Skip to content

ci(release): release only from main - #44

Merged
M3gA-Mind merged 1 commit into
tinyhumansai:mainfrom
M3gA-Mind:w6/release-main-only
Nov 3, 2026
Merged

M3gA-Mind merged 1 commit into
tinyhumansai:mainfrom
M3gA-Mind:w6/release-main-only

Conversation

@M3gA-Mind

Copy link
Copy Markdown
Collaborator

Removes the "reviewed-epic" release mode, so releases are cut only from this repo's main branch.

The mode let a release tag a reviewed PR's merge commit on an epic branch instead of main, through a reusable workflow in tinyhumansai/.github pinned at a commit that's only on that repo's epic branch (sdk-reviewed-epic-release@0cafb7a / module-reviewed-epic-release@6ed83b0). That split version lines and let releases carry code that isn't on main. The decision is that releases come only from the official repo's main.

Changes: .github/workflows/release.yml is restored to its state before 7f09f60 (the addition was additive). scripts/test-release-workflow.py now asserts that tag is the only dispatch input, that no reviewed-epic / release_mode / reviewed_pr remains, and that an epic dispatch resolves only tag and version, with jobs exactly [resolve, module-release]. 7 tests pass.

The ordinary main release path is unchanged: tag push, or dispatch with tag, through the shared release workflow, which already refuses a tag whose commit isn't an ancestor of origin/main.

Validation on the self-hosted Linux runner: the repo's release-workflow tests pass on this commit. Workflow syntax is checked by this PR's GitHub CI.

Drop the reviewed-epic release mode, its release_mode and reviewed_pr inputs,
and the call to the epic-only module-reviewed-epic-release workflow. The tag
and main release path is unchanged; release.yml is as it was before 7f09f60.
The workflow tests now assert that a dispatch names only a tag and that an
epic dispatch reaches only the ordinary module release.
@coderabbitai

coderabbitai Bot commented Nov 3, 2026

Copy link
Copy Markdown

Important

  • Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: ffd2e8ef-dc2e-4c7d-b15f-fc36934bfb5d
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

CodeRabbit Verify

  • Run CodeRabbit Verify to test the changes in this pull request.

@tinysweeper

tinysweeper Bot commented Nov 3, 2026 •

Copy link
Copy Markdown

Tiny Sweeper review

Reviewed head: 52e944a9c2c382f1f23e5ae92d40312df072722a

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 1 of 2 files; not reviewed: .github/workflow….
Pull request purpose (title): ci(release): release…

Diagnostics and supporting details

Full summary

Pull request purpose (title): ci(release): release only from main. This pull request removes the "reviewed-epic" release mode so releases are cut only from the repository's main branch, and updates the release-workflow tests to pin the narrowed contract. The latest-push delta could not be computed; the whole-pull-request diff is summarized here, not any push delta.

Unreviewed paths

  • .github/workflows/release.yml

Review snapshot

Change surface Files Review signal Count
Production 0 Active findings 0
Tests 1 Noted findings 0
Documentation 0 Resolved findings 0
Configuration 1 Pending checks/questions 0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

  • Removed — Reviewed-epic release dispatch mode and inputs: Dispatch can no longer select a mode or name a reviewed PR; the workflow exposes only a tag input, so a release is defined solely by a tag on main. (.github/workflows/release.yml on:, .github/workflows/release.yml jobs:)
  • Removed — Reviewed-epic release job and resolver validation branches: The second reusable workflow job and the mode/reviewed-PR validation and rejection logic are gone, narrowing permissions and leaving a single release path through the ordinary module-release workflow. (.github/workflows/release.yml jobs:)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Positive: Answered critique lane found no defect introduced by this change and reports the test file is consistent with the trimmed workflow.
  • Lane summary: The test file is consistent with the trimmed release workflow: `run_resolve` forwards extra env vars via `**extra`, the new assertions match the current `release.yml` (single `tag` input, one `uses:` of the shared workflow, jobs `resolve` and `module-release`), and the removed `REVIEWED_RELEASE_SHA`/reviewed-epic assertions have no remaining callers. I found no defect introduced by this change. _The code index is behind this pull request (indexed at `dcab2fd03d80`), so retrieved context may be out of date._

security

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Positive: Answered security lane found nothing reportable: no production code, workflow permission, or dependency changes, and removal of the extra read-permission job narrows exposure.
  • Lane summary: This change only edits the Python test script that exercises the release workflow resolver; it removes the reviewed-epic test cases and the injected RELEASE_MODE/REVIEWED_PR environment variables, tightening the assertions to the ordinary tag-release route. No production code, workflow permission, or dependency changes, and the test-file edits match assertions about the workflow contents — I found nothing reportable. _The code index is behind this pull request (indexed at `dcab2fd03d80`), so retrieved context may be out of date._

tests

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Positive: Answered tests lane confirms the changed resolver's surviving behavior and the removal branches are pinned by exact-equality and negative assertions.
  • Lane summary: The change deletes the reviewed-epic release path from `.github/workflows/release.yml` and rewrites the Python fixture tests to pin the surviving contract: the resolver emits exactly `tag=v0.5.2\nversion=0.5.2\n`, dispatch declares only a `tag` input, the workflow references exactly one `tinyhumansai/.github` reusable workflow, and jobs are limited to `resolve` and `module-release`. Those assertions can fail (they are exact-equality and negative `assertNotIn` checks over the workflow and resolver output), so the new behaviour — including the removal of the mode/PR validation and its rejection branches — is pinned. No remaining branch of the changed resolver is left unexercised, and the workflow change only narrows permissions and job set, so I found nothing reportable. _The code index is behind this pull request (indexed at `dcab2fd03d80`), so retrieved context may be out of date._

commits

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `dcab2fd03d80`), so retrieved context may be out of date._

description

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Positive: Answered description lane reports the description accurately covers both the workflow and test changes and notes no widened permissions, no newly unpinned action, and no untrusted context interpolated into a shell.
  • Lane summary: The pull request removes the reviewed-epic release mode, restoring release.yml to its pre-7f09f60 state and updating the release-workflow tests accordingly; the description accurately covers both the workflow and test changes, and the workflows path rules show no widening of permissions, no newly unpinned action, and no untrusted context interpolated into a shell. _The code index is behind this pull request (indexed at `dcab2fd03d80`), so retrieved context may be out of date._
Evidence and run details
  • Models: ladder/vectors-oai3, deepseek-v4.1-flash
  • Spend: $0.000053
  • Tokens: 79476 input · 2011 output · 22528 cached · 300 embedding
  • Updated: 2026-11-03T10:48:11Z
Head State Pass summary
52e944a9c2c3 ready for maintainer review 0 active finding(s), 0 resolved finding(s) (at 2026-11-03T10:48:11Z)

tinysweeper 0.1.2

@tinysweeper tinysweeper Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0001

@M3gA-Mind
M3gA-Mind merged commit d350c72 into tinyhumansai:main Nov 3, 2026
21 checks passed
@M3gA-Mind M3gA-Mind mentioned this pull request Nov 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant