[ajitpratap0]

Summary

Follow-ups from the v1.16.0 release reviews:

• Manifest version drift test. TestVersionManifestsMatchVersion (pkg/gosqlx) requires glama.json, vscode-extension/package.json, plugins/gosqlx/.claude-plugin/plugin.json, .claude-plugin/marketplace.json, performance_baselines.json and python/pyproject.toml (lockstep; .postN allowed) to equal gosqlx.Version. v1.15.0 shipped with several of these at 1.14.0; release.yml only guards the tag against Version, so this makes the release PR bump everything together. It runs in the normal task test:race suite and skips when the files are absent (e.g. a module download).
• Glama sync hardening. glama-sync.yml fails with a clear error if the release tag does not resolve to a 40-hex commit SHA, instead of posting an empty pinnedCommitSha (suggested in the docs: v1.16.0 post-tag updates (banners, integrations, pins, benchmarks, Glama sync) #855 review).

Test Plan

• go test -race -run TestVersionManifestsMatchVersion ./pkg/gosqlx/: 6/6 subtests pass at 1.16.0
• Setting glama.json to 1.16.9 makes the glama.json subtest fail
• gofmt, go vet ./pkg/gosqlx/; workflow YAML parses

Breaking Changes

None.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RkzVu3JY9Y6BRWfjesWts9

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
gosqlx-website	Ignored	Preview	Oct 22, 2026 6:09pm UTC

[github-actions]

Claude finished @ajitpratap0's task in 17s —— View job

---

Review of PR #856

Overall this is a small, useful guard. I found no blocking issues. I read the diff and checked that each manifest has the expected version field at 1.16.0. I did not run the tests myself.

Test: pkg/gosqlx/version_manifests_test.go

Good

• Table-driven with one subtest per manifest, so a failure names the file and says to bump it in the release PR.
• Skipping when a file is missing keeps module-download usage working.
• A missing version field fails with a clear message instead of passing silently.

Suggestions (non-blocking)

1. Skip can hide a broken guard. os.IsNotExist skips if a file is renamed or deleted in the repo, so the guard quietly stops covering it. Consider skipping only when a sentinel file such as go.mod or .git is absent at root, and failing when an individual manifest is missing. That separates "not a checkout" from "manifest moved".
2. Marketplace only checks plugins[0]. If more plugins are added later, the others go unchecked. Looping over all entries would be more robust.
3. Regex for pyproject.toml. (?m)^version = "..." matches any top-level version = line, including one under a different table such as [tool.x]. It's fine today. Anchoring to the [project] section, or parsing the TOML, would be stricter.
4. Python version handling. strings.SplitN(..., ".post", 2)[0] handles .postN. It would not accept rcN or .devN, which is probably what you want for lockstep.
5. Small cleanup. The jsonVersion closure returns a function, and the python case re-implements the read and skip logic. A shared readManifest(t, rel) []byte helper would remove that duplication.
6. Go version. tc is captured in a non-parallel subtest, so it is safe. With Go 1.26 loop-variable semantics it would also be safe under t.Parallel().

Workflow: .github/workflows/glama-sync.yml

• The 40-hex SHA check is correct and gives a clear ::error:: message.
• If gh api itself fails, I don't know whether the step runs under set -e. The default bash -e shell would exit before the check, and the failure would still be loud. The message would just come from gh rather than your custom error.
• grep -Eq on printf '%s' avoids newline edge cases.
• An annotated tag resolves via commits/<tag> to the commit SHA, which is what you want. Lightweight and annotated tags both work.

Other considerations

• Security: RELEASE_TAG is interpolated into a gh api URL, but it comes from an env var rather than inline ${{ }}, so there is no script injection. The check now also prevents sending an empty pinnedCommitSha.
• Performance: negligible. The test reads six small files.
• Test coverage: the PR description says you verified the failure path by setting glama.json to 1.16.9. A positive check that pyproject.toml with .post1 passes would be a nice unit test but isn't essential.

Looks good to merge, with the suggestions above optional.