Skip to content

fix(release): publish stable artifacts from github releases#462

Merged
yacosta738 merged 6 commits into
mainfrom
ci/release-please
Apr 8, 2026
Merged

fix(release): publish stable artifacts from github releases#462
yacosta738 merged 6 commits into
mainfrom
ci/release-please

Conversation

@yacosta738
Copy link
Copy Markdown
Contributor

@yacosta738 yacosta738 commented Apr 8, 2026

Summary

  • add Slack inbound image staging so file shares can be fetched, validated, and processed through the multimodal pipeline
  • update Slack runtime/onboarding guidance to require the scopes needed for file metadata and downloads (chat:write, channels:history, files:read)
  • realign release automation so merges to main drive release-please, the canonical GitHub Release is created by release-please, and stable artifact publication fans out from release.published

Tested Information

  • node --test scripts/release-contract.test.mjs
  • actionlint -config-file .github/actionlint.yml .github/workflows/release-please.yml .github/workflows/publish-release.yml .github/workflows/publish-snapshot.yml .github/workflows/_publish.yml
  • pre-push runtime checks: Rust tests passed (3492 passed)
  • pre-push web/docs checks passed during push of the release-governance commit

Documentation Impact

  • Docs updated in:
    • .github/workflows/README.md
    • clients/web/apps/docs/src/content/docs/guides/release.md
    • clients/web/apps/docs/src/content/docs/es/guides/release.md
    • clients/web/apps/docs/src/content/docs/clients/agent-runtime/ci-map.md
    • clients/web/apps/docs/src/content/docs/es/clients/agent-runtime/ci-map.md
    • clients/agent-runtime/README.md
    • CHANGELOG.md
  • No docs update required because:
  • I verified the documentation matches the current behavior.

Breaking Changes

  • No intended breaking API changes.
  • Stable release orchestration now hands off from the canonical GitHub Release (release.published) instead of tag-push-driven GitHub Release creation inside _publish.yml.

Checklist

  • I have checked that there isn’t already a PR solving the same problem.
  • I have read the Contributing Guidelines.
  • I ensured my code follows the project's style guidelines.
  • I have added or updated tests that prove my fix is effective or that my feature works.
  • I have updated the documentation, or I explained above why no documentation update is needed.
  • I verified the documentation matches the current behavior.
  • I have documented any breaking changes in the Breaking Changes section.
  • I have linked the related issue (if any).

Closes: #329

Enable Slack multimodal image ingestion so file shares can be fetched, staged, and processed like other supported channels. Update Slack setup guidance to require the scopes needed for metadata and file downloads.
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented Apr 8, 2026

Deploying corvus with  Cloudflare Pages  Cloudflare Pages

Latest commit: 16adb76
Status: ✅  Deploy successful!
Preview URL: https://a30e1f48.corvus-42x.pages.dev
Branch Preview URL: https://ci-release-please.corvus-42x.pages.dev

View logs

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Apr 8, 2026

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (2)
  • wip
  • do-not-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: f1e245ca-ab6a-4e5f-badd-168400c60917

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

This PR restructures the stable release automation to shift canonical ownership from tag-push triggers to release-please-managed GitHub Releases, redefines _publish.yml to attach assets rather than create releases, improves Slack channel error handling with explicit Result-based propagation and timeouts, and updates release governance documentation and contract tests accordingly.

Changes

Cohort / File(s) Summary
Slack Channel Error Handling
clients/agent-runtime/src/channels/slack.rs
Changed get_bot_user_id to return Result<String> instead of Option<String> with explicit error cases for HTTP failures, non-2xx responses, and missing user_id. Updated listen to propagate errors and modified resolve_file_download_url to wrap file metadata fetches in a configurable timeout, mapping failures to ImageRejectionReason::FetchFailed. Tests adjusted to assert error results.
Release Workflow Restructuring
.github/workflows/_publish.yml, .github/workflows/publish-release.yml, .github/workflows/publish-snapshot.yml, .github/workflows/release-please.yml, release-please-config.json
Replaced tag-push-driven release triggers with release.published event-based automation. publish-release.yml now triggers on GitHub Release publication and passes explicit release_tag/release_id to _publish.yml. _publish.yml changed from creating releases with generated changelogs to validating and attaching assets to existing GitHub Releases. Removed changelog input/output in favor of release_tag and release_id. Disabled skip-github-release and skip-changelog in release-please config to enable default behaviors.
Release Governance Documentation
CHANGELOG.md, .github/workflows/README.md, clients/web/apps/docs/src/content/docs/guides/release.md, clients/web/apps/docs/src/content/docs/es/guides/release.md, clients/web/apps/docs/src/content/docs/clients/agent-runtime/ci-map.md, clients/web/apps/docs/src/content/docs/es/clients/agent-runtime/ci-map.md
Updated release runbooks, CI maps, and workflow documentation to reflect new ownership model: release-please is sole canonical authority for stable tag, GitHub Release, and release notes; publish-release.yml/_publish.yml execute asset-attachment workflows triggered by release.published. Added governance clarifications and troubleshooting guidance for release-notes drift.
Release Contract Testing
scripts/release-contract.test.mjs
Tightened release governance contract assertions to enforce release-please ownership, validate release_tag/release_id wiring, and reject tag-push stable publication. Added centralized documentation file list for consistency checks across contract docs. Replaced loose ownership checks with stricter multi-assertion validation using new assertIncludesAll helper.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

Possibly related PRs

  • dallay/corvus#451 — Both modify release governance documentation and contract tests to enforce release-please canonical ownership.
  • dallay/corvus#15 — Both restructure CI workflow files and release automation orchestration.
  • dallay/corvus#236 — Both modify release workflows and release-please configuration for stable release control.

Suggested labels

area:ci, risk:high

🚥 Pre-merge checks | ✅ 2
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed Title follows Conventional Commit format with 'fix' prefix and clear description under 72 characters.
Description check ✅ Passed Description covers all key sections: Summary, Tested Information, Documentation Impact, Breaking Changes, and completed Checklist.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch ci/release-please

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 8, 2026

✅ Contributor Report

User: @yacosta738
Status: Passed (12/13 metrics passed)

Metric Description Value Threshold Status
PR Merge Rate PRs merged vs closed 90% >= 30%
Repo Quality Repos with ≥100 stars 0 >= 0
Positive Reactions Positive reactions received 10 >= 1
Negative Reactions Negative reactions received 0 <= 5
Account Age GitHub account age 3085 days >= 30 days
Activity Consistency Regular activity over time 108% >= 0%
Issue Engagement Issues with community engagement 0 >= 0
Code Reviews Code reviews given to others 530 >= 0
Merger Diversity Unique maintainers who merged PRs 2 >= 0
Repo History Merge Rate Merge rate in this repo 91% >= 0%
Repo History Min PRs Previous PRs in this repo 215 >= 0
Profile Completeness Profile richness (bio, followers) 90 >= 0
Suspicious Patterns Spam-like activity detection 1 N/A

Contributor Report evaluates based on public GitHub activity. Analysis period: 2025-04-08 to 2026-04-08

@yacosta738 yacosta738 changed the base branch from main to feat/slack-image-ingestion-329 April 8, 2026 18:58
@yacosta738 yacosta738 closed this Apr 8, 2026
Make release-please the canonical owner of the stable release PR, tag, GitHub Release, and release notes. Trigger stable publishing from release.published so _publish only validates context and attaches artifacts to the existing release.
@yacosta738 yacosta738 reopened this Apr 8, 2026
@yacosta738 yacosta738 changed the base branch from feat/slack-image-ingestion-329 to main April 8, 2026 19:35
@yacosta738 yacosta738 changed the title feat(slack): support inbound image staging fix(release): publish stable artifacts from github releases Apr 8, 2026
@yacosta738 yacosta738 linked an issue Apr 8, 2026 that may be closed by this pull request
6 tasks
@coderabbitai coderabbitai Bot added area:ci and removed area:rust labels Apr 8, 2026
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (3)
clients/web/apps/docs/src/content/docs/es/clients/agent-runtime/ci-map.md (1)

37-61: ⚠️ Potential issue | 🟡 Minor

Actualizar referencia obsoleta de triage (release.yml por tags).

Las líneas nuevas describen release.published, pero en la guía rápida (Line 74) todavía se indica fallo por tags en .github/workflows/release.yml. Eso ya no coincide con el flujo actual.

🛠 Propuesta de corrección
-- `.github/workflows/release.yml` (`Release`)
+- `.github/workflows/publish-release.yml` (`Release`)
...
-3. Failures de Release en tags: inspeccionar `.github/workflows/release.yml`.
+3. Failures de Release después de `release.published`: inspeccionar `.github/workflows/publish-release.yml`.

As per coding guidelines, **/*.{md,mdx}: Verify technical accuracy and that docs stay aligned with code changes.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@clients/web/apps/docs/src/content/docs/es/clients/agent-runtime/ci-map.md`
around lines 37 - 61, Actualizar la referencia obsoleta en el texto que aún dice
que `.github/workflows/release.yml` falla por tags: reemplaza esa mención en la
guía rápida por el evento actual `release.published` (y explica brevemente que
los jobs de publicación usan `publish-release.yml` y `_publish.yml` que se
disparan desde `release.published`), y ajusta cualquier mención de "tags" para
indicar que `release-please` crea el tag canónico `vX.Y.Z` y que la publicación
de assets ocurre después con los workflows mencionados (`release.published`,
`publish-release.yml`, `_publish.yml`).
clients/web/apps/docs/src/content/docs/clients/agent-runtime/ci-map.md (1)

37-60: ⚠️ Potential issue | 🟡 Minor

Fix stale triage reference to tag-based release.yml.

Line 37/Line 55 document the new release.published flow, but Line 73 still points to tag failures in .github/workflows/release.yml. This is now inaccurate and will misroute release triage.

🛠 Proposed doc fix
-- `.github/workflows/release.yml` (`Release`)
+- `.github/workflows/publish-release.yml` (`Release`)
...
-3. Release failures on tags: inspect `.github/workflows/release.yml`.
+3. Release failures after `release.published`: inspect `.github/workflows/publish-release.yml`.

As per coding guidelines, **/*.{md,mdx}: Verify technical accuracy and that docs stay aligned with code changes.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@clients/web/apps/docs/src/content/docs/clients/agent-runtime/ci-map.md`
around lines 37 - 60, The doc still references tag-based
`.github/workflows/release.yml` for release triage; update the "Trigger Map" and
any lines mentioning tag failures to reflect the new release.published flow and
the publish-release.yml/_publish.yml handlers. Specifically, replace mentions of
tag push / tag failures against `release.yml` with the `release.published` event
and note that `publish-release.yml` and `_publish.yml` attach artifacts to the
canonical GitHub Release created by `release-please`; ensure `CI`, `Docker`, and
`Release` bullets consistently reference `release.published` where appropriate.
.github/workflows/_publish.yml (1)

152-159: 🧹 Nitpick | 🔵 Trivial

Redundant semver validation.

The TAG_VERSION format is already validated in the release-context step (line 113-116). This duplicate check at lines 156-159 is harmless but could be removed for clarity since it now reads from an already-validated output.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/_publish.yml around lines 152 - 159, Remove the redundant
semver check that validates TAG_VERSION against the regex (the if [[ !
"$TAG_VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] ... exit 1 block) since the same
validation is already performed in the release-context step; specifically delete
that conditional block which references TAG_VERSION and
steps.release-context.outputs.release_tag and leave the surrounding run: prelude
(set -euo pipefail) and subsequent commands intact so the workflow continues to
use the already-validated release-context output.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@clients/agent-runtime/src/channels/slack.rs`:
- Around line 214-219: The warning log slices file_id using
&file_id[..file_id.len().min(8)] which can panic on multibyte UTF-8 boundaries;
update the closure that maps the error (the map_err block referencing file_id
and self.sanitize_error) to safely truncate file_id at a character boundary—use
file_id.char_indices() (or a helper that finds the byte index of the nth char)
to compute a safe end index (min 8 chars) and then slice with that byte index
when constructing the log message so it cannot panic on non-UTF-8 boundaries.

---

Outside diff comments:
In @.github/workflows/_publish.yml:
- Around line 152-159: Remove the redundant semver check that validates
TAG_VERSION against the regex (the if [[ ! "$TAG_VERSION" =~
^v[0-9]+\.[0-9]+\.[0-9]+$ ]] ... exit 1 block) since the same validation is
already performed in the release-context step; specifically delete that
conditional block which references TAG_VERSION and
steps.release-context.outputs.release_tag and leave the surrounding run: prelude
(set -euo pipefail) and subsequent commands intact so the workflow continues to
use the already-validated release-context output.

In `@clients/web/apps/docs/src/content/docs/clients/agent-runtime/ci-map.md`:
- Around line 37-60: The doc still references tag-based
`.github/workflows/release.yml` for release triage; update the "Trigger Map" and
any lines mentioning tag failures to reflect the new release.published flow and
the publish-release.yml/_publish.yml handlers. Specifically, replace mentions of
tag push / tag failures against `release.yml` with the `release.published` event
and note that `publish-release.yml` and `_publish.yml` attach artifacts to the
canonical GitHub Release created by `release-please`; ensure `CI`, `Docker`, and
`Release` bullets consistently reference `release.published` where appropriate.

In `@clients/web/apps/docs/src/content/docs/es/clients/agent-runtime/ci-map.md`:
- Around line 37-61: Actualizar la referencia obsoleta en el texto que aún dice
que `.github/workflows/release.yml` falla por tags: reemplaza esa mención en la
guía rápida por el evento actual `release.published` (y explica brevemente que
los jobs de publicación usan `publish-release.yml` y `_publish.yml` que se
disparan desde `release.published`), y ajusta cualquier mención de "tags" para
indicar que `release-please` crea el tag canónico `vX.Y.Z` y que la publicación
de assets ocurre después con los workflows mencionados (`release.published`,
`publish-release.yml`, `_publish.yml`).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: fe4a7be6-c951-4c04-bf84-2cf3a5f877ec

📥 Commits

Reviewing files that changed from the base of the PR and between 5bbd4ee and df4f469.

📒 Files selected for processing (14)
  • .github/config/changelog.json
  • .github/workflows/README.md
  • .github/workflows/_publish.yml
  • .github/workflows/publish-release.yml
  • .github/workflows/publish-snapshot.yml
  • .github/workflows/release-please.yml
  • CHANGELOG.md
  • clients/agent-runtime/src/channels/slack.rs
  • clients/web/apps/docs/src/content/docs/clients/agent-runtime/ci-map.md
  • clients/web/apps/docs/src/content/docs/es/clients/agent-runtime/ci-map.md
  • clients/web/apps/docs/src/content/docs/es/guides/release.md
  • clients/web/apps/docs/src/content/docs/guides/release.md
  • release-please-config.json
  • scripts/release-contract.test.mjs
💤 Files with no reviewable changes (3)
  • .github/config/changelog.json
  • .github/workflows/publish-snapshot.yml
  • release-please-config.json
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
  • GitHub Check: sonar
  • GitHub Check: pr-checks
  • GitHub Check: submit-gradle
  • GitHub Check: Cloudflare Pages
🧰 Additional context used
📓 Path-based instructions (6)
**/*.{md,mdx}

⚙️ CodeRabbit configuration file

**/*.{md,mdx}: Verify technical accuracy and that docs stay aligned with code changes.
For user-facing docs, check EN/ES parity or explicitly note pending translation gaps.

Files:

  • CHANGELOG.md
  • clients/web/apps/docs/src/content/docs/clients/agent-runtime/ci-map.md
  • clients/web/apps/docs/src/content/docs/guides/release.md
  • clients/web/apps/docs/src/content/docs/es/clients/agent-runtime/ci-map.md
  • clients/web/apps/docs/src/content/docs/es/guides/release.md
**/*

⚙️ CodeRabbit configuration file

**/*: Security first, performance second.
Validate input boundaries, auth/authz implications, and secret management.
Look for behavioral regressions, missing tests, and contract breaks across modules.

Files:

  • CHANGELOG.md
  • clients/web/apps/docs/src/content/docs/clients/agent-runtime/ci-map.md
  • clients/agent-runtime/src/channels/slack.rs
  • clients/web/apps/docs/src/content/docs/guides/release.md
  • clients/web/apps/docs/src/content/docs/es/clients/agent-runtime/ci-map.md
  • scripts/release-contract.test.mjs
  • clients/web/apps/docs/src/content/docs/es/guides/release.md
clients/agent-runtime/src/channels/**/*.rs

📄 CodeRabbit inference engine (clients/agent-runtime/AGENTS.md)

Implement Channel trait in src/channels/ with consistent send, listen, and health_check semantics and cover auth/allowlist/health behavior with tests

Files:

  • clients/agent-runtime/src/channels/slack.rs
clients/agent-runtime/src/**/*.rs

📄 CodeRabbit inference engine (clients/agent-runtime/AGENTS.md)

clients/agent-runtime/src/**/*.rs: Never log secrets, tokens, raw credentials, or sensitive payloads in any logging statements
Avoid unnecessary allocations, clones, and blocking operations to maintain performance and efficiency

Files:

  • clients/agent-runtime/src/channels/slack.rs
clients/agent-runtime/**/*.rs

📄 CodeRabbit inference engine (clients/agent-runtime/AGENTS.md)

Run cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, and cargo test for code validation, or document which checks were skipped and why

Files:

  • clients/agent-runtime/src/channels/slack.rs
**/*.rs

⚙️ CodeRabbit configuration file

**/*.rs: Focus on Rust idioms, memory safety, and ownership/borrowing correctness.
Flag unnecessary clones, unchecked panics in production paths, and weak error context.
Prioritize unsafe blocks, FFI boundaries, concurrency races, and secret handling.

Files:

  • clients/agent-runtime/src/channels/slack.rs
🧠 Learnings (4)
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/.github/**/*.{yml,yaml} : For workflow/template-only changes, ensure YAML/template syntax validity

Applied to files:

  • clients/web/apps/docs/src/content/docs/clients/agent-runtime/ci-map.md
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/src/main.rs : Preserve CLI contract unless change is intentional and documented; prefer explicit errors over silent fallback for unsupported critical paths

Applied to files:

  • clients/agent-runtime/src/channels/slack.rs
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/*.rs : Run `cargo fmt --all -- --check`, `cargo clippy --all-targets -- -D warnings`, and `cargo test` for code validation, or document which checks were skipped and why

Applied to files:

  • scripts/release-contract.test.mjs
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/Cargo.toml : Preserve release-size profile assumptions in `Cargo.toml` and avoid adding heavy dependencies unless clearly justified

Applied to files:

  • scripts/release-contract.test.mjs
🪛 LanguageTool
CHANGELOG.md

[uncategorized] ~7-~7: The official name of this software platform is spelled with a capital “H”.
Context: ...on starts from release.published, and .github/workflows/_publish.yml only attaches a...

(GITHUB)

clients/web/apps/docs/src/content/docs/guides/release.md

[style] ~138-~138: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...h the expected permissions and token. - Confirm the publish-release.yml trigger saw `...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)


[style] ~144-~144: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...xt passed from publish-release.yml. - Review credential warnings for Maven, Cargo, n...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)

.github/workflows/README.md

[style] ~233-~233: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ... not create the canonical stable tag. - Snapshot publishing does not own GitHub Release ...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)


[style] ~234-~234: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...does not own GitHub Release creation. - Snapshot publishing does not own stable release ...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)


[style] ~235-~235: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ng does not own stable release notes. - Snapshot publishing does not participate in the ...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)

🔇 Additional comments (18)
clients/agent-runtime/src/channels/slack.rs (2)

66-111: Good fail-fast auth handling and listener error propagation

Returning anyhow::Result<String> from get_bot_user_id() and propagating it at Line 412 is the right contract: startup failures are explicit and supervised restart handles retries cleanly.

Also applies to: 412-412


922-963: Tests now correctly pin the new Result behavior

Nice coverage update for ok=false and missing user_id cases; these tests lock in the intended non-silent failure semantics.

.github/workflows/release-please.yml (1)

62-63: Release governance summary update looks correct.

The added bullets match the workflow’s intended ownership/handoff model and do not alter runtime behavior.

CHANGELOG.md (1)

6-7: Changelog release-governance note is aligned.

The updated bullets accurately reflect the new stable release handoff and ownership model.

As per coding guidelines, **/*.{md,mdx}: Verify technical accuracy and that docs stay aligned with code changes.

.github/workflows/publish-release.yml (1)

18-29: Stable publish handoff gating is solid.

The release-event guards plus explicit release_tag/release_id handoff reduce ambiguity and align with canonical release ownership.

clients/web/apps/docs/src/content/docs/guides/release.md (1)

68-72: Runbook contract updates are coherent and operationally clear.

The release handoff, diagnostics, and recovery guidance now consistently match the release-pleaserelease.published → asset attachment model.

As per coding guidelines, **/*.{md,mdx}: Verify technical accuracy and that docs stay aligned with code changes. For user-facing docs, check EN/ES parity or explicitly note pending translation gaps.

Also applies to: 105-112, 136-157

.github/workflows/README.md (1)

185-204: Workflow README reflects the new stable-release contract accurately.

The updated trigger semantics, ownership boundaries, and _publish.yml input contract are consistent and actionable.

As per coding guidelines, **/*.{md,mdx}: Verify technical accuracy and that docs stay aligned with code changes.

Also applies to: 245-262, 283-315

clients/web/apps/docs/src/content/docs/es/guides/release.md (1)

68-72: Buen alineamiento del runbook ES con el contrato de release estable.

La guía en español conserva correctamente el mismo flujo y límites de responsabilidad que la versión EN.

As per coding guidelines, **/*.{md,mdx}: Verify technical accuracy and that docs stay aligned with code changes. For user-facing docs, check EN/ES parity or explicitly note pending translation gaps.

Also applies to: 105-112, 136-157

scripts/release-contract.test.mjs (5)

14-18: LGTM - Clean helper function.

Simple and reusable. Correctly propagates the label for actionable error messages.


20-27: LGTM - Centralized contract doc list.

Good consolidation of paths used by multiple assertions. Keeps test maintenance simpler.


40-42: LGTM - Validates release-please retains full ownership.

These assertions enforce that skip-github-release and skip-changelog are not set, ensuring release-please creates both the GitHub Release and changelog entries. Aligns with the context snippet from release-please-config.json where these keys are absent.


84-145: LGTM - Comprehensive governance contract tests.

The assertions properly validate:

  • release-please.yml creates the canonical GitHub Release
  • publish-release.yml triggers on release.published (not tag push) and passes release_tag/release_id
  • _publish.yml only uploads assets (no softprops/action-gh-release, no changelog builder)
  • Snapshot workflow stays outside stable release ownership

Negative assertions (lines 114-115, 125, 141-144) prevent regression to tag-push or changelog-generation behavior.


165-237: LGTM - Validates documentation aligns with workflow contract.

Tests ensure EN/ES docs, workflow README, and CHANGELOG all describe the release.published handoff model and explicitly reject _publish.yml ownership of canonical release notes. The negative tag push assertions (lines 224-235) prevent documentation drift.

.github/workflows/_publish.yml (5)

10-15: LGTM - Optional inputs for stable release context.

These are correctly optional since the "Resolve stable release context" step (line 99) only runs when inputs.release is true. Callers pass these values correctly per context snippets from publish-release.yml and publish-snapshot.yml.


98-146: Solid validation for stable release context.

Good defense-in-depth:

  1. Requires both release_tag and release_id for stable publishes
  2. Validates vX.Y.Z semver format
  3. Fetches release via API and verifies tag match, rejects drafts/prereleases

One minor note: if gh api fails (e.g., release deleted between trigger and execution), the script exits cleanly due to set -euo pipefail.


313-324: LGTM - Summary clearly documents ownership model.

The summary explicitly states release-please owns the canonical release and _publish.yml only handles artifact publication. Good for audit trail and debugging.


389-392: LGTM - Docker tags derive from validated release context.

Using needs.publish.outputs.release_tag ensures consistent tagging from the validated semver tag rather than raw event data.

Also applies to: 459-462


682-704: LGTM - Asset upload to existing release.

gh release upload --clobber correctly handles:

  • Idempotent retries (overwrites existing assets on re-run)
  • Attaching to canonical release owned by release-please

The glob patterns dist/corvus/corvus-* and dist/cerebro/cerebro-* match the downloaded artifacts from earlier steps. Summary correctly documents the ownership handoff.

Comment on lines +214 to +219
.map_err(|err| {
tracing::warn!(
"Slack file metadata fetch failed for {}: {}",
&file_id[..file_id.len().min(8)],
self.sanitize_error(&err)
);
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify presence of potentially unsafe byte slicing on &str across Rust sources.
# Expected: no production paths using direct byte slicing on &str without boundary checks.
rg -nP --type rust -C2 '&\w+\[\.\.[^\]]+\]|&\w+\[[^\]]+\.\.\]'

Repository: dallay/corvus

Length of output: 32370


🏁 Script executed:

cd clients/agent-runtime && sed -n '210,225p' src/channels/slack.rs

Repository: dallay/corvus

Length of output: 749


Fix unsafe byte slicing on file_id that can panic on non-UTF-8 boundaries

At line 217, &file_id[..file_id.len().min(8)] panics if the 8th byte falls in the middle of a UTF-8 character sequence. This is an unchecked panic in a production error path.

Use char_indices() to safely truncate at character boundaries:

Proposed fix
.map_err(|err| {
+    let file_id_prefix = file_id
+        .char_indices()
+        .nth(8)
+        .map(|(idx, _)| &file_id[..idx])
+        .unwrap_or(file_id);
     tracing::warn!(
         "Slack file metadata fetch failed for {}: {}",
-        &file_id[..file_id.len().min(8)],
+        file_id_prefix,
         self.sanitize_error(&err)
     );
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
.map_err(|err| {
tracing::warn!(
"Slack file metadata fetch failed for {}: {}",
&file_id[..file_id.len().min(8)],
self.sanitize_error(&err)
);
.map_err(|err| {
let file_id_prefix = file_id
.char_indices()
.nth(8)
.map(|(idx, _)| &file_id[..idx])
.unwrap_or(file_id);
tracing::warn!(
"Slack file metadata fetch failed for {}: {}",
file_id_prefix,
self.sanitize_error(&err)
);
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@clients/agent-runtime/src/channels/slack.rs` around lines 214 - 219, The
warning log slices file_id using &file_id[..file_id.len().min(8)] which can
panic on multibyte UTF-8 boundaries; update the closure that maps the error (the
map_err block referencing file_id and self.sanitize_error) to safely truncate
file_id at a character boundary—use file_id.char_indices() (or a helper that
finds the byte index of the nth char) to compute a safe end index (min 8 chars)
and then slice with that byte index when constructing the log message so it
cannot panic on non-UTF-8 boundaries.

@yacosta738 yacosta738 merged commit d3bfae0 into main Apr 8, 2026
12 of 14 checks passed
@yacosta738 yacosta738 deleted the ci/release-please branch April 8, 2026 20:23
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Apr 8, 2026

Quality Gate Failed Quality Gate failed

Failed conditions
70.6% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

This was referenced Apr 11, 2026
@dallay-bot dallay-bot Bot mentioned this pull request Apr 19, 2026
@dallay-bot dallay-bot Bot mentioned this pull request May 1, 2026
@dallay-bot dallay-bot Bot mentioned this pull request May 3, 2026
@dallay-bot dallay-bot Bot mentioned this pull request May 6, 2026
This was referenced May 10, 2026
@dallay-bot dallay-bot Bot mentioned this pull request May 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat: Slack image ingestion

1 participant