fix(release): harden release workflow validation - #622
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1f5f3f767b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
kmbroai
left a comment
kmbroai
left a comment
There was a problem hiding this comment.
Critical review
Reviewed head 4dee05146293d64ca608e03a6435a6e3616fc612.
Recommendation: keep the release-note and CI-event correctness fixes; separate the new title-type policy from them. No remaining execution defect was reproduced in the focused checks.
Necessary changes
File-based release-note transport avoids shell command substitution changing the bytes being validated. Sharing reviewed-summary parsing across release cutting and protected publication eliminates inconsistent interpretations. The current GitHub-release composition path normalizes complete terminal CRLF/LF sequences; the earlier dangling-CR recovery finding is addressed. Historical generated-only releases remain distinct from new releases that require reviewed notes.
The body-edit CI isolation also addresses a concrete workflow problem: a metadata edit must not cancel the code-validation run or replace its required context with a skipped success. The separate concurrency suffix, metadata-only context prefix, and required summaries work together; removing only one of them would undermine the fix. Release cutting now requires a successful push-origin run while preserving explicit dispatch.
Unnecessary coupling / behavior changes
The new 12-type allowlist is a policy restriction, not required to reject embedded newlines or classify release notes. The previous lowercase syntax accepted titles such as security: ... and deps: ..., and categorization already had an “Other changes” case. Updating the documentation makes the restriction explicit but does not establish why rejecting those titles is necessary. I would retain the generic lowercase type grammar and the newline checks, or make the closed set a separately approved policy change. This is a scope/compatibility recommendation, not a claim that the implementation disagrees with its new documentation.
Also call out that the replacement Unix required-summary jobs depend on the aggregate test matrix: a failure in another Unix/Node matrix entry now fails both node-22 summary contexts. That is broader than merely isolating body edits and should be intentional.
Verification
Ran release-automation.test.ts and skeleton.test.ts: 286 passed, 0 failed, including workflow-fragment and release-note regressions. Linux, Bun 1.3.14 / Node 22.13.1, cached dependencies. No hosted Actions run, branch-protection configuration change, release dispatch, tag, npm publish, or GitHub Release mutation was performed.
faizan-oai
left a comment
faizan-oai
left a comment
There was a problem hiding this comment.
Reviewed the workflow and release-note changes. The release automation and skeleton suites pass (286 tests), and required CI is green on this head. No blocking findings.
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
faizan-oai
left a comment
faizan-oai
left a comment
There was a problem hiding this comment.
Re-reviewed 0f64d08276247176236e18c50af9190870c60f40: no blocking code finding, and all 289 focused release/workflow tests pass.
Approval is waiting on the failed Windows Node 22 check. The unchanged workbench-scan-root-alias.test.ts:48 receives status: null from its Python subprocess; the log omits the spawn error, so the cause is unproved. I am not treating this as a demonstrated regression from the title changes. Please get the required full CI passing; the later successful metadata-only run does not cover this failure.
faizan-oai
left a comment
faizan-oai
left a comment
There was a problem hiding this comment.
Re-reviewed 6957d2d90699928a2a780c74485d3f5216b559dd against current main (ce452245de3d). The Windows test now uses the existing Python resolver; its path-alias and sibling-exclusion assertions are unchanged. No blocking findings.
Local verification: 296 focused tests passed, with 3 Windows-only skips; typecheck, generated-model check, changed SDK-file formatting, and diff checks passed. Full current-head CI passed all 27 jobs, including all three required Node 22 checks.
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
3 participants
Summary
Tighten release workflow validation so pull request titles, reviewed release notes, and successful CI runs are interpreted consistently across every active release path.
Changes
node-cirun onmain, while retaining the explicit manual-dispatch path.Testing
git diff --check: passed.@openai/codex-security@0.1.18; validated 265 archive entries, public import, NodeNext types, CLI, 113 bundled plugin files, bundled runtime, and nested-worker smoke behavior. The 1,224,544-byte tarball remained unchanged.Risk and rollout
The change affects release gating, CI scheduling, and note composition, so an incorrect rule could block a release. Table-driven workflow tests cover publish and recovery modes, cross-platform title decoding and parity, marker, NUL, and terminal-line-ending boundaries, existing-release reconciliation, and direct-tag publication. No dependency or package payload changes are introduced.
Public disclosure review