Repository navigation
ci(pi): derive promotion versions from canonical policy - #937
Merged
Merged
Conversation
Promotion PRs cannot push workflow edits with GitHub's built-in token. Read the existing Pi support policy in CI and remove workflow files from promotion's write scope. Preserve reviewed host locks and permissions. Refresh only the unchanged CI claim's provenance hash after re-scouting it.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (8)
💤 Files with no reviewable changes (1)
Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review. 📝 WalkthroughWalkthroughThe CI workflow previously used a fixed Pi version for its tools matrix and coverage runtime. It now reads supported versions and the last-verified version from the promotion policy. Promotion no longer writes or stages the CI workflow, and release changelog insertion preserves the Unreleased section. ChangesPi policy and promotion
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~25 minutes Change: Bug fix Sequence Diagram(s)sequenceDiagram
participant Policy as pi_promotion.py
participant ChangesJob as CI changes job
participant ToolsJob as ca-pi-tools
participant CoverageJob as Pi coverage job
ChangesJob->>Policy: Run policy command
Policy-->>ChangesJob: Return supported_versions and last_verified
ChangesJob->>ToolsJob: Set pi-versions matrix
ChangesJob->>CoverageJob: Set last-verified runtime
Merge Risk: ⚪ Minimal · up to No actionable merge-blocking issue remains from this review. The policy step runs after checkout. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 22.22% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 4 files. (3 skipped: 3 unsupported.)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The package contract still required the obsolete literal runtime matrix. Verify the canonical policy output instead and reject a regression back to hard-coded versions while retaining the existing executable job guards.
Promotion inserted its release heading above pending changes, violating the release helper's required changelog order. Retain that section and all older history while placing the new release between them. CHANGELOG: Preserve Unreleased when preparing Pi promotion release notes.
Bring the reviewed factual documentation changes into the promotion branch so final hosted validation runs against current main. The promotion source and its reviewed changelog regression remain unchanged.
Keep the existing promotion repair current with the completed engine performance group while preserving its reviewed workflow and helper changes. The merge carries the already reviewed main sources without new behavior.
Bring the branch up to current main for strict merge readiness. The three incoming site files retain the already-reviewed installer hash validation unchanged; the Pi promotion implementation is unchanged. Verify the integration with focused promotion and installer tests, TypeScript checking, source equality and independent security review.
This was referenced Oct 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pi promotion generated workflow edits that GitHub's built-in token cannot push. CI now reads supported Pi versions from the canonical compatibility descriptor, and promotion excludes workflows from its write and staging scope. This implements DEC-08 without adding credentials or changing release policy.
Promotion also inserted release headings above
Unreleased. The generator now preserves that section and historical entries, inserting the new release between them.Validation:
8806acd53cbee0edce57cadbdb36ce2da5b06446passed all 78 hosted checks, including merge readiness, in CI run 37866366349.Unreleased, inserted 0.17.2 before 0.17.1, and left workflow files unchanged.97a2ea0fb1dd2983f2757f680cfb9a359cbf69aaand the reviewed head. Ancestry and hosted checks were revalidated before merging asaf741255ab199f8465f4ea9ee8c5c178836fcc7e.The first authorized live Pi 1.1.0 promotion exercise failed during source-metadata capture on all three platforms because the exact npm record omits
gitHead. PR #940 repaired capture under ADR-0035's existingPENDING_REVIEWboundary and merged asbafe761bac1881438c6deed781668eb8f853ed70. Its local 48-test suite and real 148-entry pending capture passed, followed by successful hosted and postmerge checks.The second authorized exercise captured Pi 1.1.0 successfully on all three platforms, then failed validation because the reviewed Pi 1.0.2 runtime checks ran after the prospective descriptor changed to 1.1.0. PR #941 separates those validation phases and corrects the broker close test's handling of
ECONNRESET. It is open at9286ddbe1998a2ecef272ddc01ae2e9cf829ee31, with hosted checks still running.Both exercises skipped the draft-PR job. No candidate branch or PR was created, and no candidate code was installed or executed. The captured dependency graph remains
PENDING_REVIEW; the remote draft-PR push path remains unverified.The exercise authorizes only a draft dependency-review PR. It does not authorize merging the generated candidate, tagging or manually publishing a release.