4d0ef69802901d5324a929f241091ded32de6a85c0b8e518.

Verification

shellcheck -S warning, shfmt -d, actionlint, and git diff --check pass. No behavior outside the vendored script; no secrets.

Summary by CodeRabbit

• Chores
  • Publishing now checks that the current checkout matches the remote main branch or is based on it, unless the non-main override is used.
  • Before publishing, the exported manifest must contain valid JSON with a top-level redacted value set to true; otherwise, publishing is stopped.
  • Publishing uses the exact commit that passed validation, avoiding changes if the publication commit is unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9d891d53-2470-43e8-bdbe-3128f573e2a0

📥 Commits

Reviewing files that changed from the base of the PR and between ea664e8 and dd44a88.

📒 Files selected for processing: 1

• scripts/workflow-publish.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The publish script refreshes and checks $REMOTE/main for each checkout. It validates the exported commit’s manifest.json as JSON, compares commit IDs for no-op behavior, and pushes the validated commit rather than a mutable ref.

Changes: Publication workflow

Layer / File(s)	Summary
Source readiness checks scripts/workflow-publish.sh	The script checks for python3 and fetches $REMOTE/main to check whether HEAD is equal to or an ancestor of it. The updated usage notes describe the source check and bypass behavior.
Commit validation and publication scripts/workflow-publish.sh	The script resolves the publication ref to a commit, validates that commit’s manifest.json, compares commit IDs for the no-op check, and pushes the resolved commit when it has changed.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to dd44a

No actionable issue is established from the supplied evidence; merge after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names the change type and scope (a re-vendored, hardened workflow-publish script under ci). The raw summary and objectives confirm the main change is the re-vendored scripts/workflow-publish…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the change type and scope (a re-vendored, hardened workflow-publish script under ci). The raw summary and objectives confirm the main change is the re-vendored scripts/workflow-publish.sh with remote-main source checks, a fail-closed redacted-JSON guard, and a pinned publication commit. The title is specific enough, and it does not describe anything absent from the changeset. The ticket prefix and conventional-commit style are acceptable.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}