Repository navigation
fix(release): run catalogue self-tests without production credentials - #351
Conversation
@coderabbitai full review |
✅ Action performedFull review finished. |
Code Coverage OverviewLanguages: Go, C# Go / code-coverage/testThe overall line coverage in commit dfcf2c3 in the C# / code-coverage/dotnetThe overall line coverage in commit dfcf2c3 in the Updated |
✅MegaLinter analysis: Success
See detailed reports in MegaLinter artifacts Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining
|
Validation at
The normal release command, token scopes, consumer dry-run preview, and production concurrency remain intact. |
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (6)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (113)
🧰 Additional context used📓 Path-based instructions (5)Source excerpt: Every `.github/tests/test-*.sh` is a test entrypoint and must have an explicit invocation in a `ci.yaml` step's `run:` block.📄 CodeRabbit inference engine (AGENTS.md) Files:
Source excerpt: Run [zizmor](https://github.com/zizmorcore/zizmor) to scan for GitHub Actions vulnerabilities📄 CodeRabbit inference engine (actions/CONTRIBUTING.md) Files:
Source excerpt: Pin `` to a commit SHA.📄 CodeRabbit inference engine (README.md) Files:
Source excerpt: Add a `test-` job to `.github/workflows/ci.yaml` (`persist-credentials: false` on checkout), wired into `ci-required-checks` (both `needs:` and the inline summary step's `JOB_RESULTS` value)📄 CodeRabbit inference engine (AGENTS.md) Files:
Source excerpt: Add a row to the Actions table in the catalogue part of [README.md](README.md)📄 CodeRabbit inference engine (AGENTS.md) Files:
🔇 Additional comments (6)
📝 WalkthroughWalkthroughThe release workflow adds an offline test mode that runs release-decision cases without production credentials. The fixture uses disposable local Git repositories and checks expected release outcomes and unchanged refs. CI callers use the new mode, and regression scripts check fixture isolation and reject altered workflow controls. Priority: ➖ Normal Severity of issue fixed: Medium Merge Risk: ⚪ Minimal · up to The catalogue checks use a separate credential-free, dry-run path while preserving normal consumer release behavior. No concrete merge-blocking risk was identified; merge after normal checks pass. Security Architecture ReviewSecurity architecture risk: 🔵 Low · up to Release self-tests lose production write credentials and run against disposable local repositories. The reviewed changes show no introduced security concern, but dependency execution and interrupted-run recovery remain incompletely verified. Retained concerns Security review detailsSecurity Blast Radius
Security Findings and Attack Paths
Trust Boundaries and Controls
Resilience and Maintainability Implications
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (3 skipped: 3 unsupported.)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Assessed the Docstring Coverage warning in CodeRabbit summary 5931907015 at Its full detail says: "Analyzed 3 functions across 3 files. (3 skipped: 3 unsupported.)" All three touched functions are Bash test helpers. Bash has no native function docstring construct; the scripts describe their purpose and the isolation helper has a purpose comment. The report identifies no missing API documentation or source location. Refuted as an unsupported-language metric, with no code change.
|
Promotion readiness revalidated at
Promoting now. The ready-for-review CI run will settle before the final exact-head merge check. |
Final merge check at The unchanged unsupported Bash docstring warning remains specifically refuted above; no new finding has appeared. Every readable required gate passes. The code-quality helper still reports UNVERIFIED, not COMPLETE; the successful hosted analysis and GitHub native merge enforcement remain authoritative. Both hosted offline modes and the local decision/regression tests provide the recorded behavior evidence. Merging with the exact-head guard, then verifying main CI, the normal production release path, and the tagged artifact publication. |
Why
Release checks currently receive permission to change live repositories even when only evaluating a possible release. A check failure could therefore affect real repository content.
What
Run the catalogue release checks in disposable repositories while preserving the expected version decisions. Consumer releases and release previews keep their current behavior.
Fixes #348