Repository navigation
fix: make release retries self-healing - #53
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
proof:needed
EvoZeus Proof GateMode: dry-run Proof labels
Missing or weak fields
Next action
|
EvoZeus Queue GuardMode: dry-run Author open PRs: 4 Branch family: codex/bug/20260804-infra-v051-release-followup Branch family open PRs: 1 Violations
Next action
|
EvoZeus Privacy ScanMode: dry-run Findings
Next action
|
github-actions
Bot
added
triage:dirty-pr
EvoZeus Dirty PR CheckMode: dry-run Surfaces
Reasons
Next action
|
github-actions
Bot
added
risk:github-token
EvoZeus Labeler ReportPR type/risk labels were updated from changed files. Surfaces
Labels
Changed lines
|
EvoZeus Auto ResponseMissing real behavior proofThis PR needs real behavior proof before review can continue. Add the command, environment, input, output after the patch, observed result, and what was not tested. Split this PRThis PR appears to mix too many surfaces or protected paths. Split it into one primary layer and one review target. Owner review requiredThis PR changes a protected path. CODEOWNERS review and maintainer approval are required; do not request automerge. RFC requiredGovernance, workflow, branch protection, or architecture changes need linked RFC or maintainer discussion before normal PR review. Queue limit reachedThis author or branch family appears to exceed the current queue limit. Reduce open PRs or ask a maintainer to override before continuing review. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fc5ee60b91
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Build Core archive and Stable product manifest | ||
| run: | | ||
| test "$(git describe --tags --exact-match)" = "${GITHUB_REF_NAME}" | ||
| remote_tag_commit="$(git ls-remote origin "refs/tags/${GITHUB_REF_NAME}^{}" | awk '{print $1}')" |
There was a problem hiding this comment.
When a release uses a lightweight tag, git ls-remote origin "refs/tags/${GITHUB_REF_NAME}^{}" returns no row because the ^{} peeled ref is advertised only for annotated tags (the git ls-remote --help contract describes these as peeled tags). Consequently remote_tag_commit is empty and this check aborts every lightweight-tag release before draft creation. Resolve both lightweight and annotated remote tags to their underlying commit before comparing with GITHUB_SHA.
Useful? React with 👍 / 👎.
This branch was successfully deployed
1 participant
Summary
What problem does this PR solve?
The v0.5.1 release run proved that the Actions
GITHUB_TOKENcannot read the repository Administration endpoint for immutable-release settings. A duplicate tag event also produced two concurrent release runs.Why does this matter now?
The current v0.5.1 tag has no Release because the workflow stopped before Draft creation. The retry contract must work with the built-in token and remain safe under duplicate or interrupted runs.
What is the intended outcome?
Serialize same-tag runs, verify the peeled remote tag twice, publish only after exact asset verification, re-audit an existing immutable Release idempotently, and clean up any existing or newly published mutable Release.
What is intentionally out of scope?
No product composition, Core runtime, CoEvolve, contract, Harness Skill, or target migration behavior changes.
What should reviewers focus on?
Duplicate-run serialization, existing mutable/immutable recovery branches, tag identity, and the asset verification ordering.
Linked Context
Related #52
Requested by the failed v0.5.1 Release run
30897069562.PR Scope
Primary layer:
Primary artifact kind: Release workflow recovery contract
One thing this PR does: makes immutable Release retries safe and self-healing with the built-in GitHub token.
What this PR does not do: claim strict atomic immutability preflight; configuration drift uses bounded rollback.
EvoZeus Evidence Proof
GITHUB_TOKEN; duplicate tag runs could race.30897069562and local workflow tests.GITHUB_TOKEN; the workflow documents bounded rollback for that path.Verdict / Review Gate
Review gates checked:
Tests and Validation
npm run test:release-notes;npm run test:preflight;python3 scripts/check_pr_ready.py;git diff --check; YAML parse;npm audit --audit-level=high.All checks passed.
Risk Checklist
Did user-visible behavior change? (
No)Did SKILL.md, public instructions, or agent behavior change? (
No)Did privacy, security, network, auth, or tool permission behavior change? (
Yes)Did schema, storage, branch, PR, or governance behavior change? (
Yes)Highest-risk area: interrupted or duplicate Release publication.
How is that risk mitigated? Serialized runs, two remote Tag checks, Draft asset verification, explicit mutable recovery, and immutable idempotent re-audit.
AI-Assisted Work
Was this PR written or materially changed by an AI coding agent? (
Yes)Codex implemented the recovery contract; an independent subagent identified and verified interrupted-run recovery boundaries.
Confirm the author understands the changed behavior:
Current Review State
Next action: run required CI, admin-merge, retarget the unpublished v0.5.1 tag, protect
v*tags, and audit the immutable Release.Still waiting on author, maintainer, CI, or external proof: required GitHub checks and real-tag Release proof.
Reviewer or bot comments addressed: all independent audit blockers were fixed before opening this PR.
Privacy Checklist
Operational Checklist
python3 scripts/check_pr_ready.pypassesgit diff --checkpasses