ci: Detect unmerged release fixes to main.

[MinoruSekine]

Summary by CodeRabbit

• New Features
  • Added automated checks to detect commits on the release branch that have not been merged into the main branch.
  • Checks run after relevant branch updates, daily, or on demand.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: MinoruSekine/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 585c091e-f844-4e03-ad9a-ac3d9141ba23

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

.github/workflows/detect_unmerged.yml (1)

14-16: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Declare the minimum GITHUB_TOKEN permission.

This job only reads repository contents and runs a local detector. The workflow does not declare permissions, so its token scope depends on external defaults. Add contents: read to prevent a permissive default from granting unnecessary access. GitHub recommends this permission for actions/checkout. (docs.github.com)

Proposed fix

+permissions:
+  contents: read
+
 jobs:

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/detect_unmerged.yml around lines 14 - 16, Add a read-only
permissions declaration for the detect_unmerged job, granting only contents:
read before its runs-on configuration. Keep the existing job behavior unchanged.

Source: MCP tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/detect_unmerged.yml:
- Line 3: Update the workflow name in the top-level name declaration to “Detect
commits in the release branch that have not been merged to main.”
- Around line 26-28: Add the missing
.github/workflows/scripts/detect_unmerged.sh file to the repository before the
workflow step invokes it, ensuring it is executable and implements the expected
origin/main and origin/releng/v0 arguments used by the workflow.

---

Nitpick comments:
In @.github/workflows/detect_unmerged.yml:
- Around line 14-16: Add a read-only permissions declaration for the
detect_unmerged job, granting only contents: read before its runs-on
configuration. Keep the existing job behavior unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: MinoruSekine/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d045e033-c24d-4e73-94c8-fd1527ac5da2

📥 Commits

Reviewing files that changed from the base of the PR and between 3249fc4 and ef575c7.

📒 Files selected for processing (1)

• .github/workflows/detect_unmerged.yml