Repository navigation
fix(release): use the existing-tag recovery engine - #5523
Conversation
Validation at The selected v14.0.5 release resolves to signed source After this consumer merges, repeat the native safety controls, recover each captured missing publication once, and independently verify the tag/source, latest-release selection and no-additional-write reruns. No retry of the earlier refused request has been sent, and the historical ref-rejection cause remains unproven. |
@coderabbitai review |
✅ Action performed
|
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title "fix(release): use the existing-tag recovery engine" matches the main change. The PR updates the release-recovery engine pin to v14.0.5, which publishes an already verified tag without a sep… |
| Description check | |
The description explains the problem (older releases missing after tags were created, and a refused prior recovery attempt) and the change (adopting the released correction that publishes an already v… |
| Docstring Coverage | |
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Title check
-
Explanation
The title "fix(release): use the existing-tag recovery engine" matches the main change. The PR updates the release-recovery engine pin to v14.0.5, which publishes an already verified tag without a separate creation target. The title is specific and conventional, and it names the release scope. It does not cover the source SHA pin updates, but that is expected.
Full details: Description check
-
Explanation
The description explains the problem (older releases missing after tags were created, and a refused prior recovery attempt) and the change (adopting the released correction that publishes an already verified tag without a separate creation target). It also notes that consent, source verification, and the release queue are preserved, and links the work to
#4839. This relates directly to the changeset, which updates the recovery source pins and the operator guide.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (3 skipped: 3 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Ready at The newly fetched main changes separate image-verifier and dependency files; it does not overlap this four-file update. Live health is OK. User evaluation includes the source-pin RED/GREEN contract and native execution of the released publisher’s credential refusal. Actual publication and no-op readback remain the protected-main follow-up on #4839/#787 and are not claimed by these offline controls. Queue admission will retain every normal integration/deployment gate. |
Why
Older releases remain missing after their tags were created, and the previous recovery attempt was refused during publication.
What
Adopt the released correction that publishes an already verified tag without a separate creation target. Preserve consent, source verification and the release queue; the original incident stays open until real publication and independent no-op checks are complete.
Part of #4839