Repository navigation
Deploy changes can merge without publishing a new OCI artifact #130
Description
🤖 Generated by the Agentic Engineer
Description
A behavior-changing edit under deploy/ can merge with a no-bump Conventional Commit type and never publish the corrected OCI artifact. PR #129 renamed gitops-tenant-template to platform-tenant-template on main, but its refactor(deploy): squash commit produced no semantic release. Production therefore remains pinned to the stale v1.21.4 artifact.
Steps to Reproduce
- Inspect signed
mainat1f6f6a1fc601ee7e37c7d84e088138281229986b; the renamed manifests are present. - Inspect Release run
30755682269; semantic-release reports that the commit should not trigger a release and publishes nothing. - Inspect the live
github-configFlux Kustomization: it still applies1.21.4@sha256:8fddda7bd40f30c3020b1a814b347c321a6632215b9ee82c75a43f2756689c45, where both old TeamRepository objects retry 404s and keep the Kustomization unhealthy.
Expected Behavior
Any merged deploy/ change that alters the published artifact produces an intentional SemVer release, and CI prevents a no-bump PR title from silently leaving production on stale desired state.
Actual Behavior
The merge and Release workflow are green, but no tag or OCI artifact is published. Platform apps is blocked on the stale github-config tenant, including merge-group run 30760329199 for platform#2876.
Environment
- Repository head:
1f6f6a1fc601ee7e37c7d84e088138281229986b - Last released version:
v1.21.4 - Observed: 2026-08-02,
admin@prod
Acceptance Criteria
- A patch release publishes the already-merged rename as a cosign-signed OCI artifact.
- Production Flux applies that exact artifact and
github-configbecomes Ready. - A test/CI guard rejects no-bump PR types for behavior-changing
deploy/changes. - The Platform merge queue is retried only after the root cause is healthy.
Activity
coderabbitai commentedon Aug 2, 2026
🔗 Related PRs
#76 - fix(ci): release revert commits so reverts reach the cluster [merged]
#80 - ci: repoint reusable workflows to devantler-tech/actions v8.0.0 [merged]
#82 - feat: declare the devantler-tech/aws config-tenant repo [merged]
#86 - fix: gate repository-permissions/ until provider-upjet-github supports shaPinningRequired [merged]
#127 - fix(repositories): keep org-enforced signoff out of update payloads [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!