fix(release): sync internal dependency versions in release PRs#722
Merged
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a canonical internal-release-dependencies contract, a new Node CLI to validate/sync versioned Rust path dependencies ( Changes
Sequence Diagram(s)sequenceDiagram
participant GH as GitHub Actions Runner
participant RP as release-please Action
participant SY as sync-internal-release-deps.mjs
participant GL as Cargo.lock regen / Rust checks
participant Git as Git remote
GH->>RP: run release-please (update manifests)
RP-->>GH: release-please updated manifests
GH->>SY: run sync-internal-release-deps.mjs --write
SY-->>GH: report changes / write updated Cargo.toml(s)
GH->>Git: git add staged manifests
alt staged changes exist
GH->>Git: commit & push synced manifests
else no staged changes
GH-->>GH: skip commit
end
GH->>GL: regenerate Cargo.lock & run Rust validation
GL-->>GH: lockfiles updated / validations
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
✅ Contributor ReportUser: @yacosta738
Contributor Report evaluates based on public GitHub activity. Analysis period: 2025-04-29 to 2026-04-29 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release-please-beta.yml:
- Around line 91-94: After running node scripts/sync-internal-release-deps.mjs
--write, add a step that configures git (git config user.name/email), stages the
changed Cargo.toml files (git add), and conditionally commits and pushes them
(use SKIP_GIT_HOOKS=1, check git diff --cached --quiet and if not empty run git
commit -m "chore: sync internal release dependencies" and git push). Ensure the
step references the same script name sync-internal-release-deps.mjs and only
commits when there are staged changes to persist the modifications made by the
script.
In @.github/workflows/release-please.yml:
- Around line 90-93: The "🔁 Sync internal release dependencies" step runs
scripts/sync-internal-release-deps.mjs which updates Cargo.toml but never
commits or pushes those changes; add a follow-up step that stages the modified
files, creates a descriptive commit (e.g. "chore: sync internal release deps"),
and pushes the branch (or use git config user.name/email and force-with-lease if
needed) immediately after that run step so the updated pins are persisted, or
alternatively move the sync step to run before the release-please action if you
prefer the changes to be included in the release PR.
In @.github/workflows/sync-cargo-lockfiles.yml:
- Around line 63-66: The workflow runs node
scripts/sync-internal-release-deps.mjs --write which mutates
clients/agent-runtime/Cargo.toml, but the subsequent commit only stages the two
Cargo.lock files; update the commit step (the one after the "🔁 Sync internal
release dependencies" run) to also git add the rewritten manifest
(clients/agent-runtime/Cargo.toml) or simply git add -A (or git add .) so the
mutated Cargo.toml is included in the commit alongside the Cargo.lock files.
In `@openspec/changes/release-internal-dependency-sync/design.md`:
- Around line 30-53: The doc uses snake_case names internal_release_dependency
and version_selector but the implemented contract and validator use camelCase
internalReleaseDependencies and versionSelector; update the design text to use
the actual config field names (internalReleaseDependencies and versionSelector)
everywhere (including the example block and field list) so the spec matches the
code and validator naming exactly.
In `@openspec/changes/release-internal-dependency-sync/tasks.md`:
- Around line 11-19: Update the task spec to use the canonical config key name
`internalReleaseDependencies` (instead of `internal_release_dependencies`) so it
matches the actual schema in `config/release-components.json`; update all
references in the phase list (e.g., step "1.4" and any mentions in steps
"2.1"/"2.2") and ensure the script `scripts/sync-internal-release-deps.mjs`
check/write behavior and tests are described with `internalReleaseDependencies`
to prevent implementation drift.
In `@scripts/release-contract.test.mjs`:
- Around line 149-185: Add tests to cover failure paths for the internal release
dependency sync contract: create new tests in scripts/release-contract.test.mjs
that manipulate the test graph or fixture manifests and call
runInternalReleaseSync (and readJson if needed) to assert failure behaviors for
drift (version mismatch), path-mismatch (dependencyPath mismatch), missing-entry
(an expected internalReleaseDependency absent from manifest), and unmanaged-edge
(an edge present in manifest but not declared in internalReleaseDependencies).
For each case, assert runInternalReleaseSync(["--check"]) returns a
non-success/error message describing the specific problem and that
runInternalReleaseSync(["--write"]) either reports fixes where applicable or
still fails when it cannot auto-fix; reuse existing helpers used in other tests
(runInternalReleaseSync, readJson, the internalReleaseDependencies fixture) and
mirror the style of current assertions (assert.match / assert.deepEqual) so
these regressions are covered.
In `@scripts/sync-internal-release-deps.mjs`:
- Around line 75-127: The script only updates edges present in
graph.internalReleaseDependencies and always uses extractPackageVersion
(package.version) and ignores versionSelector; update
sync-internal-release-deps.mjs to (1) scan each component manifest (using
readText and the existing dependency/block helpers: extractDependencyBlock and
extractField) for internal path dependencies that are not present in
graph.internalReleaseDependencies and treat them as unmanaged edges (fail in
mode === "check" with a clear message and report them in changes when writing),
and (2) honor the configured version selector for each upstream component when
resolving expectedVersion (use the selector from the component metadata in
loadReleaseComponents() instead of always calling extractPackageVersion; you may
add a helper that applies versionSelector to upstream manifest content), then
continue to validate path equality (edge.dependencyPath vs actualPath) and
update via updateVersionInBlock/writeText as before; reference symbols:
loadReleaseComponents, graph.internalReleaseDependencies, extractPackageVersion,
extractDependencyBlock, extractField, updateVersionInBlock, readText, writeText,
mode, edge.manifestPath, edge.dependencyName, edge.dependencyPath.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 1297548a-3a95-43f1-8d3b-d48e985b6d45
📒 Files selected for processing (14)
.github/workflows/pull-request-check.yml.github/workflows/release-please-beta.yml.github/workflows/release-please.yml.github/workflows/sync-cargo-lockfiles.ymlclients/web/apps/docs/src/content/docs/es/guides/release.mdclients/web/apps/docs/src/content/docs/guides/release.mdconfig/release-components.jsonopenspec/changes/release-internal-dependency-sync/design.mdopenspec/changes/release-internal-dependency-sync/proposal.mdopenspec/changes/release-internal-dependency-sync/state.yamlopenspec/changes/release-internal-dependency-sync/tasks.mdscripts/release-components.mjsscripts/release-contract.test.mjsscripts/sync-internal-release-deps.mjs
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: pr-checks
- GitHub Check: sonar
- GitHub Check: submit-gradle
- GitHub Check: Cloudflare Pages
🧰 Additional context used
📓 Path-based instructions (2)
**/*.{md,mdx}
⚙️ CodeRabbit configuration file
**/*.{md,mdx}: Verify technical accuracy and that docs stay aligned with code changes.
For user-facing docs, check EN/ES parity or explicitly note pending translation gaps.
Files:
openspec/changes/release-internal-dependency-sync/tasks.mdclients/web/apps/docs/src/content/docs/es/guides/release.mdclients/web/apps/docs/src/content/docs/guides/release.mdopenspec/changes/release-internal-dependency-sync/proposal.mdopenspec/changes/release-internal-dependency-sync/design.md
**/*
⚙️ CodeRabbit configuration file
**/*: Security first, performance second.
Validate input boundaries, auth/authz implications, and secret management.
Look for behavioral regressions, missing tests, and contract breaks across modules.
Files:
openspec/changes/release-internal-dependency-sync/tasks.mdscripts/sync-internal-release-deps.mjsopenspec/changes/release-internal-dependency-sync/state.yamlscripts/release-components.mjsclients/web/apps/docs/src/content/docs/es/guides/release.mdclients/web/apps/docs/src/content/docs/guides/release.mdopenspec/changes/release-internal-dependency-sync/proposal.mdscripts/release-contract.test.mjsconfig/release-components.jsonopenspec/changes/release-internal-dependency-sync/design.md
🧠 Learnings (6)
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/.github/**/*.{yml,yaml} : For workflow/template-only changes, ensure YAML/template syntax validity
Applied to files:
.github/workflows/pull-request-check.yml
📚 Learning: 2026-04-25T06:56:44.008Z
Learnt from: yacosta738
Repo: dallay/corvus PR: 0
File: :0-0
Timestamp: 2026-04-25T06:56:44.008Z
Learning: In release-please configuration files (`release-please-config.json`, `release-please-beta-config.json`), each entry under `extra-files` supports only a single `jsonpath` string per object — not a list of selectors. When multiple fields in the same file need to be updated (e.g., multiple `optionalDependencies` entries in a `package.json`), the correct approach is to repeat the file path entry with a different `jsonpath` per object. This is intentional and required by the release-please schema.
Applied to files:
scripts/release-components.mjs
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/Cargo.toml : Preserve release-size profile assumptions in `Cargo.toml` and avoid adding heavy dependencies unless clearly justified
Applied to files:
clients/web/apps/docs/src/content/docs/guides/release.mdconfig/release-components.jsonopenspec/changes/release-internal-dependency-sync/design.md
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/*.rs : Run `cargo fmt --all -- --check`, `cargo clippy --all-targets -- -D warnings`, and `cargo test` for code validation, or document which checks were skipped and why
Applied to files:
clients/web/apps/docs/src/content/docs/guides/release.md
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/Cargo.toml : Do not add heavy dependencies for minor convenience; justify new crate additions
Applied to files:
config/release-components.jsonopenspec/changes/release-internal-dependency-sync/design.md
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/src/main.rs : Preserve CLI contract unless change is intentional and documented; prefer explicit errors over silent fallback for unsupported critical paths
Applied to files:
openspec/changes/release-internal-dependency-sync/design.md
🔇 Additional comments (7)
.github/workflows/pull-request-check.yml (1)
124-129: Good early gate placement.This catches internal dependency drift before the heavier Rust metadata checks, and it keeps the existing bot-skip behavior consistent with the rest of the job.
config/release-components.json (1)
72-83: The new internal dependency edge looks consistent.The
corvus-runtime -> cerebroedge matches the validator contract and the referenced components already exist in the graph, so this should load cleanly.openspec/changes/release-internal-dependency-sync/proposal.md (1)
1-81: The proposal is clear and aligned with the implementation.The scope, risks, rollback, and success criteria all match the new check/write contract and workflow ordering.
scripts/release-components.mjs (1)
6-16: Validator wiring looks solid.The new mode export and graph validation fail closed on malformed or unknown internal dependency edges, which is the right contract for the sync script.
Also applies to: 28-62, 79-80, 133-137
clients/web/apps/docs/src/content/docs/guides/release.md (1)
45-45: Runbook updates are technically on target.The new sync step and the drift-troubleshooting section line up with the new release-contract behavior and distinguish it from generic lockfile failures.
Also applies to: 75-77, 205-209
clients/web/apps/docs/src/content/docs/es/guides/release.md (1)
45-45: Spanish runbook stays aligned with the release workflow.The new sync step, lockfile ordering, and drift troubleshooting match the updated release contract.
Also applies to: 78-80, 238-243
openspec/changes/release-internal-dependency-sync/state.yaml (1)
1-25: Planned rollout metadata looks consistent.The phase state and artifact list match a change that is still gated behind apply/verify.
Deploying corvus with
|
| Latest commit: |
92baee4
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://c783e365.corvus-42x.pages.dev |
| Branch Preview URL: | https://fix-internal-release-depende.corvus-42x.pages.dev |
github-actions
Bot
added
size/xl
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
♻️ Duplicate comments (1)
scripts/sync-internal-release-deps.mjs (1)
113-133:⚠️ Potential issue | 🟠 MajorScan every release-managed Cargo manifest for unmanaged internal edges.
manifestTextsis seeded only fromedge.manifestPath, so a brand-new versioned internal path dependency in another managed manifest is never inspected and can bypass the fail-closed check until someone also adds a contract entry.Suggested fix
const manifestTexts = new Map(); -for (const edge of graph.internalReleaseDependencies) { - if (!manifestTexts.has(edge.manifestPath)) { - manifestTexts.set(edge.manifestPath, readText(edge.manifestPath)); - } +for (const component of Object.values(graph.components)) { + for (const versionSurface of component.versionSurfaces ?? []) { + if (versionSurface.endsWith("Cargo.toml") && !manifestTexts.has(versionSurface)) { + manifestTexts.set(versionSurface, readText(versionSurface)); + } + } }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/sync-internal-release-deps.mjs` around lines 113 - 133, The code only seeds manifestTexts from graph.internalReleaseDependencies' edge.manifestPath, so manifests that only contain newly added versioned internal path dependencies (and not yet present in internalReleaseDependencies) are never scanned; change the seeding so you collect every release-managed Cargo manifest (e.g., iterate graph.manifests or otherwise gather all manifest paths under releaseManagedPathPrefixes) instead of only edge.manifestPath, then call collectInternalPathDependencies(manifestText) for each to detect unmanaged edges; keep the existing checks that use releaseManagedPathPrefixes, managedEdges and edgeKey(manifestPath, dependency.dependencyName) so newly-added manifests are inspected and the fail-closed behavior is enforced.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/sync-cargo-lockfiles.yml:
- Line 83: The git add invocation in .github/workflows/sync-cargo-lockfiles.yml
currently hardcodes three manifests and will miss future rewrites; change the
staging step (the git add command) to add all updated Cargo.toml and Cargo.lock
files produced by sync-internal-release-deps.mjs, e.g. replace the explicit file
list with a recursive pattern such as git add -- clients/**/*.Cargo.toml
clients/**/*.Cargo.lock or use git add -A (or git add --all) after the script
runs so any newly rewritten manifests are committed without needing workflow
edits.
In
`@openspec/changes/archive/2026-04-29-release-internal-dependency-sync/state.yaml`:
- Around line 4-19: The state metadata is stale: update the top-level status
value from "planned" to "completed" and set phases.apply.status and
phases.verify.status from "pending" to "completed" so the YAML reflects the
archive's PASS verify report; change the "status" key and the
"phases.apply.status" and "phases.verify.status" entries accordingly.
In
`@openspec/changes/archive/2026-04-29-release-internal-dependency-sync/verify-report.md`:
- Line 77: The follow-up sentence "Archive should be retried after this report
is accepted so delta specs can be synced into
`openspec/specs/release-management/*`." in verify-report.md is outdated; either
remove that line or replace it with the correct post-merge action reflecting the
current archived state (e.g., no retry needed or a different sync step), and
ensure the updated text accurately references the delta spec sync workflow and
the `openspec/specs/release-management/*` path if relevant.
In `@scripts/release-contract.test.mjs`:
- Around line 220-279: Tests hard-code the cerebro crate version ("3.6.2") which
drifts; update all tests in scripts/release-contract.test.mjs that replace or
assert on that literal to use the shared releaseVersion value instead. Locate
usages inside withPatchedFile and assertions that reference "3.6.2" (and the
expected regexes like /3\.6\.2/ or the replacement string '0.0.0 -> 3.6.2') and
build those replacement strings and regexes dynamically from releaseVersion
(e.g., construct the replacement line passed to withPatchedFile and the expected
match patterns for assert.match using releaseVersion), keeping existing calls to
runInternalReleaseSync, runInternalReleaseSyncFailure and readText unchanged.
Ensure regex escapes are generated for dots when creating assertions from
releaseVersion.
- Around line 360-362: The test "openspec design and tasks use canonical
internalReleaseDependencies naming" fails because readText() is pointing at the
old paths; update the two readText calls that set design and tasks to use the
archived OpenSpec paths (replace
"openspec/changes/release-internal-dependency-sync/..." with
"openspec/changes/archive/2026-04-29-release-internal-dependency-sync/...") so
the variables design and tasks load the archived design.md and tasks.md
correctly before the assertions run.
---
Duplicate comments:
In `@scripts/sync-internal-release-deps.mjs`:
- Around line 113-133: The code only seeds manifestTexts from
graph.internalReleaseDependencies' edge.manifestPath, so manifests that only
contain newly added versioned internal path dependencies (and not yet present in
internalReleaseDependencies) are never scanned; change the seeding so you
collect every release-managed Cargo manifest (e.g., iterate graph.manifests or
otherwise gather all manifest paths under releaseManagedPathPrefixes) instead of
only edge.manifestPath, then call collectInternalPathDependencies(manifestText)
for each to detect unmanaged edges; keep the existing checks that use
releaseManagedPathPrefixes, managedEdges and edgeKey(manifestPath,
dependency.dependencyName) so newly-added manifests are inspected and the
fail-closed behavior is enforced.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9c3d356e-be29-4d8d-b52c-c14b06c1566b
📒 Files selected for processing (13)
.github/workflows/release-please-beta.yml.github/workflows/release-please.yml.github/workflows/sync-cargo-lockfiles.ymlconfig/release-components.jsonopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/design.mdopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/proposal.mdopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/specs/release-management/spec.mdopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/state.yamlopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/tasks.mdopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/verify-report.mdopenspec/specs/release-management/spec.mdscripts/release-contract.test.mjsscripts/sync-internal-release-deps.mjs
📜 Review details
🧰 Additional context used
📓 Path-based instructions (2)
**/*
⚙️ CodeRabbit configuration file
**/*: Security first, performance second.
Validate input boundaries, auth/authz implications, and secret management.
Look for behavioral regressions, missing tests, and contract breaks across modules.
Files:
openspec/changes/archive/2026-04-29-release-internal-dependency-sync/state.yamlopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/proposal.mdopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/verify-report.mdconfig/release-components.jsonopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/tasks.mdopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/specs/release-management/spec.mdopenspec/specs/release-management/spec.mdopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/design.mdscripts/sync-internal-release-deps.mjsscripts/release-contract.test.mjs
**/*.{md,mdx}
⚙️ CodeRabbit configuration file
**/*.{md,mdx}: Verify technical accuracy and that docs stay aligned with code changes.
For user-facing docs, check EN/ES parity or explicitly note pending translation gaps.
Files:
openspec/changes/archive/2026-04-29-release-internal-dependency-sync/proposal.mdopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/verify-report.mdopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/tasks.mdopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/specs/release-management/spec.mdopenspec/specs/release-management/spec.mdopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/design.md
🧠 Learnings (7)
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/Cargo.toml : Preserve release-size profile assumptions in `Cargo.toml` and avoid adding heavy dependencies unless clearly justified
Applied to files:
config/release-components.jsonopenspec/specs/release-management/spec.mdopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/design.md.github/workflows/sync-cargo-lockfiles.yml
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/Cargo.toml : Do not add heavy dependencies for minor convenience; justify new crate additions
Applied to files:
config/release-components.jsonopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/design.md.github/workflows/sync-cargo-lockfiles.yml
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Keep changes local and avoid cross-module refactors in unrelated tasks to maintain code stability
Applied to files:
openspec/changes/archive/2026-04-29-release-internal-dependency-sync/tasks.md
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/.github/**/*.{yml,yaml} : For workflow/template-only changes, ensure YAML/template syntax validity
Applied to files:
.github/workflows/release-please-beta.yml.github/workflows/sync-cargo-lockfiles.yml
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/src/main.rs : Preserve CLI contract unless change is intentional and documented; prefer explicit errors over silent fallback for unsupported critical paths
Applied to files:
openspec/changes/archive/2026-04-29-release-internal-dependency-sync/design.md
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/*.rs : Run `cargo fmt --all -- --check`, `cargo clippy --all-targets -- -D warnings`, and `cargo test` for code validation, or document which checks were skipped and why
Applied to files:
.github/workflows/sync-cargo-lockfiles.ymlscripts/sync-internal-release-deps.mjsscripts/release-contract.test.mjs
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Include threat/risk notes and rollback strategy for security, runtime, and gateway changes; add or update tests for boundary checks and failure modes
Applied to files:
scripts/release-contract.test.mjs
🔇 Additional comments (5)
.github/workflows/release-please.yml (1)
90-109: Sync-and-persist flow looks correct.The workflow now rewrites internal pins and persists only when staged changes exist, which avoids no-op commits and preserves deterministic behavior.
.github/workflows/release-please-beta.yml (1)
91-110: Beta workflow parity is solid.The added sync + conditional commit/push block matches stable-release behavior and correctly persists rewritten manifests only when needed.
config/release-components.json (1)
72-83: Canonical internal edge declaration looks correct.The new
internalReleaseDependenciesentry is complete and consistent with the sync/validation contract.openspec/specs/release-management/spec.md (1)
159-214: Spec additions align with implementation.The new requirements/scenarios correctly codify
--check/--writebehavior and persistence expectations in stable/beta/lockfile workflows.openspec/changes/archive/2026-04-29-release-internal-dependency-sync/proposal.md (1)
1-81: Proposal is clear and well-scoped.Intent, scope boundaries, risks, rollback, and success signals are consistent with the implemented automation.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/sync-cargo-lockfiles.yml:
- Line 83: The git add pathspecs are wrong: replace the glob patterns
"clients/**/*.Cargo.toml" and "clients/**/*.Cargo.lock" with
"clients/**/Cargo.toml" and "clients/**/Cargo.lock" in the workflow step that
runs git add (the line containing git add --all -- clients/**/*.Cargo.toml
clients/**/*.Cargo.lock) so the actual Cargo.toml/Cargo.lock files are matched;
also update the matching assertion in scripts/release-contract.test.mjs to use
the same corrected patterns ("clients/**/Cargo.toml" and
"clients/**/Cargo.lock").
In
`@openspec/changes/archive/2026-04-29-release-internal-dependency-sync/verify-report.md`:
- Around line 32-60: The markdown headings beginning with "#### Scenario:"
(e.g., "#### Scenario: Aligned internal release dependency passes validation",
"#### Scenario: Drifted internal release dependency is repaired in write mode",
etc.) need a blank line after each heading so markdownlint stops flagging them;
update the document by inserting a single empty line between every "####
Scenario: ..." heading line and the following list/paragraph content throughout
the file (including the Requirement and Scenario sections) to ensure proper
markdown spacing.
In `@scripts/sync-internal-release-deps.mjs`:
- Around line 111-137: The unmanaged-edge check currently tests dependency.path
prefixes directly (releaseManagedPathPrefixes) which misses sibling client
references like "../cerebro"; update the check to resolve dependency.path
relative to manifestPath before testing: for each dependency from
collectInternalPathDependencies, compute the normalized target path by resolving
path.dirname(manifestPath) + dependency.path (use
path.resolve/path.posix.resolve) and then test whether that resolved/normalized
path is under the clients/ tree (e.g., startsWith("clients/") or otherwise
matches the patterns used to build releaseManagedManifestPaths) instead of
matching the raw dependency.path; keep using
managedEdges.has(edgeKey(manifestPath, dependency.dependencyName)) for the final
existence check.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9c84f4fa-7863-414c-bcd2-f52f115e4b99
📒 Files selected for processing (5)
.github/workflows/sync-cargo-lockfiles.ymlopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/state.yamlopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/verify-report.mdscripts/release-contract.test.mjsscripts/sync-internal-release-deps.mjs
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: sonar
- GitHub Check: pr-checks
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: submit-gradle
- GitHub Check: Cloudflare Pages
🧰 Additional context used
📓 Path-based instructions (2)
**/*
⚙️ CodeRabbit configuration file
**/*: Security first, performance second.
Validate input boundaries, auth/authz implications, and secret management.
Look for behavioral regressions, missing tests, and contract breaks across modules.
Files:
openspec/changes/archive/2026-04-29-release-internal-dependency-sync/state.yamlopenspec/changes/archive/2026-04-29-release-internal-dependency-sync/verify-report.mdscripts/sync-internal-release-deps.mjsscripts/release-contract.test.mjs
**/*.{md,mdx}
⚙️ CodeRabbit configuration file
**/*.{md,mdx}: Verify technical accuracy and that docs stay aligned with code changes.
For user-facing docs, check EN/ES parity or explicitly note pending translation gaps.
Files:
openspec/changes/archive/2026-04-29-release-internal-dependency-sync/verify-report.md
🧠 Learnings (5)
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/*.rs : Run `cargo fmt --all -- --check`, `cargo clippy --all-targets -- -D warnings`, and `cargo test` for code validation, or document which checks were skipped and why
Applied to files:
.github/workflows/sync-cargo-lockfiles.ymlscripts/sync-internal-release-deps.mjsscripts/release-contract.test.mjs
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/.github/**/*.{yml,yaml} : For workflow/template-only changes, ensure YAML/template syntax validity
Applied to files:
.github/workflows/sync-cargo-lockfiles.yml
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/Cargo.toml : Preserve release-size profile assumptions in `Cargo.toml` and avoid adding heavy dependencies unless clearly justified
Applied to files:
.github/workflows/sync-cargo-lockfiles.ymlscripts/release-contract.test.mjs
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/**/Cargo.toml : Do not add heavy dependencies for minor convenience; justify new crate additions
Applied to files:
.github/workflows/sync-cargo-lockfiles.yml
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Include threat/risk notes and rollback strategy for security, runtime, and gateway changes; add or update tests for boundary checks and failure modes
Applied to files:
scripts/release-contract.test.mjs
🪛 LanguageTool
openspec/changes/archive/2026-04-29-release-internal-dependency-sync/verify-report.md
[uncategorized] ~55-~55: The official name of this software platform is spelled with a capital “H”.
Context: ...e: scripts/release-contract.test.mjs, .github/workflows/release-please.yml, `.github...
(GITHUB)
🪛 markdownlint-cli2 (0.22.1)
openspec/changes/archive/2026-04-29-release-internal-dependency-sync/verify-report.md
[warning] 32-32: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 37-37: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 42-42: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 47-47: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 54-54: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 59-59: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
Complete SDD cycle for Rook Phase 1 production baseline: - Merge 6 production requirements into gateway spec (292 lines) - Archive change with full traceability - 20/20 spec scenarios verified - 42/42 tasks completed - 360 tests passing Requirements added: - Effective Rook configuration assembly and export - Config export redaction for secrets - Rook doctor deterministic diagnostics - Readiness/liveness health endpoints - Backward-compatible base health endpoint - Baseline metrics exposure for gateway operations
Archive cerebro-add-release-smoke-test-for-real-server-startup-692: - Add Linux release binary startup smoke validation to gateway spec - 6/6 spec scenarios verified compliant - 9/9 tasks completed - Real server startup validation in CI with health/readiness probes - MCP authentication testing with proper cleanup Archive release-component-graph-design: - Formalize release-component graph model with 8 requirements - Update 6 release-management specs with graph-backed semantics - 30+ Given/When/Then scenarios covering all resolution paths - Transitive dependency expansion and publish policy enforcement - Documentation-first phase complete (100% task completion) Both changes: PASS verification, 0 critical issues, 0 warnings
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issues
clients/cerebroandclients/agent-runtime.Summary
internalReleaseDependenciescontract plus a newscripts/sync-internal-release-deps.mjstool to validate and normalize versioned internal path dependencies.release-pleaseworkflows, and Cargo lockfile regeneration so release PRs repair drift before lockfiles and heavier Rust validation fail.Tested Information
node --test scripts/release-contract.test.mjs.node scripts/sync-internal-release-deps.mjs --check.node scripts/sync-internal-release-deps.mjs --write.cargo metadata --manifest-path clients/agent-runtime/Cargo.toml --locked --format-version 1 --no-deps.cargo metadata --manifest-path clients/cerebro/Cargo.toml --locked --format-version 1 --no-deps.Documentation Impact
clients/web/apps/docs/src/content/docs/guides/release.mdclients/web/apps/docs/src/content/docs/es/guides/release.mdopenspec/changes/release-internal-dependency-sync/proposal.mdopenspec/changes/release-internal-dependency-sync/design.mdopenspec/changes/release-internal-dependency-sync/tasks.mdopenspec/changes/release-internal-dependency-sync/state.yamlBreaking Changes
Checklist