release: merge dev into main (v0.46.2, module signing CI) by djm81 · Pull Request #506 · nold-ai/specfact-cli

djm81 · 2026-04-14T22:58:12Z

Summary

v0.46.2 — version bump across canonical sources + changelog.
CI: require --require-signature for all PRs targeting main (pr-orchestrator, sign-modules) so post-merge main verify matches PR verify.
Modules: init and related signing/version-bump fixes (including locally signed manifests on dev).

Checklist

Verify Verify Module Signatures and full orchestrator are green on this PR.
Confirm init (and other bundled modules) have valid integrity.signature before merge.

Made with Cursor

) * fix(backlog): restore installed runtime discovery and add backlog prompt * Archive bugfix change * fix(version): sync built-in module manifests to 0.36.1 --------- Co-authored-by: Dominikus Nold <djm81@users.noreply.github.com>

* fix: harden module lifecycle bootstrap and signing workflows * fix: stabilize module signature hashing across environments * fix: stabilize bundle module signature verification in CI --------- Co-authored-by: Dominikus Nold <djm81@users.noreply.github.com>

…ions

…ics (#311) * fix(backlog): harden refine writeback, prompts, and daily any filters * fix(github): default story type fallback to feature * Fix format * Fix codex review findings * bump and sign changed modules * chore(hooks): enforce module signature verification in pre-commit * chore(hooks): add markdownlint to pre-commit checks --------- Co-authored-by: Dominikus Nold <djm81@users.noreply.github.com>

… tweaks

Keep dev versions for all conflicted paths (--ours). Retain auto-merged non-conflicting updates from main (notably adapter/analyzer tests). Made-with: Cursor

Use diff-filter ACMRD so deletion-only commits are not treated as empty safe changes. Restrict markdown and code-review paths to existing files. Made-with: Cursor

…503) * feat(ci): sign modules on PR approval and manual dispatch - Add sign-modules-on-approval workflow (approved reviews, dev/main base) - Extend sign-modules.yml with workflow_dispatch inputs and sign-and-push job - Document flows in module-security.md; update CHANGELOG and tests Made-with: Cursor * Fix sign review and process --------- Co-authored-by: Dominikus Nold <djm81@users.noreply.github.com>

* feat(ci): sign modules on PR approval and manual dispatch - Add sign-modules-on-approval workflow (approved reviews, dev/main base) - Extend sign-modules.yml with workflow_dispatch inputs and sign-and-push job - Document flows in module-security.md; update CHANGELOG and tests Made-with: Cursor * Fix sign review and process * Fix signature flow * Fix review gate findings * Fix review gate findings --------- Signed-off-by: Dom <39115308+djm81@users.noreply.github.com> Co-authored-by: Dominikus Nold <djm81@users.noreply.github.com>

- Add sign-on-dispatch job with base_branch/version_bump inputs and merge-base signing - Rename approval job to sign-on-approval; fix concurrency for manual runs - Document default-branch vs Run workflow on dev; update tests and CHANGELOG - Refactor workflow tests to satisfy code-review complexity gate Made-with: Cursor Co-authored-by: Dominikus Nold <djm81@users.noreply.github.com>

Align VERIFY_ARGS order; use immutable PR base SHA and branch checkout for approval signing; make PyPI ahead-of-registry check lenient on network failures in PR jobs. Refactor workflow policy tests for radon complexity; add beartype and icontract to the PyPI check script; restore init manifest signature field where applicable. Made-with: Cursor

The prior commit added integrity.signature without incrementing the module version, so sign-modules verify failed (same 0.1.27 vs HEAD~1). Refresh checksum; CI will re-add signatures via Module Signature Hardening workflow_dispatch. Made-with: Cursor

Bump patch version across canonical sources. Tighten pr-orchestrator and sign-modules verify so every PR targeting main uses --require-signature, matching the post-merge main push gate. Made-with: Cursor

coderabbitai · 2026-04-14T22:58:32Z

Warning

Rate limit exceeded

@djm81 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 3 minutes and 46 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 3 minutes and 46 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 130b4ad2-86f2-4a1f-937a-5015a1da990e

📥 Commits

Reviewing files that changed from the base of the PR and between 7962a6a and 55c4c97.

📒 Files selected for processing (9)

.github/workflows/pr-orchestrator.yml
.github/workflows/sign-modules.yml
CHANGELOG.md
pyproject.toml
setup.py
src/__init__.py
src/specfact_cli/__init__.py
src/specfact_cli/modules/init/module-package.yaml
tests/unit/specfact_cli/registry/test_signing_artifacts.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dev

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

enforce-version-bump compares changed manifests to origin/main; signing-only changes on 0.1.28 still failed. Re-sign integrity.signature locally after pull. Made-with: Cursor

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1ceddabe18

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

djm81 and others added 30 commits February 23, 2026 10:52

Merge branch 'main' into dev

37a4a30

Merge branch 'dev' of https://github.com/nold-ai/specfact-cli into dev

991d568

test: simplify monkeypatch callables in module_security tests

a819852

Merge branch 'main' into dev

67cd7e9

Fix duplicate with statement

078012f

Merge branch 'main' into dev

fa0604a

chore(release): bump to v0.37.1 and harden signature gates

c3f5bb6

test: fix init command regression assertions

c0692e9

Merge branch 'main' into dev

7787ba7

fix: release v0.37.2 with runtime crypto deps

db8d153

fix: address signature-backend warning and module version drift

cce4cf7

fix: use hatch build in PyPI publish workflow script (#304)

297fb6c

Merge branch 'main' into dev

e63669c

fix: resolve startup module freshness home path dynamically (#306)

dad2381

Merge branch 'main' into dev

0e1ac55

Merge branch 'main' into dev

764e5c9

Merge branch 'dev' of https://github.com/nold-ai/specfact-cli into dev

fa8708c

fix: harden module signing workflow and reduce startup log noise

5d90ced

test: align module migration compatibility with decoupled module vers…

276830e

…ions

fix: fail fast on invalid base ref in changed-only module signing

effd96f

fix: stabilize module precedence and backlog github mapping flow

798fc1a

merge: resolve main into dev and retain module/backlog updates

f72d6e8

fix(module-registry): persist disables and correct bundled availability

c6a05f5

Re-sign module registry and fix / ignore local temp artifacts

c9db837

bump module registry version to 0.1.3

db4da83

fix(registry): restore protocol reporting logs in debug mode

48ae89b

Merge branch 'main' into dev

c87c2d0

djm81 and others added 15 commits April 14, 2026 21:54

apply code review fixes

f7e3fd2

apply code review fixes

96879a9

merge: integrate origin/dev with local PyPI pre-commit and type-check…

cdf7e4d

… tweaks

merge: integrate origin/main into dev (conflicts resolved favoring dev)

29fdca8

Keep dev versions for all conflicted paths (--ours). Retain auto-merged non-conflicting updates from main (notably adapter/analyzer tests). Made-with: Cursor

fix(pre-commit): include staged deletions in staged_files() for Block 2

3ffec56

Use diff-filter ACMRD so deletion-only commits are not treated as empty safe changes. Restrict markdown and code-review paths to existing files. Made-with: Cursor

Fix review findings

95ccde3

Fix code review findings

c8a1116

Merge branch 'main' into dev

e7efd7d

chore(release): v0.46.2 — require signatures on all PRs to main

e61a8a2

Bump patch version across canonical sources. Tighten pr-orchestrator and sign-modules verify so every PR targeting main uses --require-signature, matching the post-merge main push gate. Made-with: Cursor

sign changed package

1ceddab

djm81 self-assigned this Apr 14, 2026

djm81 added bug Something isn't working module-system Module system and registry labels Apr 14, 2026

djm81 added this to SpecFact CLI Apr 14, 2026

djm81 moved this from Todo to In Progress in SpecFact CLI Apr 14, 2026

github-project-automation bot moved this to Todo in SpecFact CLI Apr 14, 2026

djm81 linked an issue Apr 14, 2026 that may be closed by this pull request

[Change] CI-Driven Module Signing On PR Approval #500

Closed

fix(modules): bump init to 0.1.29 for dev→main PR version gate

48ea131

enforce-version-bump compares changed manifests to origin/main; signing-only changes on 0.1.28 still failed. Re-sign integrity.signature locally after pull. Made-with: Cursor

chatgpt-codex-connector bot reviewed Apr 14, 2026

View reviewed changes

Comment thread src/specfact_cli/modules/init/module-package.yaml Outdated

djm81 added 3 commits April 15, 2026 01:00

Signed modules and bumped version

7e9504e

Signed modules and bumped version

b34f9fb

Fix sign flow

55c4c97

djm81 merged commit 1ae9ead into main Apr 14, 2026
44 checks passed

github-project-automation bot moved this from In Progress to Done in SpecFact CLI Apr 14, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

release: merge dev into main (v0.46.2, module signing CI)#506

release: merge dev into main (v0.46.2, module signing CI)#506
djm81 merged 411 commits intomainfrom
dev

djm81 commented Apr 14, 2026

Uh oh!

coderabbitai bot commented Apr 14, 2026 •

edited

Loading

Rate limit exceeded

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

djm81 commented Apr 14, 2026

Summary

Checklist

Uh oh!

coderabbitai bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai bot commented Apr 14, 2026 •

edited

Loading