feat: implement issue #1076 — autocut: make the cut idempotent — reuse an existing release tag at the target commit instead of bumping (prevents orphan-tag spam on a blocked next-move) - #1078
Conversation
…e an existing release tag at the target commit instead of bumping (prevents orphan-tag spam on a blocked next-move)
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdds a helper to detect an existing ChangesAutocut Idempotent Reuse
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Autocut as _autocut_agent
participant Host as _host_release_version_at_commit
participant CutRelease as cut-release.sh
Autocut->>Host: query tags dereferencing to mainsha
Host-->>Autocut: highest matching vX.Y.Z or empty
alt tag already exists at mainsha
Autocut->>CutRelease: run --channel next --promote --push
CutRelease-->>Autocut: promote succeeds or warns on failure
else no matching tag
Autocut->>CutRelease: cut new bumped version
CutRelease-->>Autocut: new version cut
end
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces idempotent release tag reuse in the canary rollout script to prevent duplicate release tags on retries after partial failures. It adds a helper function to find existing release tags at a target commit and updates the autocut logic to promote the existing tag instead of cutting a new version. The feedback suggests validating positional parameters and initializing local variables in the new helper function to prevent unbound variable crashes under set -u, as well as guarding a command substitution in the tests with || true to avoid premature test failures under set -e.
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
There was a problem hiding this comment.
Pull request overview
This PR updates the canary-rollout autocut orchestrator to be idempotent when a release tag already exists at the target commit (main HEAD), reusing that existing <agent>/vX.Y.Z tag and moving next via cut-release.sh --promote to prevent repeated orphan tag creation after partial failures (issue #1076).
Changes:
- Added
_host_release_version_at_commitand integrated it into_autocut_agentto reuse an existing release tag at main HEAD and movenextvia--promoteinstead of cutting a new version. - Extended the Bats autocut stubs and added new tests covering the reuse path, retry-after-partial-failure behavior, and dry-run output for the reuse path.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| tests/canary_rollout.bats | Adds/extends autocut stubs and introduces tests for the idempotent reuse + retry convergence paths. |
| scripts/canary-rollout.sh | Implements release-tag-at-commit lookup and reuses an existing release tag via cut-release.sh --promote during autocut. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 241f4b67ab8441307d1f46da7c5283113d67157e
Cascade: triage → deep (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5)
Summary
PR #1078 makes canary-rollout autocut idempotent: when an /vX.Y.Z release tag already points at main HEAD it reuses it via cut-release.sh --promote instead of minting a duplicate on retry-after-partial-failure (#1076). Triage escalated on two advisory-bot findings, but on deep review both are defensive-programming nits, not real bugs: the new helper is only ever called with two args (and already guards empty commit), its read-populated locals are referenced only after assignment, and the test's grep -c exits 0 on the single-line passing path. No auth/secrets/crypto/migrations/injection/eval; all gates pass (shellcheck, bats, CodeQL, SonarCloud 0 issues, gitleaks, AgentShield). Downstream impact: (none). Secret-scanning MCP tool not exposed in this environment; diff contains no secret-like content.
Findings
- MINOR: Gemini (HIGH) suggests validating $# and initializing read-populated locals in _host_release_version_at_commit for set -u safety. Non-blocking: the function is only ever invoked with two args ("$agent" "$mainsha"), already guards empty commit, and ref/obj/type are referenced only inside the while-read loop after assignment. Matches existing repo convention (e.g. _autocut_agent uses local agent=$1 dry=$2 with no $# check). shellcheck CI passes.
- INFO: Gemini (LOW) suggests guarding grep -c with || true. Non-blocking: in the passing path CUT_LOG has exactly one line so grep -c exits 0; bats does not set inherit_errexit, so a hypothetical 0-match case still fails the [ ] test cleanly rather than erroring. bats CI passes.
- INFO: Reuse logic and annotated-tag dereference mirror existing _gh_candidate_cut_date; tests cover reuse path, retry-convergence (exactly one cut-release invocation), preserved bump path when no tag points at main HEAD, and dry-run. Good coverage. SonarCloud quality gate: 0 new issues.
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5). Reply if you need a human review.
Dev-Lead — review-changes (applied)Changes committed and pushed. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #1078 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
Review — fix requested (cycle 2/3)The automated review identified the following issues. Please address each one: Findings to fixAutomated review — NEEDS HUMAN REVIEWRisk: MEDIUM SummaryPR #1078 makes canary-rollout autocut idempotent: when an /vX.Y.Z release tag already points at main HEAD it reuses it via cut-release.sh --promote instead of minting a duplicate on retry-after-partial-failure (#1076). Code is correct and well-tested (helper _host_release_version_at_commit guards $#<2, initializes locals, dereferences annotated tags, and picks the highest semver; max_semver/_agent_field exist and mainsha/defbranch/host are in scope); no auth/secrets/crypto/migrations/injection/eval, and all real CI checks are green (shellcheck, bats, unit-tests, CodeQL, SonarCloud 0 issues, gitleaks, AgentShield). Not a security concern, so no Tier 3 audit — but a gate fails: the branch is CONFLICTING/DIRTY and cannot merge (reviewDecision REVIEW_REQUIRED), so it is escalated rather than approved. Downstream impact: (none). Findings
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5). Reply if you need a human review. Additional tasks
The review cascade will automatically re-review after new commits are pushed. |
|
Closing to simplify the upcoming canary-release relocation (.github-private → .github). Two reasons: (1) this now conflicts with the merged #1084 (both edit |
Closes #1076
Implemented by dev-lead agent. Please review.
Summary by CodeRabbit
New Features
autocutnow reuses an existing release version when the current main branch commit is already tagged, instead of always creating a new version.nextis moved forward to that existing version automatically.Bug Fixes