This repository was archived by the owner on Aug 12, 2026. It is now read-only.
fix(ci): enforce v1.0.0 release gates - #154
Merged
Merged
Conversation
- Run coverage and documentation as stable pull-request checks. - Exercise the opt-in viewer contract on macOS. - Centralize compiler, Python, LCOV, and cache pins. - Extend action pinning and remove the obsolete debug wrapper. - Keep ThreadSanitizer and CodeQL advisory. Closes #95
acgetchell
enabled auto-merge
August 10, 2026 04:34
WalkthroughThe PR centralizes CI tool versions, resolves compiler-specific packages and cache keys, adds macOS viewer validation, strengthens coverage and documentation gates, updates release documentation, and expands workflow configuration tests. ChangesCI release gates
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant Justfile
participant CompilerResolution
participant CIContracts
participant MacOSViewer
GitHubActions->>Justfile: Resolve tool versions
Justfile-->>CompilerResolution: Return compiler and Python versions
CompilerResolution->>CIContracts: Provide compiler package and cache key
CIContracts->>MacOSViewer: Run viewer-build on macOS
Possibly related issues
Possibly related PRs
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codecov-upload.yml:
- Around line 39-48: Update the tool-version resolution steps in
.github/workflows/codecov-upload.yml lines 39-48,
.github/workflows/_sanitizer.yml lines 75-77, and .github/workflows/codeql.yml
lines 73-76: assign each just --evaluate result to a variable so failures stop
the step, then write the values to GITHUB_OUTPUT with printf instead of
embedding commands inside echo; preserve all existing output names and evaluated
version symbols.
- Around line 8-10: Update the Codecov upload workflow’s pull-request handling
to disable use_oidc for dependabot[bot] actors, or select the supported
tokenless upload path for those runs. Preserve coverage generation, artifact
validation, and the existing OIDC behavior for other pull requests.
In `@docs/RELEASING.md`:
- Around line 119-135: Update the protected-branch context list in the releasing
documentation to match the active main ruleset: retain only build, CodeRabbit,
build / AddressSanitizer + UndefinedBehaviorSanitizer, and build / LeakSanitizer
as required contexts. Remove CodeCov and docs from the required-context
description while preserving the advisory and manual sanitizer guidance.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 87cafa48-913c-4164-909a-839cf80b4abb
📒 Files selected for processing (15)
.github/CONTRIBUTING.md.github/actions/setup-just/action.yml.github/workflows/_sanitizer.yml.github/workflows/ci.yml.github/workflows/codecov-upload.yml.github/workflows/codeql.yml.github/workflows/doxygen.yml.pinact.yaml.python-versionJustfileREADME.mddocs/RELEASING.mddocs/viewer.mdscripts/debug.shscripts/tests/test_justfile_discoverability.py
💤 Files with no reviewable changes (1)
- scripts/debug.sh
Welcome to Codecov 🎉Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests. Thanks for integrating Codecov - We've got you covered ☂️ |
- Propagate tool-version resolution failures before publishing outputs. - Disable Codecov OIDC for Dependabot while preserving it for other runs. - Align documented required checks with the active main ruleset.
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/codecov-upload.yml (1)
120-120: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winValidate the two coverage reports independently.
if-no-files-found: errorchecks the combinedpathresult. An existingbuild/coverage.infocan therefore mask a missing or emptybuild/coverage-html. Add a validation step before the artifact upload.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codecov-upload.yml at line 120, Add a validation step before the artifact upload in the Codecov workflow to independently verify that both build/coverage.info and build/coverage-html exist and are non-empty. Do not rely on the combined artifact path or if-no-files-found setting, which can allow one report to mask the other.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codecov-upload.yml:
- Line 147: Add the Codecov token input alongside use_oidc in the Codecov upload
action, sourcing it from secrets.CODECOV_TOKEN, and configure that secret for
Dependabot so runs with use_oidc disabled authenticate successfully while
preserving OIDC for other actors.
---
Outside diff comments:
In @.github/workflows/codecov-upload.yml:
- Line 120: Add a validation step before the artifact upload in the Codecov
workflow to independently verify that both build/coverage.info and
build/coverage-html exist and are non-empty. Do not rely on the combined
artifact path or if-no-files-found setting, which can allow one report to mask
the other.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 10107b00-b9ad-4688-a9bc-09b87ed98099
📒 Files selected for processing (4)
.github/workflows/_sanitizer.yml.github/workflows/codecov-upload.yml.github/workflows/codeql.ymldocs/RELEASING.md
💤 Files with no reviewable changes (1)
- docs/RELEASING.md
- Preserve Apple archive tools during macOS viewer builds. - Authenticate Dependabot uploads and reject incomplete coverage reports.
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/ci.yml (1)
95-102: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winMake tool-version resolution fail fast.
Assign each
just --evaluateresult before writingGITHUB_OUTPUT. A failed command substitution insideechocan still produce a successfulechostatus and write an empty output. Later steps can consume invalid tool versions.Use
set -euo pipefail, assignments, andprintffor the outputs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 95 - 102, Update the tool-version resolution block in the CI workflow to enable set -euo pipefail, assign each just --evaluate result to a variable before writing outputs, and use printf to append those variables to GITHUB_OUTPUT. Ensure any failed version evaluation stops the step instead of emitting an empty output.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 95-102: Update the tool-version resolution block in the CI
workflow to enable set -euo pipefail, assign each just --evaluate result to a
variable before writing outputs, and use printf to append those variables to
GITHUB_OUTPUT. Ensure any failed version evaluation stops the step instead of
emitting an empty output.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 22bed660-233f-436e-acd6-a3e3df58b71c
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/codecov-upload.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #95
Summary by CodeRabbit
Documentation
CI Improvements
Maintenance
Tests