chore: promote qualified public candidate - #6
Conversation
private-candidate-commit: 335010d666f10229dafa763fee241307b93b3690 export-tree-sha256: 2ca49200d3e8111d037a04a067807a3470bed3745e647ca9958b97dfa353e7fc file-count: 510
📝 WalkthroughWalkthroughThis PR aligns release validation and package policy with the public repository, enforces clean release worktrees, changes documentation links to tags or ChangesPublic release alignment
Wire conformance corpus
Estimated code review effort: 4 (Complex) | ~60 minutes Mergeability Score: 🟠 High · up to The release checks can miss certain encoded private paths, which could allow unintended internal references into the promoted public distribution. Merge should wait for the decoder fix and regression coverage. Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow
participant VerifyRelease
participant ReleaseChecks
participant DocumentationSite
ReleaseWorkflow->>VerifyRelease: normalized release state
VerifyRelease->>ReleaseChecks: worktree and publication content
ReleaseChecks->>DocumentationSite: documentation and brand validation
DocumentationSite-->>VerifyRelease: validation results
Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
scripts/release_checks.py (1)
1755-1766: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winApply public-reference checks at every release boundary.
_scan_contentcontains the new SDK and repository checks. Generated-site and worktree validation callscan_secret_and_address_contentdirectly. They do not execute these checks. A generated output can therefore contain a non-public SDK reference or an unapproved Picogrid repository URL and still pass release verification.Extract these checks into a shared scanner. Call it from both
_scan_contentand the worktree and generated-output validation paths.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/release_checks.py` around lines 1755 - 1766, Extract the non-public SDK, unapproved Picogrid repository, private package index, and private API checks from _scan_content into a shared scanner. Invoke that scanner from _scan_content and both the worktree and generated-output validation paths that call scan_secret_and_address_content, preserving the existing ArtifactPolicyError messages and behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/site/tests/documentation.spec.ts`:
- Around line 562-564: Update the test’s public source identity setup around
publicReference, publicSourceKind, and publicTitle to use the identity resolved
by resolveVersionControl instead of defaulting to main and branch when
DOCS_GIT_TAG is unset. Pass or reuse the resolver’s resolved reference and
source kind so clean v${version} checkouts produce the selected release tag.
In `@scripts/verify_release.py`:
- Around line 4128-4132: Update the git_worktree_status collection near
_require_clean_release_worktree to include ignored status entries, then filter
only approved generated roots from _EXPECTED_IGNORED_ROOTS before the
clean-worktree validation. Preserve rejection of any unexpected ignored path,
and add a regression test covering that case.
In `@tests/release/test_release_checks.py`:
- Around line 1108-1115: Update
test_content_scan_allows_the_public_documentation_package_name to invoke
_scan_content directly, or inspect a synthetic artifact through the path that
exercises it, while retaining the picogrid-ecn-sdk-docs input and policy setup
so the regression test verifies the new import detector allow case.
---
Outside diff comments:
In `@scripts/release_checks.py`:
- Around line 1755-1766: Extract the non-public SDK, unapproved Picogrid
repository, private package index, and private API checks from _scan_content
into a shared scanner. Invoke that scanner from _scan_content and both the
worktree and generated-output validation paths that call
scan_secret_and_address_content, preserving the existing ArtifactPolicyError
messages and behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 143ab084-890b-44df-a323-630b5585294d
📒 Files selected for processing (37)
.github/CODEOWNERS.github/workflows/release.yml.github/workflows/scorecard.yml.gitignoreCONTRIBUTING.mdMANIFEST.inMakefileNOTICE.mddocs/README.mddocs/cspell.jsondocs/reference/evidence-status.mddocs/reference/original-ecn-integration-parity.mddocs/site/check-built-site.mjsdocs/site/public-routes.mjsdocs/site/tests/documentation.spec.tsdocs/site/version-control.mjsdocs/site/version-control.test.mjsdocs/src/components/DocumentationFooter.astrodocs/src/components/VersionSelect.astrodocs/src/content.config.tsdocs/src/pages/404.astrodocs/src/styles/picogrid.csspyproject.tomlscripts/installed_examples.pyscripts/installed_wheel_probe.pyscripts/original-guide-inventory.jsonscripts/release-policy.jsonscripts/release_checks.pyscripts/verify_release.pyscripts/verify_types.pytests/contract/test_synthetic_fixtures.pytests/differential/test_public_boundary.pytests/examples/conftest.pytests/examples/test_examples.pytests/release/test_operator_artifact_release.pytests/release/test_release_checks.pytests/release/test_version_sync.py
💤 Files with no reviewable changes (10)
- pyproject.toml
- docs/reference/original-ecn-integration-parity.md
- scripts/original-guide-inventory.json
- .gitignore
- docs/reference/evidence-status.md
- docs/site/public-routes.mjs
- tests/differential/test_public_boundary.py
- docs/src/content.config.ts
- scripts/installed_wheel_probe.py
- MANIFEST.in
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/release_checks.py`:
- Around line 1872-1881: Update the variant expansion logic around the HTML-file
handling and _scan_nonpublic_references flow to apply both percent decoding and
html_unescape to newly generated variants until reaching a fixed point, while
enforcing a small maximum iteration depth. Preserve deduplication and existing
scan behavior, and add a regression case in the release-check tests covering
&`#37`;2finternal&`#37`;2fstatus.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 69091b38-824c-4288-b7b5-235b53cf0694
📒 Files selected for processing (12)
CHANGELOG.mddocs/site/tests/documentation.spec.tsdocs/site/url-compatibility.test.mjsscripts/release_checks.pyscripts/verify_release.pytests/contract/test_synthetic_fixtures.pytests/examples/test_examples.pytests/fixtures/conformance/drop_policy.jsontests/fixtures/conformance/manifest.jsontests/fixtures/conformance/topic_grammar.jsontests/release/test_release_checks.pytests/unit/test_conformance_corpus.py
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 353dd4316a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| percent_variant_count = len(scan_texts) | ||
| for index in range(percent_variant_count): | ||
| decoded = html_unescape(scan_texts[index]) | ||
| if decoded != scan_texts[index] and decoded not in scan_texts: | ||
| scan_texts.append(decoded) |
There was a problem hiding this comment.
When an HTML artifact encodes percent signs as entities, such as %2Finternal%2Fstatus, the percent-decoding loop runs before html_unescape, and the resulting %2Finternal%2Fstatus variant is never decoded again. Consequently scan_publication_content accepts a browser-resolvable private API path (and similarly encoded non-public references), bypassing the publication boundary this change adds; iterate both decoders to a bounded fixed point or percent-decode each HTML-decoded variant.
Useful? React with 👍 / 👎.
| expected = metadata.get("canonical_sha256") | ||
| if expected is None: | ||
| continue |
There was a problem hiding this comment.
If canonical_sha256 is accidentally removed from a json_entity, json_location, or task_envelope manifest entry while its raw file hash remains, this test silently skips that fixture and every other corpus test still passes because the manifest itself is not integrity-pinned. That permits the new corpus to stop enforcing a canonical encoding without CI noticing; require this field for every family to which canonical encoding applies and reserve the skip only for explicitly non-canonical families.
Useful? React with 👍 / 👎.
1 participant
Summary
The SDK runtime, public API, wire protocol, authentication model, and supported platform set are unchanged.
Promotion record
95c9b3d4f8078104f8a72be26e1018979cc03b5b23b094b49632f9c928c916fcb90050560ad26fdfb5218befc9508820a2a5d061Verification
Merge only after required public checks and independent review clear for public head
353dd4316a8a8415afe667bcd2d9608ba653fd6c.Summary by CodeRabbit
Documentation
mainbranch.Release Improvements
Conformance
Maintenance