Skip to content

Automate verified GitHub release synchronization - #8

Merged
samtay32 merged 2 commits into
mainfrom
codex/automate-github-release-sync
Jul 26, 2026
Merged

Automate verified GitHub release synchronization#8
samtay32 merged 2 commits into
mainfrom
codex/automate-github-release-sync

Conversation

@samtay32

@samtay32 samtay32 commented Jul 26, 2026

Copy link
Copy Markdown
Owner

What changed

  • creates a draft GitHub Release at the exact commit after trusted npm staging succeeds
  • adds an hourly and manually triggerable synchronization workflow
  • publishes the draft only after npm exposes the version and its artifact digest, npm publish attestation, SLSA workflow identity, and provenance commit all match
  • keeps npm publication authority and GitHub release write authority in separate jobs
  • documents the behavior for non-coders and maintainers

Safety properties

  • human npm staged-package approval remains mandatory
  • sync runs trusted default-branch code at an immutable SHA
  • mismatched tags, commits, registries, workflows, branches, digests, or missing provenance fail closed
  • npm staging and GitHub release publication use separate least-privilege jobs
  • the process is idempotent and never publishes npm packages

Verification

  • npm run release:check (50 tests; packed-install smoke passed)
  • npx --yes markdownlint-cli2@0.20.0 '**/*.md'
  • checksum-verified actionlint v1.7.7 on both changed workflows
  • live prepare idempotency check against v0.3.0
  • live sync dry run found no pending drafts and made no changes

The separate user-owned CHANGELOG 2.md was not staged or modified.

Summary by CodeRabbit

  • New Features

    • Added automated draft GitHub Releases tied to the exact staged commit.
    • Added hourly and on-demand synchronization that verifies npm publication, attestations, provenance, and commit identity before publishing releases.
    • Added fail-closed handling for mismatches or missing verification data.
  • Documentation

    • Updated release guidance and changelog to describe the new guarded release flow.
  • Tests

    • Added coverage for release preparation, provenance validation, synchronization, and workflow safeguards.

@coderabbitai

coderabbitai Bot commented Jul 26, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 25 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: cd80e02a-c13a-4622-8bf1-719e69c9da7a

📥 Commits

Reviewing files that changed from the base of the PR and between 2c72120 and 275ad35.

📒 Files selected for processing (6)
  • .github/workflows/publish.yml
  • .github/workflows/sync-github-release.yml
  • docs/RELEASE.md
  • scripts/github-release-sync.mjs
  • test/github-release-sync.test.mjs
  • test/maintenance.test.mjs
📝 Walkthrough

Walkthrough

Adds a Node.js release synchronization CLI, commit-bound draft release preparation, attestation and provenance validation, scheduled GitHub Release publication, workflow permission scoping, tests, and release documentation.

Changes

Release synchronization

Layer / File(s) Summary
Provenance validation and GitHub API helpers
scripts/github-release-sync.mjs, test/github-release-sync.test.mjs
Validates npm integrity, DSSE attestations, SLSA provenance, repository identity, workflow metadata, branch, and commit bindings.
Draft preparation and synchronization
scripts/github-release-sync.mjs, test/github-release-sync.test.mjs, package.json
Creates or reuses commit-bound draft releases, plans eligible npm-published drafts, publishes validated releases, and adds syntax checking to lint.
Workflow wiring and release documentation
.github/workflows/*, test/maintenance.test.mjs, CHANGELOG.md, README.md, docs/RELEASE.md
Scopes publish permissions, adds scheduled/manual synchronization, tests workflow constraints, and documents the staged release flow.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PublishWorkflow
  participant ReleaseSync
  participant GitHub
  participant Npm
  PublishWorkflow->>ReleaseSync: prepare staged commit
  ReleaseSync->>GitHub: create or verify draft release
  ReleaseSync->>Npm: inspect publication and attestations
  ReleaseSync->>GitHub: publish matching validated draft
Loading

Possibly related PRs

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: automating verified synchronization between npm publishes and GitHub Releases.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/automate-github-release-sync

Comment @coderabbitai help to get the list of available commands.

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 26, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 26, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 26, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 7

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish.yml:
- Around line 19-21: Annotate each privileged permissions block in the workflow:
document that id-token: write enables npm trusted publishing, contents: read
supports checkout, and contents: write is required to create the draft GitHub
Release. Apply these explanations to both referenced permission blocks without
changing their values.

In @.github/workflows/sync-github-release.yml:
- Around line 8-9: Move the contents write permission from workflow scope into
the sync job in .github/workflows/sync-github-release.yml, preserving it as
jobs.sync.permissions. Update test/maintenance.test.mjs to reject any root-level
permissions block and verify permissions are nested under the intended jobs,
including jobs.sync.

In `@scripts/github-release-sync.mjs`:
- Around line 33-38: Harden validateRepository in
scripts/github-release-sync.mjs:33-38 to reject "." and ".." as either
repository component while preserving valid owner/repository names. In
scripts/github-release-sync.mjs:396-401, call validateRepository(repository) at
the start of syncDraftReleases, before listReleases constructs any API URL,
matching prepareDraftRelease.
- Around line 156-176: Update requestJson to pass an AbortSignal.timeout-based
signal in the fetchImplementation options, using the supported Node 20.12 API
and an appropriate request timeout so stalled npm or GitHub connections are
aborted. Preserve the existing headers, body, and method behavior.
- Around line 341-357: Update the draft-processing loop around attestationUrl
and requestJson to detect a missing published dist.attestations.url before
constructing or fetching the attestation URL. Record the draft in skipped with
the existing not-public-on-npm-style reason and continue to the next release,
while allowing attestation fetch or provenance validation errors for present
metadata to propagate as hard failures.
- Around line 93-118: Update provenanceCommit to verify each Sigstore bundle’s
signatures, verification material, and Fulcio certificate identity before
calling decodeAttestation or validateSubject. Reuse the repository’s existing
Sigstore verification helper and enforce the expected issuer and package
identity, rejecting either publishAttestation or slsaAttestation when
verification fails.

In `@test/github-release-sync.test.mjs`:
- Around line 365-424: Extend the synchronization test around syncDraftReleases
to return two drafts in an order different from their versions, with the older
version not matching registryData["dist-tags"].latest. Assert that both drafts
are published in sorted version order and that publishRequest captures
make_latest: "false" for the older release and "true" for the latest release,
covering plan.sort and the non-latest branch.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e0e72d3b-6244-4f87-b2e5-219b044b1aae

📥 Commits

Reviewing files that changed from the base of the PR and between 5a63dbc and 2c72120.

📒 Files selected for processing (9)
  • .github/workflows/publish.yml
  • .github/workflows/sync-github-release.yml
  • CHANGELOG.md
  • README.md
  • docs/RELEASE.md
  • package.json
  • scripts/github-release-sync.mjs
  • test/github-release-sync.test.mjs
  • test/maintenance.test.mjs

Comment thread .github/workflows/publish.yml Outdated
Comment thread .github/workflows/sync-github-release.yml Outdated
Comment thread scripts/github-release-sync.mjs
Comment thread scripts/github-release-sync.mjs
Comment thread scripts/github-release-sync.mjs
Comment thread scripts/github-release-sync.mjs
Comment thread test/github-release-sync.test.mjs Outdated

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 26, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@samtay32
samtay32 merged commit dca712d into main Jul 26, 2026
7 of 15 checks passed
@samtay32
samtay32 deleted the codex/automate-github-release-sync branch July 26, 2026 19:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant