Skip to content

(DRAFT-RUN) HYPERFLEET-1024 - feat: automate#37

Closed
mliptak0 wants to merge 7 commits intoopenshift-hyperfleet:mainfrom
mliptak0:HYPERFLEET-1024
Closed

(DRAFT-RUN) HYPERFLEET-1024 - feat: automate#37
mliptak0 wants to merge 7 commits intoopenshift-hyperfleet:mainfrom
mliptak0:HYPERFLEET-1024

Conversation

@mliptak0
Copy link
Copy Markdown
Contributor

@mliptak0 mliptak0 commented May 6, 2026

TODO

Summary

  • HYPERFLEET-XXX

Test Plan

  • Unit tests added/updated
  • make test-all passes
  • make lint passes
  • Helm chart changes validated with make test-helm (if applicable)
  • Deployed to a development cluster and verified (if Helm/config changes)
  • E2E tests passed (if cross-component or major changes)

Summary by CodeRabbit

  • Chores

    • Enhanced CI with schema build, diff, lint, and version checks; upgraded toolchain.
    • Streamlined release workflow with deterministic installs and expanded published assets.
    • Added configuration for OpenAPI linting.
  • Maintenance

    • Added Go module support for distributing embedded schema assets.
  • Bug Fixes

    • Adjusted error response instance format for better compatibility.

… schema linting

- Add CI workflow (ci.yml): builds all 4 schemas, checks consistency
  against committed files, lints with Spectral, and enforces version
  bump on every PR and push to main
- Replace release.yml: triggers on push to main instead of manual tag;
  auto-creates annotated tag from main.tsp version; uploads all 4
  schema artifacts (core+gcp openapi+swagger); idempotent on re-runs
- Add go.mod + schemas/schemas.go: exposes all 4 generated schemas via
  //go:embed as embed.FS, enabling downstream Go consumers to import
  versioned schemas as a module dependency without local copies
- Add .spectral.yaml with spectral:oas ruleset for OpenAPI 3.0 linting
- Add @stoplight/spectral-cli ^6.15.1 as devDependency

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@openshift-ci openshift-ci Bot requested review from Mischulee and kuudori May 6, 2026 12:07
@openshift-ci
Copy link
Copy Markdown

openshift-ci Bot commented May 6, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kuudori for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 6, 2026

Walkthrough

Adds CI and release GitHub Actions workflows, a Spectral configuration, Go module support, an embedded schemas package, and updates schema format annotations. CI workflow runs on pull_request and pushes to main: checks out code, sets up Node 20, installs dependencies, installs TypeSpec v1.11 and Spectral CLI, builds core and gcp schemas (with and without swagger), diffs generated schemas for consistency, lints OpenAPI files with Spectral, and checks for a version bump. Release workflow now uses actions/checkout@v6, npm ci, TypeSpec v1.11, extracts version from main.tsp, skips if tag exists, builds all schema variants, prepares four YAML assets, creates an annotated tag, and publishes a GitHub Release. Added .spectral.yaml, go.mod, schemas package exporting embedded FS, and changed Error.instance format from "uri" to "uri-reference" across source and generated schemas.

Sequence Diagram(s)

sequenceDiagram
    participant Dev as Developer (push/PR)
    participant GH as GitHub
    participant Runner as Actions Runner
    participant TS as TypeSpec CLI
    participant Spectral as Spectral CLI
    participant Repo as Repository (files)
    participant ReleaseAPI as GitHub Releases API

    Dev->>GH: push / open PR
    GH->>Runner: start CI job
    Runner->>Repo: checkout code
    Runner->>Runner: npm ci, install TypeSpec v1.11, install Spectral
    Runner->>TS: build schemas (core/gcp, with/without swagger)
    TS-->>Runner: generated YAML artifacts
    Runner->>Runner: diff generated schemas vs committed schemas
    Runner->>Spectral: lint openapi YAMLs
    Spectral-->>Runner: lint results
    Runner->>GH: report CI status

    Note over Runner,GH: On release workflow (manual / main-test)
    Dev->>GH: trigger release
    GH->>Runner: start release job
    Runner->>Repo: checkout full history
    Runner->>TS: build schemas
    Runner->>Runner: extract version from main.tsp, check tags
    alt tag does not exist
        Runner->>GH: create annotated tag
        Runner->>ReleaseAPI: create GitHub Release with 4 YAML assets
    else tag exists
        Runner-->>GH: skip release steps
    end
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~40 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Title check ❓ Inconclusive The title is incomplete and vague, mentioning "automate" without clearly specifying what is being automated or what the main change is. Rewrite the title to clearly describe the main change, such as 'Add CI/CD workflows and Go package for schema distribution' or similar, removing draft markers and vague terms.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 52-53: The CURRENT version extraction (variable CURRENT from the
grep on main.tsp) isn't validated; add a fail-fast check immediately after
computing CURRENT to detect empty or invalid output and exit non‑zero with a
clear message. In practice, after the CURRENT assignment in the CI script, test
if CURRENT is empty or does not match a simple semver regex and if so print an
error like "Failed to parse current version from main.tsp: $CURRENT" and exit 1
so the bump gate cannot proceed on malformed/empty values.

In @.github/workflows/release.yml:
- Around line 38-47: The current two-step tag existence check in the "Check if
release already exists" step (id: check_tag) and the later git push is
TOCTOU-prone; remove or de-emphasize the pre-check and make the push operation
idempotent by handling "already exists" as a benign outcome: attempt to push the
tag (the git push <remote> "${{ steps.version.outputs.tag }}" command) and if it
fails, inspect the error/exit status or stderr for the "already exists" /
"remote rejected" message and treat that case as success (set skip=true in
GITHUB_OUTPUT), otherwise fail the job on other errors—update the workflow steps
that perform the push to implement this tolerant-push logic and remove reliance
on the separate existence check in check_tag.
- Around line 34-36: The workflow currently assumes the grep extraction into the
VERSION variable succeeds; validate that VERSION is non-empty after
VERSION=$(grep -oP '(?<=version: ")[^"]+' main.tsp) and before writing to
GITHUB_OUTPUT, and if it is empty emit a clear error (use echo to STDERR or fail
the job) and exit non-zero to prevent writing "tag=v" and corrupting the
release; reference the VERSION variable and the subsequent echo "tag=v$VERSION"
>> "$GITHUB_OUTPUT" locations to add this guard and fail-fast behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 04b6ead1-ae1b-4533-8f99-5c5262aa34c7

📥 Commits

Reviewing files that changed from the base of the PR and between 2807639 and 36402d2.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (6)
  • .github/workflows/ci.yml
  • .github/workflows/release.yml
  • .spectral.yaml
  • go.mod
  • package.json
  • schemas/schemas.go

Comment thread .github/workflows/ci.yml
Comment on lines +52 to +53
CURRENT=$(grep -oP '(?<=version: ")[^"]+' main.tsp)
LATEST=$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null | sed 's/^v//' || echo "")
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Harden version extraction before enforcing the bump gate.

At Line 52, the parsed version is not validated. If parsing returns empty/unexpected output, the version-check logic can produce false passes. Fail fast when CURRENT is empty.

Proposed fix
-          CURRENT=$(grep -oP '(?<=version: ")[^"]+' main.tsp)
+          CURRENT=$(sed -nE 's/.*version:[[:space:]]*"([^"]+)".*/\1/p' main.tsp | head -n1)
+          if [ -z "$CURRENT" ]; then
+            echo "Failed to extract version from main.tsp"
+            exit 1
+          fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
CURRENT=$(grep -oP '(?<=version: ")[^"]+' main.tsp)
LATEST=$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null | sed 's/^v//' || echo "")
CURRENT=$(sed -nE 's/.*version:[[:space:]]*"([^"]+)".*/\1/p' main.tsp | head -n1)
if [ -z "$CURRENT" ]; then
echo "Failed to extract version from main.tsp"
exit 1
fi
LATEST=$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null | sed 's/^v//' || echo "")
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 52 - 53, The CURRENT version
extraction (variable CURRENT from the grep on main.tsp) isn't validated; add a
fail-fast check immediately after computing CURRENT to detect empty or invalid
output and exit non‑zero with a clear message. In practice, after the CURRENT
assignment in the CI script, test if CURRENT is empty or does not match a simple
semver regex and if so print an error like "Failed to parse current version from
main.tsp: $CURRENT" and exit 1 so the bump gate cannot proceed on
malformed/empty values.

Comment on lines +34 to +36
VERSION=$(grep -oP '(?<=version: ")[^"]+' main.tsp)
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Validate extracted release version before deriving the tag.

At Line 34, the workflow assumes extraction always succeeds. If it fails, you can emit v as tag and corrupt release flow. Add an explicit non-empty validation.

Proposed fix
-          VERSION=$(grep -oP '(?<=version: ")[^"]+' main.tsp)
+          VERSION=$(sed -nE 's/.*version:[[:space:]]*"([^"]+)".*/\1/p' main.tsp | head -n1)
+          if [ -z "$VERSION" ]; then
+            echo "Failed to extract version from main.tsp"
+            exit 1
+          fi
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
VERSION=$(grep -oP '(?<=version: ")[^"]+' main.tsp)
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
VERSION=$(sed -nE 's/.*version:[[:space:]]*"([^"]+)".*/\1/p' main.tsp | head -n1)
if [ -z "$VERSION" ]; then
echo "Failed to extract version from main.tsp"
exit 1
fi
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 34 - 36, The workflow currently
assumes the grep extraction into the VERSION variable succeeds; validate that
VERSION is non-empty after VERSION=$(grep -oP '(?<=version: ")[^"]+' main.tsp)
and before writing to GITHUB_OUTPUT, and if it is empty emit a clear error (use
echo to STDERR or fail the job) and exit non-zero to prevent writing "tag=v" and
corrupting the release; reference the VERSION variable and the subsequent echo
"tag=v$VERSION" >> "$GITHUB_OUTPUT" locations to add this guard and fail-fast
behavior.

mliptak0 and others added 5 commits May 6, 2026 14:21
…-action

Replace manual npx spectral invocation with stoplightio/spectral-action@v0.8.13.
The action bundles its own Spectral binary, avoiding Node.js version
compatibility issues with npx. Remove @stoplight/spectral-cli devDependency
as it is no longer needed. Update TypeSpec compiler to @1.11 in both workflows.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…versions

Add checks:write to CI job so stoplightio/spectral-action can post inline
PR annotations via GitHub API. Without this permission, the action fails
with "Resource not accessible by integration" even when linting passes.

Note: fork PRs cannot receive checks:write (GitHub security restriction)
so annotation posting will still fail there, but branch PRs on the real
repo will work correctly.

Bump actions/checkout and actions/setup-node from v4 to v6 (Node.js 24
runtime) ahead of the June 2nd, 2026 Node.js 20 forced deprecation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ons format

Replace stoplightio/spectral-action (Docker, hides output behind GitHub API
annotations) with a direct npx spectral lint invocation using --format
github-actions. This format emits ::error and ::warning workflow commands
to stdout, which GitHub Actions renders as inline PR annotations natively
without requiring checks:write or any API call. Output is fully visible in
step logs. Remove checks:write permission as it is no longer needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…k file conflict

The lock file (generated on Node.js 25) pins a nested AJV build inside
@stoplight/spectral-core that fails in CI. Installing spectral-cli globally
with npm install -g resolves a fresh compatible dependency tree, bypassing
the lock file. Call spectral directly (not via npx) and keep it out of
devDependencies since it is a CI-only tool installed separately.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…eference

Per RFC 7807, the instance field identifies a specific occurrence of a
problem and may be a relative URI reference. The example /api/hyperfleet/v1/clusters
is a valid relative URI reference but not a valid URI (missing scheme),
which caused Spectral's oas3-valid-schema-example rule to error. Changing
the format annotation to uri-reference is semantically correct and fixes
the lint error. Rebuild all four schema artifacts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 57-61: The current LATEST assignment hides failures by redirecting
stderr and falling back to an empty string; change the logic so the gh release
lookup failure is detected and fails the job while only an empty successful
result is treated as "no releases." Run the gh release list --limit 1 --json
tagName --jq '.[0].tagName' (with the sed 's/^v//' transform) without
redirecting stderr, capture its exit status (the command producing LATEST), and
if the command exits non-zero, print the gh error output and exit non-zero; only
if the command succeeds but yields an empty string should you echo "No previous
releases found — version check skipped" and exit 0. Ensure you reference and
update the LATEST assignment and the subsequent conditional that checks -z
"$LATEST" so transient API/auth failures don't get treated as "no releases."

In @.github/workflows/release.yml:
- Around line 38-47: The current check in the step with id check_tag uses git
rev-parse on steps.version.outputs.tag and sets skip=true if the tag exists,
which prevents creating a release on retries when the tag was pushed but the
release step failed; change the logic so it only skips when a GitHub release for
that tag already exists (not merely the git tag). Replace the git rev-parse
branch in the "Check if release already exists" step to query the GitHub
Releases API (using curl with GITHUB_TOKEN or the gh CLI) to check for an
existing release for steps.version.outputs.tag and set skip=true only if the API
returns a release for that tag (otherwise set skip=false) so reruns can recover
by creating the missing release. Ensure you reference the same step id
(check_tag) and the tag value steps.version.outputs.tag when implementing the
API check.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 13021b02-2d5b-4f46-aa9f-df57bd8c2d25

📥 Commits

Reviewing files that changed from the base of the PR and between 36402d2 and ff27042.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (7)
  • .github/workflows/ci.yml
  • .github/workflows/release.yml
  • models/common/model.tsp
  • schemas/core/openapi.yaml
  • schemas/core/swagger.yaml
  • schemas/gcp/openapi.yaml
  • schemas/gcp/swagger.yaml

Comment thread .github/workflows/ci.yml
Comment on lines +57 to +61
LATEST=$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null | sed 's/^v//' || echo "")
if [ -z "$LATEST" ]; then
echo "No previous releases found — version check skipped"
exit 0
fi
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

# Check if the workflow file exists and examine lines 57-61
if [ -f .github/workflows/ci.yml ]; then
  echo "=== File exists. Checking lines 57-61 ==="
  sed -n '57,61p' .github/workflows/ci.yml
  echo ""
  echo "=== Full context (lines 50-70) ==="
  sed -n '50,70p' .github/workflows/ci.yml
else
  echo ".github/workflows/ci.yml does not exist"
  # Try to find any CI workflow file
  find . -name "ci.yml" -o -name "ci.yaml" 2>/dev/null | head -10
fi

Repository: openshift-hyperfleet/hyperfleet-api-spec

Length of output: 1201


Fail closed when release lookup fails in the version gate.

At line 57, errors from the release lookup are suppressed with 2>/dev/null, and combined with the || echo "" fallback, any command failure results in an empty LATEST value. This conflates two scenarios: no releases existing (legitimate for initial releases) and transient GitHub/API/auth failures. Both are treated identically—as "no releases"—causing the version check to be silently skipped during failures.

Suggested fix
-          LATEST=$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null | sed 's/^v//' || echo "")
-          if [ -z "$LATEST" ]; then
+          if ! LATEST_RAW=$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null); then
+            echo "Failed to query latest release tag"
+            exit 1
+          fi
+          LATEST="${LATEST_RAW#v}"
+          if [ -z "$LATEST" ]; then
             echo "No previous releases found — version check skipped"
             exit 0
           fi
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 57 - 61, The current LATEST assignment
hides failures by redirecting stderr and falling back to an empty string; change
the logic so the gh release lookup failure is detected and fails the job while
only an empty successful result is treated as "no releases." Run the gh release
list --limit 1 --json tagName --jq '.[0].tagName' (with the sed 's/^v//'
transform) without redirecting stderr, capture its exit status (the command
producing LATEST), and if the command exits non-zero, print the gh error output
and exit non-zero; only if the command succeeds but yields an empty string
should you echo "No previous releases found — version check skipped" and exit 0.
Ensure you reference and update the LATEST assignment and the subsequent
conditional that checks -z "$LATEST" so transient API/auth failures don't get
treated as "no releases."

Comment on lines +38 to +47
- name: Check if release already exists
id: check_tag
run: |
git fetch --tags
if git rev-parse "${{ steps.version.outputs.tag }}" >/dev/null 2>&1; then
echo "Tag ${{ steps.version.outputs.tag }} already exists — skipping release"
echo "skip=true" >> "$GITHUB_OUTPUT"
else
echo "skip=false" >> "$GITHUB_OUTPUT"
fi
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/release.yml | sed -n '30,85p'

Repository: openshift-hyperfleet/hyperfleet-api-spec

Length of output: 2524


Tag-based skip logic prevents release recovery after partial failures.

At line 42, the workflow checks tag existence using git rev-parse and sets skip=true if the tag exists. This blocks all downstream steps—including release creation at line 75—on subsequent runs. If the tag is pushed successfully (line 71) but release publication fails, reruns cannot recover because the tag already exists and the release creation step remains skipped.

Suggested fix
-      - name: Check if release already exists
-        id: check_tag
+      - name: Check if release already exists
+        id: check_release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          git fetch --tags
-          if git rev-parse "${{ steps.version.outputs.tag }}" >/dev/null 2>&1; then
-            echo "Tag ${{ steps.version.outputs.tag }} already exists — skipping release"
+          if gh release view "${{ steps.version.outputs.tag }}" >/dev/null 2>&1; then
+            echo "Release ${{ steps.version.outputs.tag }} already exists — skipping release"
             echo "skip=true" >> "$GITHUB_OUTPUT"
           else
             echo "skip=false" >> "$GITHUB_OUTPUT"
           fi

-      - name: Build all schemas
-        if: steps.check_tag.outputs.skip == 'false'
+      - name: Build all schemas
+        if: steps.check_release.outputs.skip == 'false'

-      - name: Prepare release assets
-        if: steps.check_tag.outputs.skip == 'false'
+      - name: Prepare release assets
+        if: steps.check_release.outputs.skip == 'false'

-      - name: Create release tag
-        if: steps.check_tag.outputs.skip == 'false'
+      - name: Create release tag
+        if: steps.check_release.outputs.skip == 'false'
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -a "${{ steps.version.outputs.tag }}" -m "Release ${{ steps.version.outputs.tag }}"
-          git push origin "${{ steps.version.outputs.tag }}"
+          git fetch --tags
+          if git rev-parse "${{ steps.version.outputs.tag }}" >/dev/null 2>&1; then
+            echo "Tag already exists; continuing to release creation."
+          else
+            git tag -a "${{ steps.version.outputs.tag }}" -m "Release ${{ steps.version.outputs.tag }}"
+            git push origin "${{ steps.version.outputs.tag }}"
+          fi

-      - name: Create GitHub Release
-        if: steps.check_tag.outputs.skip == 'false'
+      - name: Create GitHub Release
+        if: steps.check_release.outputs.skip == 'false'
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 38 - 47, The current check in the
step with id check_tag uses git rev-parse on steps.version.outputs.tag and sets
skip=true if the tag exists, which prevents creating a release on retries when
the tag was pushed but the release step failed; change the logic so it only
skips when a GitHub release for that tag already exists (not merely the git
tag). Replace the git rev-parse branch in the "Check if release already exists"
step to query the GitHub Releases API (using curl with GITHUB_TOKEN or the gh
CLI) to check for an existing release for steps.version.outputs.tag and set
skip=true only if the API returns a release for that tag (otherwise set
skip=false) so reruns can recover by creating the missing release. Ensure you
reference the same step id (check_tag) and the tag value
steps.version.outputs.tag when implementing the API check.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 4-7: The workflow's push trigger currently limits releases to
branch "main-test" so pushes to main won't auto-run; update the workflow's
push.branches value under the "push:" trigger to include "main" (or replace
"main-test" with "main", or list both "main" and "main-test") so that automatic
runs fire on pushes to main, leaving "workflow_dispatch" intact for manual runs;
edit the "push:" -> "branches:" block in the release workflow to make this
change.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 097b0e29-679b-402c-b7f6-7d5d2a676446

📥 Commits

Reviewing files that changed from the base of the PR and between ff27042 and f82792c.

📒 Files selected for processing (1)
  • .github/workflows/release.yml

Comment on lines 4 to +7
push:
tags:
- 'v*'
branches:
- main-test
workflow_dispatch:
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Trigger branch main-test will not run on main.

The PR is targeting main but the push trigger is restricted to main-test. After this merges, automatic releases will never fire on main pushes — only manual workflow_dispatch runs will publish. If main-test is a leftover from a draft/test cycle, switch it back to main (or include both) before merging.

Proposed fix
   push:
     branches:
-      - main-test
+      - main
   workflow_dispatch:
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
push:
tags:
- 'v*'
branches:
- main-test
workflow_dispatch:
push:
branches:
- main
workflow_dispatch:
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 4 - 7, The workflow's push
trigger currently limits releases to branch "main-test" so pushes to main won't
auto-run; update the workflow's push.branches value under the "push:" trigger to
include "main" (or replace "main-test" with "main", or list both "main" and
"main-test") so that automatic runs fire on pushes to main, leaving
"workflow_dispatch" intact for manual runs; edit the "push:" -> "branches:"
block in the release workflow to make this change.

@mliptak0 mliptak0 closed this May 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant