fix(release): declare the inventory schema version the release gate requires - #1685
Conversation
…equires verify-release-evidence.ts (added in #1628) rejects a release image inventory without schemaVersion 1, but security/release-images.json never gained the field, so tag-images died with "release image inventory is malformed" on the first release since — after the tag was already cut. The always-running check-release-image-inventory gate validated only the images and upstream arrays, so no pull request could catch the mismatch. Assert the schema version there too, with a test pinning the shipped file, so the two validators can no longer disagree about the same document. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe release image manifest now declares schema version 1. Pull-request validation rejects inventories without that version, and a test verifies the shipped manifest. ChangesRelease inventory schema
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to This localized change aligns release-inventory validation with the required schema and adds coverage for the shipped file; no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (1 skipped: 1 unsupported.) ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
📚 Documentation Preview
|
🧩 Storybook Preview
|
…pipeline Reverts 8984f73 (chore(release): version packages). The v0.75.0 release cut its draft, then tag-images failed: it checks out the release commit, and 8984f73 predates both pipeline fixes it needs — the SIGPIPE in release-notes extraction (#1684) and the missing inventory schemaVersion (#1685). A release anchored there can never pass, and the draft carried no tag and no assets, so it was deleted. Restoring the pending changesets lets the changesets bot regenerate the version PR on top of the fixes, so v0.75.0 ships from a commit whose pipeline works — same version, same notes, no gap in the released series.
1 participant
Description
The v0.75.0 release cut its tag, then
tag-imagesfailed withrelease image inventory is malformed.scripts/verify-release-evidence.ts(introduced in #1628) requiresschemaVersion === 1onsecurity/release-images.json, but the field was never added — and v0.75.0 is the first release since #1628 merged, so this is the first time it fired.Worse, the gate that runs on every pull request (
check-release-image-inventory.ts) validated only theimagesandupstreamarrays and never looked atschemaVersion— so no PR could have caught the mismatch. Two validators disagreed about the same document, and only the release-time one was strict.This adds the field, asserts it in the PR-time gate too, and pins the shipped file with a test.
How to test
node scripts/check-release-image-inventory.tspasses.node --test scripts/check-release-image-inventory.test.ts scripts/verify-release-evidence.test.ts— 19/19 green.tag-imagespast inventory validation.No changeset: release evidence tooling only.
Summary by CodeRabbit
Bug Fixes
Chores