Skip to content

ci(release): release only from main - #126

Merged
M3gA-Mind merged 2 commits into
tinyhumansai:mainfrom
M3gA-Mind:w6/release-main-only
Nov 3, 2026
Merged

M3gA-Mind merged 2 commits into
tinyhumansai:mainfrom
M3gA-Mind:w6/release-main-only

Conversation

@M3gA-Mind

Copy link
Copy Markdown
Contributor

Removes the "reviewed-epic" release mode, so releases are cut only from this repo's main branch.

The mode let a release tag a reviewed PR's merge commit on an epic branch instead of main, through a reusable workflow in tinyhumansai/.github pinned at a commit that's only on that repo's epic branch (sdk-reviewed-epic-release@0cafb7a / module-reviewed-epic-release@6ed83b0). That split version lines and let releases carry code that isn't on main. The decision is that releases come only from the official repo's main.

Changes: .github/workflows/release.yml is restored to its state before 77ec9ba (additive). scripts/test_reviewed_release_workflow.py is deleted, along with its ci.yml line. release_workflow_tests.py gains a test that tag is the only input and the jobs are [resolve, module-release] (10 tests pass). Independent of #125 (0.28.0), which doesn't touch workflows.

The ordinary main release path is unchanged: tag push, or dispatch with tag, through the shared release workflow, which already refuses a tag whose commit isn't an ancestor of origin/main.

Validation on the self-hosted Linux runner: the repo's release-workflow tests pass on this commit. Workflow syntax is checked by this PR's GitHub CI.

Drop the reviewed-epic release mode: the mode and reviewed_pr inputs, the
reviewed dispatch validator, and the call to the epic-only
module-reviewed-epic-release workflow. The tag and main release path is
unchanged; release.yml is as it was before 77ec9ba. The reviewed-release test
script goes with it, and the release workflow tests now assert that a
dispatch names only a tag and runs only the module release.
@coderabbitai

coderabbitai Bot commented Nov 3, 2026 •

Copy link
Copy Markdown

Important

  • Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: c5684f43-592e-4f0e-a310-eac832419465
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

CodeRabbit Verify

  • Run CodeRabbit Verify to test the changes in this pull request.

@tinysweeper

tinysweeper Bot commented Nov 3, 2026 •

Copy link
Copy Markdown

Tiny Sweeper review

Reviewed head: e8d97e9239a915d193935cecf76f8beb0b051331

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 1 of 4 files; not reviewed: .github/workflow…, .github/workflow…, and 1 additional unreviewed files.
Pull request purpose (title): ci(release): release…

Diagnostics and supporting details

Full summary

Pull request purpose (title): ci(release): release only from main. Per the pull-request title and description, this change makes releases come only from main by removing the "reviewed-epic" release mode. The diff restores `.github/workflows/release.yml` to a tag-only additive shape, deletes the dedicated reviewed-epic test file and its CI invocation, and adds a replacement test pinning the simplified workflow shape. The latest-push delta is unavailable.

Unreviewed paths

  • .github/workflows/ci.yml
  • .github/workflows/release.yml
  • scripts/test_reviewed_release_workflow.py

Review snapshot

Change surface Files Review signal Count
Production 0 Active findings 0
Tests 2 Noted findings 0
Documentation 0 Resolved findings 0
Configuration 2 Pending checks/questions 0

Completeness: Complete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

`.github/workflows/release.yml#jobs:` drops the `mode` and `reviewed_pr` dispatch inputs, the `inputs.mode` condition on module-release, and the `validate-reviewed-dispatch` and `module-reviewed-release` jobs, leaving only `resolve` and `module-release` behind the single `tag` input. `.github/workflows/release.yml#name: Release` continues to use the unchanged shared module-release workflow pin. `.github/workflows/ci.yml#jobs:` removes the `python3 scripts/test_reviewed_release_workflow.py` step. `scripts/release_workflow_tests.py#def test_release_uses_the_canonical_module_pipeline(self):` region gains a test asserting `tag` is the only dispatch input, jobs are `[resolve, module-release]`, no reviewed-epic remnants remain, and exactly one shared-workflow call exists. `scripts/test_reviewed_release_workflow.py` is deleted entirely, including its epic-dispatch guards and unrelated Cargo/tinybus manifest guards.

Features

  • Removed — Reviewed-epic release path: Eliminates the dispatch mode, validation job, and reviewed-epic shared workflow call so releases flow only through the main tag path. (.github/workflows/release.yml jobs:, .github/workflows/release.yml name: Release)
  • Removed — Dedicated reviewed-release workflow test and its CI step: Removes the script guarding the epic caller along with the CI invocation, since the behaviour it guarded no longer exists; unrelated manifest guards went with it. (.github/workflows/ci.yml jobs:, scripts/test_reviewed_release_workflow.py)
  • Added — Main-tag-only release shape test: Pins the simplified workflow — single `tag` input, `[resolve, module-release]` jobs, no epic remnants, one shared-workflow call — so a regression reintroducing the epic path would fail. (scripts/release_workflow_tests.py def test_release_uses_the_canonical_module_pipeline(self):)

Tests

  • removed — Deleted file of reviewed-epic dispatch guards (input defaults, permissions, run-block gating) plus Cargo/tinybus manifest and version guards.: The tests lane judges nothing with remaining behaviour was lost; the description lane notes the unrelated manifest guards removed with it were not mentioned in the description — a minor omission. (scripts/test_reviewed_release_workflow.py, .github/workflows/ci.yml jobs:)

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Positive: Critique lane reports no findings.
  • Lane summary: Reviewed 0 files; 0 findings.

security

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Positive: Security lane reports the change narrows release.yml to the tag-only main path with no shell interpolation of untrusted context and one pinned reusable workflow.
  • Lane summary: Reviewed 0 files; 0 findings.

tests

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Positive: Tests lane confirms the behavioural change is covered by the new assertion on the real workflow file.
  • Lane summary: The change removes the reviewed-epic release path from release.yml, deletes its dedicated test script, and adds a test in release_workflow_tests.py that pins the remaining tag-only shape (single `tag` input, exactly the `resolve` and `module-release` jobs, no epic-only strings, one shared-workflow `uses:`). That new test asserts on the real workflow file and would fail if any of those properties regressed, so the behavioural change is covered; the deleted test file only tested the removed path. No defects found.

commits

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Positive: Commits lane reports no sensitive content in committed files.
  • Lane summary: No sensitive content in committed files.

description

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Positive: Description lane confirms the description matches the diff, including the workflow restore, the deleted script and its ci.yml line, and the new test; the only unmentioned detail is that the deleted file also carried unrelated manifest guards.
  • Lane summary: The change removes the reviewed-epic release mode and its workflow test, narrows release.yml to the tag-only main path (a widening of nothing, one pinned reusable workflow, no shell interpolation of untrusted context), and adds a test asserting the remaining input, jobs and single pinned `uses`. The description matches the diff: workflow restore, deleted script and its ci.yml line, new test. The `epic`-related test cases removed with the deleted file were guards for the removed feature, and the touching/semver/vendor checks they also carried exist in the remaining suite (test_release_uses_the_canonical_module_pipeline, VERSION_CASES, test_native_e2e_topology.py). I found nothing to block on.
Evidence and run details
  • Models: ladder/vectors-oai3, deepseek-v4.1-flash
  • Spend: $0.001759
  • Tokens: 115726 input · 10267 output · 32256 cached · 659 embedding
  • Updated: 2026-11-03T11:14:54Z
Head State Pass summary
700a24110150 ready for maintainer review 0 active finding(s), 0 resolved finding(s) (at 2026-11-03T10:48:31Z)
e8d97e9239a9 ready for maintainer review 0 active finding(s), 0 resolved finding(s) (at 2026-11-03T11:14:54Z)

tinysweeper 0.1.2

@tinysweeper tinysweeper Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0004

@tinysweeper tinysweeper Bot added the priority: p3 Whenever. Cosmetic, a nicety, or a cleanup with no user visible effect. label Nov 3, 2026
@M3gA-Mind
M3gA-Mind merged commit 1924e88 into tinyhumansai:main Nov 3, 2026
23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

priority: p3 Whenever. Cosmetic, a nicety, or a cleanup with no user visible effect.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant