ci(release): three-tier release automation - #524
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis change adds nightly and stable release automation, release dry-run checks, parameterized clice and VS Code publishing, target metadata in generated builds and crash logs, updated package contents, and release-channel documentation. ChangesRelease orchestration and CI gating
Parameterized package publishing
Target version generation and crash stamps
Package contents and release documentation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant NightlyWorkflow as nightly.yml
participant GitHubRelease
participant ClicePublisher as publish-clice.yml
participant VSCodePublisher as publish-vscode.yml
NightlyWorkflow->>GitHubRelease: create nightly tag and pre-release
NightlyWorkflow->>ClicePublisher: pass release_tag
NightlyWorkflow->>VSCodePublisher: pass package source and prerelease
ClicePublisher->>GitHubRelease: upload packages and symbols
VSCodePublisher->>GitHubRelease: upload VSIX assets
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (4)
.github/workflows/main.yml (2)
149-164: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueExplicitly restrict permissions for reusable workflow calls.
Jobs calling reusable workflows (
publish-clice.yml,publish-vscode.yml) inherit the caller's top-level default permissions. Sincemain.ymldoes not define top-level permissions, these jobs may run with broadread-allorwrite-allpermissions depending on repository settings.Adding a
permissions:block enforces the principle of least privilege.🔒 Proposed fix
release-check-clice: needs: changes if: >- ${{ !cancelled() && (github.event_name == 'workflow_dispatch' || needs.changes.outputs.release == 'true') }} + permissions: + contents: read uses: ./.github/workflows/publish-clice.yml release-check-vscode: needs: release-check-clice if: ${{ !cancelled() && needs.release-check-clice.result == 'success' }} + permissions: + contents: read uses: ./.github/workflows/publish-vscode.yml with: source: package🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/main.yml around lines 149 - 164, Add explicit least-privilege permissions to the release-check-clice and release-check-vscode reusable workflow jobs that call publish-clice.yml and publish-vscode.yml. Define only the permissions required by those workflows, setting all others to none where appropriate, while preserving the existing job dependencies and conditions.
202-210: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueExplicitly restrict permissions for
instant-vscode.Similar to the
release-check-*jobs, this job calls a reusable workflow and inherits the unconstrained top-level permissions. Adding apermissions:block enforces least privilege.🔒 Proposed fix
instant-vscode: needs: [changes, native-test, cross-test] if: ${{ needs.changes.outputs.cmake == 'true' }} + permissions: + contents: read uses: ./.github/workflows/publish-vscode.yml with: source: build🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/main.yml around lines 202 - 210, Add a job-level permissions block to the instant-vscode job that invokes publish-vscode.yml, matching the least-privilege permissions used by the release-check-* jobs. Do not alter its triggers, dependencies, or workflow inputs..github/workflows/nightly.yml (1)
13-14: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueRemove overly broad top-level permissions.
Defining
contents: writeat the top level grants write permissions to all jobs, including the reusable workflow calls (cliceandvscode) which already define their own permissions.Instead, define
contents: writedirectly within thepreparejob (the only job missing it, ascleanupand the reusable workflows already define their ownpermissionsblocks).🔒 Proposed fix
-permissions: - contents: write - jobs: prepare: runs-on: ubuntu-latest + permissions: + contents: write outputs:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/nightly.yml around lines 13 - 14, Remove the top-level permissions block and add contents: write under the prepare job’s permissions configuration. Leave cleanup and the clice and vscode reusable workflow jobs’ existing permissions unchanged..github/workflows/publish-vscode.yml (1)
94-98: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPrevent shell template injection.
Passing the GitHub Actions string input directly into the shell script can trigger template injection warnings in static analysis tools (like
zizmor) and is generally discouraged. Bind it to an environment variable instead.♻️ Proposed refactor
- name: Stage bundled server + env: + INPUT_SOURCE: ${{ inputs.source }} run: | DEST=editors/vscode/clice - if [ "${{ inputs.source }}" = "package" ]; then + if [ "$INPUT_SOURCE" = "package" ]; then cd /tmp/server🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish-vscode.yml around lines 94 - 98, Update the “Stage bundled server” step to pass the inputs.source value through the step’s environment rather than interpolating the GitHub Actions expression directly in the shell condition. Keep the existing package-source branching behavior unchanged while comparing the environment variable inside the script.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/main.yml:
- Around line 119-124: Update the “Auto correct” workflow step to use a
consistent enforcement mode: replace --lint with --fix if it should modify
documentation and let the subsequent Check diff detect changes, or remove
continue-on-error: true if it should remain lint-only and fail on violations.
---
Nitpick comments:
In @.github/workflows/main.yml:
- Around line 149-164: Add explicit least-privilege permissions to the
release-check-clice and release-check-vscode reusable workflow jobs that call
publish-clice.yml and publish-vscode.yml. Define only the permissions required
by those workflows, setting all others to none where appropriate, while
preserving the existing job dependencies and conditions.
- Around line 202-210: Add a job-level permissions block to the instant-vscode
job that invokes publish-vscode.yml, matching the least-privilege permissions
used by the release-check-* jobs. Do not alter its triggers, dependencies, or
workflow inputs.
In @.github/workflows/nightly.yml:
- Around line 13-14: Remove the top-level permissions block and add contents:
write under the prepare job’s permissions configuration. Leave cleanup and the
clice and vscode reusable workflow jobs’ existing permissions unchanged.
In @.github/workflows/publish-vscode.yml:
- Around line 94-98: Update the “Stage bundled server” step to pass the
inputs.source value through the step’s environment rather than interpolating the
GitHub Actions expression directly in the shell condition. Keep the existing
package-source branching behavior unchanged while comparing the environment
variable inside the script.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 9abead77-d0c9-4afa-b78f-0c5d41137a5d
📒 Files selected for processing (20)
.claude/commands/release.md.github/workflows/check-format.yml.github/workflows/cross-pair.yml.github/workflows/deploy-docs.yml.github/workflows/main.yml.github/workflows/native-test.yml.github/workflows/nightly.yml.github/workflows/publish-clice.yml.github/workflows/publish-vscode.yml.github/workflows/release-check.ymlCMakeLists.txtREADME.mdcmake/generate_version.cmakecmake/release.cmakecmake/version.h.ineditors/vscode/README.mdsrc/server/transport/master_server.cppsrc/support/logging.cpptests/integration/lifecycle/test_anomaly.pytests/unit/support/logging_tests.cpp
💤 Files with no reviewable changes (5)
- .github/workflows/deploy-docs.yml
- .github/workflows/cross-pair.yml
- .github/workflows/release-check.yml
- .github/workflows/check-format.yml
- .github/workflows/native-test.yml
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dee392e4b9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/main.yml:
- Around line 218-219: Remove the secrets: inherit setting from the reusable
workflow invocation in the publish-clice job, leaving the uses reference
unchanged so the workflow relies only on the automatically provided
GITHUB_TOKEN.
In `@cmake/generate_version.cmake`:
- Around line 26-46: Update the exact-tag path in the CMake version-generation
logic to detect whether the working tree is dirty and append the “-dirty” suffix
to CLICE_GIT_DESCRIBE when it is. Preserve the highest exact-tag selection and
existing clean-build behavior, using the nearby git execution flow rather than
changing the fallback describe path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: acd6b963-edab-482e-a39e-6b20be4a23e0
📒 Files selected for processing (4)
.github/workflows/main.yml.github/workflows/nightly.ymlCMakeLists.txtcmake/generate_version.cmake
🚧 Files skipped from review as they are similar to previous changes (2)
- CMakeLists.txt
- .github/workflows/nightly.yml
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d1d8af16f8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 35cd936f9d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
1 participant
Summary
Finishes the pre-release cleanup round: a three-tier release process (instant builds / nightlies / stable), single-source versioning with no hand-edited version numbers, consolidated workflows, and user-facing release documentation.
Release tiers
X.<odd>.YYMMDDHH(UTC hour)vX.<even>.Zgit describeversion always names the exact release — required for crash symbolization.vsce publishis rejected by the Marketplace as a version downgrade.Workflow consolidation
publish-vscode.ymlis one parameterized pipeline (source: none | package | build) covering the universal PR build, release bundling, and instant repackaging — the previously separate logic is gone.check-format.yml,deploy-docs.yml, and the release dry-run file are folded intomain.yml(leaf jobs inline, orchestration viauses:); the dry run fires on release-plumbing paths andworkflow_dispatch.SCCACHE_BASEDIRSvariable removed everywhere.Observability & packaging
versionandtarget(asset-style identifier); both are logged at master startup and at the top of every crash section, so a crash log names the exact downloadable artifact and symbol package.Validation
Summary by CodeRabbit
LICENSEfile.