Skip to content

ci(release): release only from main - #117

Merged
M3gA-Mind merged 1 commit into
tinyhumansai:mainfrom
M3gA-Mind:w6/release-main-only
Nov 3, 2026
Merged

M3gA-Mind merged 1 commit into
tinyhumansai:mainfrom
M3gA-Mind:w6/release-main-only

Conversation

@M3gA-Mind

Copy link
Copy Markdown
Collaborator

Removes the "reviewed-epic" release mode, so releases are cut only from this repo's main branch.

The mode let a release tag a reviewed PR's merge commit on an epic branch instead of main, through a reusable workflow in tinyhumansai/.github pinned at a commit that's only on that repo's epic branch (sdk-reviewed-epic-release@0cafb7a / module-reviewed-epic-release@6ed83b0). That split version lines and let releases carry code that isn't on main. The decision is that releases come only from the official repo's main.

Changes: .github/workflows/release.yml is restored byte for byte to its state before the reviewed-epic addition (e528eed), which was purely additive. The release_mode and reviewed_pr inputs and the sdk-reviewed-epic-release job are gone.

The ordinary main release path is unchanged: tag push, or dispatch with tag, through the shared release workflow, which already refuses a tag whose commit isn't an ancestor of origin/main.

Validation on the self-hosted Linux runner: the repo's release-workflow tests pass on this commit. Workflow syntax is checked by this PR's GitHub CI.

Drop the reviewed-epic release mode, its release_mode and reviewed_pr inputs,
and the call to the epic-only sdk-reviewed-epic-release workflow. The tag and
main release path is unchanged; the file is as it was before e528eed.
@tinysweeper

tinysweeper Bot commented Nov 3, 2026 •

Copy link
Copy Markdown

Tiny Sweeper review

Reviewed head: 7e1c4a0d0a4ecae370d3c38ee5604aed355b61cf

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 1 of 1 files.
Pull request purpose (title): ci(release): release…

Diagnostics and supporting details

Full summary

Pull request purpose (title): ci(release): release only from main. This pull request removes the "reviewed-epic" release mode so releases are cut only from this repository's main branch. The `release_mode` and `reviewed_pr` dispatch inputs, the mode validation and output plumbing in the resolve step, the conditional guard on `sdk-release`, and the entire `sdk-reviewed-epic-release` job are deleted, leaving the main-only path through the shared release workflow. The latest-push delta is unavailable.

Review snapshot

Change surface Files Review signal Count
Production 0 Active findings 0
Tests 0 Noted findings 0
Documentation 0 Resolved findings 0
Configuration 1 Pending checks/questions 0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

`.github/workflows/release.yml` is restored to its pre-reviewed-epic state: the `release_mode` and `reviewed_pr` workflow-dispatch inputs are removed, the resolve step no longer validates or emits `release_mode`/`reviewed_pr` outputs and writes only `tag` and `version`, the `if: needs.resolve.outputs.release_mode == 'main'` guard is dropped from `sdk-release`, and the `sdk-reviewed-epic-release` job (with its `contents: write`, `pull-requests: read`, `checks: read`, `actions: read` permissions) is deleted. Top-level `permissions: {}` and the SHA-pinned `sdk-release.yml` call are unchanged.

Features

  • Removed — Reviewed-epic release mode inputs: Workflow dispatch no longer accepts `release_mode` or `reviewed_pr`, so callers cannot request the epic-branch release path; only the main path remains. (.github/workflows/release.yml on:)
  • Removed — Reviewed-epic resolve validation and outputs: The resolve step no longer validates release mode or reviewed PR number and emits only `tag` and `version`, simplifying the shell step and removing the JSON-number workaround. (.github/workflows/release.yml jobs:)
  • Removed — sdk-reviewed-epic-release job: The job that tagged a reviewed PR's merge commit on an epic branch, along with its broader read permissions, is gone; releases can no longer carry code that is not on main. (.github/workflows/release.yml jobs:)
  • Modified — sdk-release job guard: The `sdk-release` job now runs unconditionally after resolve rather than only in main mode, since main is the sole remaining path; its `contents: write` scope and SHA-pinned reusable workflow are unchanged. (.github/workflows/release.yml jobs:)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Positive: The critique lane answered with no findings, noting the removed inputs were optional, the surviving job is not widened, and no permission expansion or unpinned action is introduced.
  • Lane summary: The diff removes the optional `reviewed-epic` release path, leaving a single reusable-workflow call (`sdk-release.yml`) pinned to a full commit SHA with job-scoped `contents: write`, and `permissions: {}` at the top level is unchanged. The removed inputs were optional and the surviving job is not widened, so no permission expansion or unpinned action is introduced. I found no reachable defect in the changed lines; the only unverified detail is the internals of the pinned `sdk-release.yml` in the external `tinyhumansai/.github` repository, which this file no longer parameterises.

security

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Positive: The security lane answered with no findings, confirming the workflow narrows rather than widens: the reviewed-epic job and its extra read permissions are removed, `permissions: {}` is retained, and the remaining reusable workflow stays pinned to a full commit SHA.
  • Lane summary: The workflow narrows rather than widens: the reviewed-epic job (which needed contents: write plus pull-requests, checks and actions read) and its inputs are removed, the caller keeps permissions: {} and the single SDK release job keeps contents: write; both reusable workflows remain pinned to full commit SHAs and the shell step interpolates only the workflow-level permissions-free `inputs.tag`/`github.ref_name` through `env`, not directly. No security defect in this file.

tests

  • Conclusion: Neutral
  • Scope reviewed: all assigned evidence
  • Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Positive: The commits lane answered with no findings, reporting no sensitive content in committed files.
  • Lane summary: No sensitive content in committed files.

description

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: The description matches the diff: the workflow dispatch inputs release_mode and reviewed_pr, the validation branch in the resolve step, the conditional guard on sdk-release, and the sdk-reviewed-epic-release job are all removed, leaving the main-only path through the shared release workflow. No widening of permissions is introduced and the remaining `uses` is pinned. Nothing to report on the description.
Evidence and run details
  • Models: deepseek-v4.1-flash, ladder/vectors-oai3
  • Spend: $0.000038
  • Tokens: 66884 input · 2117 output · 10752 cached · 111 embedding
  • Updated: 2026-11-03T10:48:08Z
Head State Pass summary
7e1c4a0d0a4e ready for maintainer review 0 active finding(s), 0 resolved finding(s) (at 2026-11-03T10:48:08Z)

tinysweeper 0.1.2

@coderabbitai

coderabbitai Bot commented Nov 3, 2026

Copy link
Copy Markdown

Important

  • Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 099a4904-f792-4dd4-bc2e-c4ee6afd0d63
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

CodeRabbit Verify

  • Run CodeRabbit Verify to test the changes in this pull request.

@tinysweeper tinysweeper Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0000

@tinysweeper tinysweeper Bot added the priority: p3 Whenever. Cosmetic, a nicety, or a cleanup with no user visible effect. label Nov 3, 2026
@M3gA-Mind
M3gA-Mind merged commit 1a4a2b1 into tinyhumansai:main Nov 3, 2026
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

priority: p3 Whenever. Cosmetic, a nicety, or a cleanup with no user visible effect.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant