Conversation
|
Caution Review failedPull request was closed or merged during review WalkthroughAdds two composite actions (release-tag-snapshot, release-tag-check) and updates the release workflow to snapshot the latest Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
lerian-studio
added
size/XS
🔍 Lint Analysis
|
🛡️ CodeQL Analysis ResultsLanguages analyzed: ✅ No security issues found. 🔍 View full scan logs | 🛡️ Security tab |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release.yml (1)
106-106: 🧹 Nitpick | 🔵 TrivialPre-existing: Third-party actions not SHA-pinned.
These actions (
actions/create-github-app-token@v2,actions/checkout@v6,crazy-max/ghaction-import-gpg@v7,actions/setup-node@v6,cycjimmy/semantic-release-action@v6) are pinned by tag, not commit SHA. Per coding guidelines, third-party actions outsideLerianStudioorg must be pinned by SHA with a# vX.Y.Zcomment.Not introduced by this PR, but flagging for awareness. Consider addressing in a follow-up.
Also applies to: 113-113, 124-124, 136-136, 151-151
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/release.yml at line 106, The workflow currently references third-party actions by tag (e.g., actions/create-github-app-token@v2, actions/checkout@v6, crazy-max/ghaction-import-gpg@v7, actions/setup-node@v6, cycjimmy/semantic-release-action@v6); replace each tag reference with the corresponding commit SHA (pin to a full commit hash) and add a trailing comment with the version (e.g., "# v2.0.0") as per guidelines, ensuring you update the uses: entries for those actions to the SHA form and include the "# vX.Y.Z" comment for each referenced action name to satisfy the org policy.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release.yml:
- Line 174: The LATEST_TAG assignment uses "git tag --sort=-v:refname" which can
surface non-semver tags; change the LATEST_TAG logic to only consider
semantic-style tags by filtering tags (e.g., those prefixed with "v") before
sorting — replace the current git tag invocation used to set LATEST_TAG so it
lists only "v*" tags and then sorts by version (maintain the -v:refname sort and
the head selection) to ensure non-semver tags like "beta" or
"release-candidate-1" are excluded.
- Around line 177-182: The check uses TAG_DATE computed from the commit
(TAG_COMMIT) which is wrong for lightweight tags; change the logic so TAG_DATE
is derived from the tag ref creation time (reflog) or from the workflow run
timestamp instead of the commit timestamp: query the tag ref reflog for
refs/tags/"$LATEST_TAG" to get its reflog creation epoch (use that value as
TAG_DATE) or fall back to GitHub Actions provided run time (e.g.,
GITHUB_RUN_CREATED_AT or the workflow run timestamp) and then compute DIFF = NOW
- TAG_DATE; update references to TAG_DATE, TAG_COMMIT and DIFF accordingly so
the 5-minute check uses tag creation time rather than the commit author time.
---
Outside diff comments:
In @.github/workflows/release.yml:
- Line 106: The workflow currently references third-party actions by tag (e.g.,
actions/create-github-app-token@v2, actions/checkout@v6,
crazy-max/ghaction-import-gpg@v7, actions/setup-node@v6,
cycjimmy/semantic-release-action@v6); replace each tag reference with the
corresponding commit SHA (pin to a full commit hash) and add a trailing comment
with the version (e.g., "# v2.0.0") as per guidelines, ensuring you update the
uses: entries for those actions to the SHA form and include the "# vX.Y.Z"
comment for each referenced action name to satisfy the org policy.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9f86cde4-4b90-48a7-a86e-c4c3382d5052
📒 Files selected for processing (1)
.github/workflows/release.yml
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…d release-tag-check composites
lerian-studio
added
size/S
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release.yml:
- Around line 179-190: The workflow interpolates step output directly into the
shell run block (using PRE_TAG="${{ steps.pre-tags.outputs.latest_tag }}"),
which risks command injection; change to pass the output via an env: variable
and reference it inside the run script (e.g., set env PRE_TAG from
steps.pre-tags.outputs.latest_tag and use PRE_TAG within the run script),
ensuring NEW_TAG, PRE_TAG, VERSION and writing to GITHUB_OUTPUT remain the same
but without direct GitHub Actions expression interpolation inside the shell
code.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 45ddbc50-5e31-4a0c-9265-962cc788ae55
📒 Files selected for processing (1)
.github/workflows/release.yml
bedatty
added a commit
that referenced
this pull request
Mar 26, 2026
…gin fails (#176) (#177) * fix(release): detect published release via git tag when backmerge plugin fails * fix(release): pin external actions by commit SHA * fix(release): use tag snapshot comparison instead of timestamp heuristic * refactor(release): extract tag detection into release-tag-snapshot and release-tag-check composites
5 tasks
14 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Actions Shared Workflows
Description
When the
@saithodev/semantic-release-backmergeplugin fails (e.g., non-fast-forward push todevelop), thecycjimmy/semantic-release-actionexits with failure and does not set thenew_release_publishedoutput — even though the release was successfully published.This caused the backmerge PR fallback step to be skipped and the job to fail with a misleading error: "Semantic release failed before publishing a new version".
Fix: Added a new step that detects whether a release was actually published by checking if a recent git tag (< 5 min old) exists on the current branch. The backmerge fallback and fail conditions now use this detection as an alternative signal, ensuring the fallback PR is created when the backmerge plugin fails after a successful release.
Affected workflow:
release.yml(reusable)Triggered by: https://github.com/LerianStudio/github-actions-shared-workflows/actions/runs/23607221651/job/68753204358
Type of Change
fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)Breaking Changes
None.
Testing
@developor the beta tagCaller repo / workflow run: https://github.com/LerianStudio/github-actions-shared-workflows/actions/runs/23607221651/job/68753204358 (the failing run that triggered this fix)
Related Issues
N/A
Summary by CodeRabbit