Accept package-generated release headings in analyzer provenance - #1198
Conversation
Accept the exact undated calendar-version heading emitted by pm-changelog, alongside the historical matching-date form, when proving a deterministic automatic release transformation. Preserve immutable tag identity, complete manifest substitution, reviewed-parent evidence and byte-exact changelog content outside the heading. Require a complete Unreleased heading line so partial headings cannot inherit analyzer provenance. Add red/green controls for both valid formats, incorrect versions and dates, altered content and the partial-heading false acceptance. Document the contract and record recurrence, linked verification and closure through the existing pm-u1baah lineage and package-generated changelog. Validation: 149 focused regressions; 8427 tests across 608 files at exact 100/100/100/100; complete static quality, type checking, docs/skills and live immutable v2026.9.5 provenance verification.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (7)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 SummarySummary by CodeRabbit
WalkthroughThe release gate now accepts undated and matching-date release changelog headings. Tests cover valid and invalid heading transformations. Documentation, changelog content, and incident records were updated to reflect the correction. ChangesRelease provenance validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to The release provenance check now supports package-generated dated and undated release headings while retaining strict changelog integrity validation. The documented valid and invalid cases are covered, with no current merge-blocking risk identified. Sequence Diagram(s)sequenceDiagram
participant ReleaseCandidate
participant HostedAnalysisGate
participant ReviewedParent
ReleaseCandidate->>HostedAnalysisGate: provide generated changelog
HostedAnalysisGate->>ReviewedParent: compare heading and unchanged bytes
ReviewedParent-->>HostedAnalysisGate: return parent evidence
HostedAnalysisGate-->>ReleaseCandidate: accept or reject provenance
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideUpdates the hosted analyzer readiness gate to recognize both undated and matching-date package-generated release headings, while retaining strict changelog, manifest, tag, commit, and analyzer-evidence validation; adds focused regressions and regenerates associated release metadata. Flow diagram for release changelog validationflowchart TD
A[Read parent and candidate CHANGELOG.md] --> B{Exact Unreleased heading in parent?}
B -->|No| R[Reject release]
B -->|Yes| C{Candidate matches exact version heading?}
C -->|Yes| D[Compare all remaining changelog bytes]
C -->|No| E{Candidate matches version plus matching date?}
E -->|No| R
E -->|Yes| D
D -->|Different content| R
D -->|Byte-for-byte unchanged| P[Continue release readiness checks]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
@greptileai please review the exact release-heading provenance correction and its positive and negative controls. |
|
@coderabbitai full review |
|
@sourcery-ai review |
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
@coderabbitai full review |
|
Read the edited full-review card for exact head 6559bee: no actionable findings and minimal merge risk across all seven changed files. All checks and the stricter zero-annotation analyzer proof passed. The repository separately enforces exact 100% docstring and code coverage; this card's generic 80% threshold is not the project gate. Canonical scope and evidence are linked in the PR through pm-u1baah. |
|
This guide accurately describes both supported heading forms and the unchanged-byte, immutable-tag and reviewed-parent requirements. The partial-heading negative control failed before the fix; all 149 focused contracts and full 8427-test coverage now pass. |
|
Recorded the seven-day Sourcery budget limitation. This is provider availability evidence, not a completed code review or approval; no paid upgrade is being used. The full CodeRabbit round remains required. |
|
This command did not complete because the included review was still rate-limited. The reset window has now elapsed and the unchanged exact head has received a new full-review request. |
✅ Action performedFull review finished. |
|
Accepted the exact-head benchmark receipt: all 11 benchmarks are unchanged. This correction affects release provenance validation and preserves the published SDK and CLI runtime behavior. |
|
Confirmed against the canonical local and hosted coverage gates: 8427 tests pass and coverage remains exact 100/100/100/100. The new undated-heading and partial-heading controls were red before the implementation change. |
|
Recorded this review as quota-limited, without code-review approval. The canonical pm-u1baah evidence and executable positive/negative controls remain available, and the CodeRabbit full review is being awaited. |
|
Confirmed the full review finished on unchanged head 6559bee with no actionable findings. The complete hosted check watch and zero-annotation analyzer proof passed; final reaction, reply and thread inventory will precede merge. |
|
Merged and independently verified on main CodeRabbit's full review of all seven files found no actionable issues. Every bot comment/review was read, rated and answered, including edited cards; the final inventory across #1195, #1196 and #1198 found no new or edited unread feedback, unrated artifacts, or unresolved threads. Provider quota receipts are recorded as limitations rather than approvals. Canonical recurrence, implementation and test evidence: pm-u1baah. The checkout is clean on main. Public |
1 participant
The automatic
v2026.9.5release generated## 2026.9.5, but the analyzer provenance checker required a dated heading. The resulting release commit failed main's analyzer-readiness check even though all manifests contained the exact version substitution and the reviewed parent had zero analyzer findings.Accept the two package-supported heading forms: the exact calendar version alone, or that version with its matching date. Require an exact
Unreleasedheading line and retain byte-for-byte comparison of the remaining changelog, complete manifest inventory, immutable tag, canonical commit identity, and reviewed-parent analyzer evidence. This also fixes an existing false acceptance of partial headings such asUnreleased notes.Canonical implementation, recurrence, history and linked verification: pm-u1baah — Releases from the default branch are supported with analyzer evidence. This corrects the repository's consumer contract;
pm-changelogintentionally keeps explicit versions undated when no date is supplied.Validation:
69092a748283ee69e69fb9aa2453db0f2d91addconly asdeterministic_release_transform, with reviewed headf7293276add7a10f0fec41e9275c4be5c047bee7, zero CodeFactor annotations, zero new DeepScan issues and strict protection.The immutable release tag and package contents remain unchanged. Hosted checks and reviews on this correction must pass before merge.
CHANGELOG.mdis regenerated bypm-changelog2026.9.2: the recurrent canonical item's entry moves to Unreleased and the now-tagged release gains its tag-derived date. Its earlier delivery evidence remains in append-only PM history. The managed-extension manifest timestamp is also produced by the package command.Summary by Sourcery
Support both package-generated release heading formats while preserving strict analyzer provenance and changelog validation.
Bug Fixes:
Enhancements:
Documentation:
Tests:
Summary by cubic
Fixes the release analyzer provenance check so package-generated changelog headings no longer block valid release commits.
Bug Fixes
## <version> - <date>heading;pm-changelogemits an undated## <version>heading, so the validv2026.9.5release was refused.## Unreleasedheading line, which also closes a false acceptance of partial headings likeUnreleased notes.CHANGELOG.mdviapm-changelogand documents the accepted heading forms indocs/RELEASING.md.Written for commit 6559bee. Summary will update on new commits.