Repository navigation
Fix release regex parsing and missing artifact prepare coverage - #254
Merged
Merged
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
Summary by CodeRabbit
WalkthroughThe release workflow now matches its date-version pattern through a variable, with Bash regression tests for valid and invalid versions. Prepare-merge-driver tests cover ChangesDependabot release validation
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~12 minutes Change: Bug fix Possibly related PRs
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly summarizes both primary changes: release regex parsing and missing prepare coverage. |
| Description check | |
The description directly explains the release regex auditor defect, prepare coverage gap, implemented fixes, and validation results. |
| Docstring Coverage | |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (4 skipped: 4 … |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (4 skipped: 4 unsupported.)
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Reviewer's GuideThe PR fixes canonical release-workflow auditing by binding the Bash version regex as literal data, adds regression coverage for its matching semantics, and restores prepare-launcher coverage for npm pack/publish while validating that configured checkout artifacts remain intact. Sequence diagram for release workflow version parsing and publish auditsequenceDiagram
participant Workflow as ReleaseWorkflow
participant Bash as Bash
participant Auditor as CanonicalAuditor
participant Registry as PackageRegistry
Workflow->>Bash: npm pkg get version
Workflow->>Bash: version_pattern='^([0-9]+)\\.([0-9]+)\\.([0-9]+)(-[0-9]+)?$'
Bash-->>Workflow: current_version
Workflow->>Bash: [[ "$current_version" =~ $version_pattern ]]
Bash-->>Workflow: BASH_REMATCH or no match
Workflow->>Auditor: validate publish provenance
Auditor->>Registry: verify publish path
Registry-->>Auditor: provenance result
Auditor-->>Workflow: release gate result
Sequence diagram for prepare artifact lifecycle coveragesequenceDiagram
participant Test as PrepareTests
participant Helper as LifecycleHelper
participant Launcher as PrepareLauncher
participant Checkout as ConfiguredCheckout
participant Package as PackageManager
Test->>Helper: run lifecycle command
Helper->>Launcher: invoke prepare
Launcher->>Checkout: read configured checkout
Checkout-->>Launcher: checkout configuration
Launcher->>Package: npm pack
Package-->>Launcher: packed artifact
Launcher->>Package: npm publish
Package-->>Launcher: published artifact
Launcher-->>Helper: prepare result
Helper-->>Test: artifact and lifecycle assertions
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Owner
Author
|
@coderabbitai full review Please review head 38fd0ac, including outside-diff findings. |
✅ Action performedFull review finished. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot #248 updates the canonical workflow auditor, which mistakes the inline Bash release-version regex tail for an executable:
cannot prove executable expansion; refusing an unresolved publish path: ?$ ]]. This is a shell-model compatibility defect rather than a pinned-version assertion.Keep the identical regex in a single-quoted literal variable, then execute the actual Bash condition against ordinary, suffixed, padded and malformed version strings. The canonical auditor still checks every publish for provenance.
Full CI-identity validation exposed a second defect shared with unbraind/pm-ado#30 and unbraind/pm-beads#144: the updated prepare launcher adds pack/publish branches absent from the install-only tests. Apply the same explicit lifecycle helper and configured Git-checkout artifact tests in all three repos. Dependency pins, canonical template equality and coverage thresholds remain unchanged.
Before: the repository-workflow gate rejects the inline regex. Fixing that alone leaves 613 passing functional tests but 99.98% lines / 99.95% branches, missing prepare line 28. After both fixes: each full runtime gate passes 615/615 with zero failures, skips, cancellations or todos and 100% lines, branches and functions.
Revert proofs: restore only the original release workflow condition and the repository-workflow test fails with the original unresolved-path diagnostic. Keep the new artifact tests but remove only lifecycle-command injection from the prepare helper and launcher coverage fails at 98.65% lines / 75% branches, missing line 28. Restoring both fixes passes the complete gates.
Validation: full exact dependency-overlay npm and Bun gates, using a fresh HOME and GIT_CONFIG_GLOBAL=/dev/null plus GIT_CONFIG_NOSYSTEM=1. Commands:
npm run release:checkandbun run release:check. Current-pin focused PM-linked suites also pass 25/25 workflow/auditor tests and 10/10 prepare tests. Local interrupted full runs are not counted as pass evidence. Details:docs/dependabot-root-cause.md.Tracker: pmc-38z4, left open for orchestration review.
The final validation tree differs from the delivered fix revision only by the original dependency/generated-template overlay and its temporary validation workflow. Tracker receipts and documentation are included in this final validation.