Repository navigation
fix(release): pin the ruleset-checking verifier and drop ref_protected from the release gates - #1211
Conversation
…d from the release gates The release verifier now checks the active tag rulesets itself, so the GHCR and Tauri gates no longer depend on github.ref_protected, which is reported as false for tag pushes. Move the pin in both workflows, the policy checker and its tests to the protected-main commit that contains the check, require the exact remaining conditions, and add a dispatch-only read-only proof that runs the pinned verifier with the production token against an existing tag.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
| Status | Commit | Started (UTC) | Finished (UTC) |
|---|---|---|---|
✅ #b0455 Reviewed your PR |
1cc5310 |
Nov 10, 2026 · 03:54 | 04:00 |
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
No actionable comments were generated in the recent review. Walkthrough
Merge Risk:
 |
Reviewer's GuideImplementationUpdate the release gate checker and its declared interface to require the new exact tag-push conditions and pin the verifier commit that checks tag rulesets.
ConfigurationAlign Docker and Tauri verification and publishing gates with the ruleset-checking verifier, and add a read-only dispatch workflow to prove it can inspect an existing tag with the production token.
DocumentationDocument that ruleset enforcement now happens in the pinned verifier and explain the dispatch-only proof workflow and pin-rotation requirements.
Record the updated release-gate contract and verifier pin in the unreleased changelog.
TestsUpdate release security gate and workflow-policy tests to enforce the new verifier pin, exact conditions, and read-only proof workflow.
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
codeant-ai
Bot
added
the
size:L
Commit ✅ Overall Status: PASSED
|
Commit ⚪ Overall Status: Not applicable
New-code coverage threshold not configured; coverage is reported but not enforced. |
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
There was a problem hiding this comment.
Gates Passed
See analysis details in CodeScene
Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.
|
[check-pr-size] PR size is over the target tier (normal profile): 9 files, 159 meaningful lines, 1 commits — limit ≤8 files / ≤400 lines / ≤6 commits. Consider splitting into smaller, independently reviewable PRs. |
|
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
User description
Summary
Part of #1206, step 2 of 2 after #1210. The release verifier now checks the active tag rulesets itself, so the GHCR and Tauri release gates stop depending on
github.ref_protected, which community reports describe asfalsefor tag pushes (discussion 142985, discussion 66588). If that value werefalseon the real tag push, both verifier jobs would be skipped, nothing would publish, and the immutable tag could not be removed.What changes
docker.ymlandtauri-build.yml: the verifier pin moves from147470682b62tod348d863f0cc, the protected-maincommit from fix(signing): require active tag rulesets for release tags in the verifier #1210 that contains the ruleset check (GitHub-verified).github.ref_protected == trueis removed from the verifier job and from both publish conditions.scripts/release-security-gate.mjsand its types: the pin constant moves, and the exact conjunction for the verifier job and for both publish jobs no longer containsref_protected. Re-adding it, or adding any permissive branch, is rejected as a change of the exact condition.tests/unit/tooling/releaseSecurityGate.test.tsandtests/unit/workflowPolicy.test.tsfollow the new contract. A test pins that neither workflow mentionsref_protected, and another that a looser or a stricter verifier condition is rejected for both workflows. The two "unprotected tag" cases were removed because the condition they mutated no longer exists..github/workflows/tag-verifier-proof.yml: dispatch-only,contents: read, no secrets. It runs the pinned verifier with the production token against an existing annotated tag (defaultv1.29.2), so the ruleset read with the Actions token is proven before a real release tag is pushed. Its pin must match the release workflows, which a test enforces.docs/CI.mdand the changelog describe the new contract.Evidence
releaseSecurityGate,workflowPolicyandworkflowPolicyChecktests pass (217), the release gate and the workflow policy check pass.v1.29.2(ok: true), and it rejects a malformed tag input.Known limit
The API hides
bypass_actorsfrom callers without admin rights, so the verifier cannot prove that no actor can bypassrelease-tags-immutable. That stays a maintainer-verified setting (read earlier: no bypass actors on ruleset 26812769).Release boundary
No tag, GitHub Release, registry push or Vercel mutation. This PR does not authorize
v1.29.3.Summary by Sourcery
Ensure tag-based GHCR and Tauri releases rely on the pinned ruleset-aware verifier rather than the unreliable
github.ref_protectedstatus.New Features:
Bug Fixes:
github.ref_protectedas false for tag pushes.Enhancements:
github.ref_protected.Documentation:
Tests:
Summary by cubic
Completes step 2 of 2 for #1206: drops
github.ref_protectedfrom the GHCR and Tauri release gates. Community reports describe it asfalsefor tag pushes, so both verifier jobs and both publish jobs could be skipped and nothing would publish.The verifier pin moves to the protected-
maincommit that checks active tag rulesets itself (added in #1210).ref_protectedand reject looser or stricter variants.tag-verifier-proof.ymlruns the pinned verifier with the production token against an existing tag, proving the ruleset read before a real tag is pushed.release-tags-immutableruleset, which stays a maintainer-verified setting.Written for commit 1cc5310. Summary will update on new commits.
CodeAnt-AI Description
Allow verified version tags to reach release publishing without relying on GitHub’s protection flag
What Changed
Impact
✅ Fewer skipped GHCR releases on tag pushes✅ Fewer skipped Tauri releases on tag pushes✅ Releases still require successful tag verification and security audits💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit