Automate verified GitHub release synchronization - #8
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 25 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughAdds a Node.js release synchronization CLI, commit-bound draft release preparation, attestation and provenance validation, scheduled GitHub Release publication, workflow permission scoping, tests, and release documentation. ChangesRelease synchronization
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant PublishWorkflow
participant ReleaseSync
participant GitHub
participant Npm
PublishWorkflow->>ReleaseSync: prepare staged commit
ReleaseSync->>GitHub: create or verify draft release
ReleaseSync->>Npm: inspect publication and attestations
ReleaseSync->>GitHub: publish matching validated draft
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 19-21: Annotate each privileged permissions block in the workflow:
document that id-token: write enables npm trusted publishing, contents: read
supports checkout, and contents: write is required to create the draft GitHub
Release. Apply these explanations to both referenced permission blocks without
changing their values.
In @.github/workflows/sync-github-release.yml:
- Around line 8-9: Move the contents write permission from workflow scope into
the sync job in .github/workflows/sync-github-release.yml, preserving it as
jobs.sync.permissions. Update test/maintenance.test.mjs to reject any root-level
permissions block and verify permissions are nested under the intended jobs,
including jobs.sync.
In `@scripts/github-release-sync.mjs`:
- Around line 33-38: Harden validateRepository in
scripts/github-release-sync.mjs:33-38 to reject "." and ".." as either
repository component while preserving valid owner/repository names. In
scripts/github-release-sync.mjs:396-401, call validateRepository(repository) at
the start of syncDraftReleases, before listReleases constructs any API URL,
matching prepareDraftRelease.
- Around line 156-176: Update requestJson to pass an AbortSignal.timeout-based
signal in the fetchImplementation options, using the supported Node 20.12 API
and an appropriate request timeout so stalled npm or GitHub connections are
aborted. Preserve the existing headers, body, and method behavior.
- Around line 341-357: Update the draft-processing loop around attestationUrl
and requestJson to detect a missing published dist.attestations.url before
constructing or fetching the attestation URL. Record the draft in skipped with
the existing not-public-on-npm-style reason and continue to the next release,
while allowing attestation fetch or provenance validation errors for present
metadata to propagate as hard failures.
- Around line 93-118: Update provenanceCommit to verify each Sigstore bundle’s
signatures, verification material, and Fulcio certificate identity before
calling decodeAttestation or validateSubject. Reuse the repository’s existing
Sigstore verification helper and enforce the expected issuer and package
identity, rejecting either publishAttestation or slsaAttestation when
verification fails.
In `@test/github-release-sync.test.mjs`:
- Around line 365-424: Extend the synchronization test around syncDraftReleases
to return two drafts in an order different from their versions, with the older
version not matching registryData["dist-tags"].latest. Assert that both drafts
are published in sorted version order and that publishRequest captures
make_latest: "false" for the older release and "true" for the latest release,
covering plan.sort and the non-latest branch.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: e0e72d3b-6244-4f87-b2e5-219b044b1aae
📒 Files selected for processing (9)
.github/workflows/publish.yml.github/workflows/sync-github-release.ymlCHANGELOG.mdREADME.mddocs/RELEASE.mdpackage.jsonscripts/github-release-sync.mjstest/github-release-sync.test.mjstest/maintenance.test.mjs
|
@coderabbitai review |
✅ Action performedReview finished.
|
What changed
Safety properties
Verification
npm run release:check(50 tests; packed-install smoke passed)npx --yes markdownlint-cli2@0.20.0 '**/*.md'actionlintv1.7.7 on both changed workflowsprepareidempotency check againstv0.3.0The separate user-owned
CHANGELOG 2.mdwas not staged or modified.Summary by CodeRabbit
New Features
Documentation
Tests