Fix CI release pipeline + Scorecard alerts#234
Merged
s-b-e-n-s-o-n merged 5 commits intomainfrom Mar 30, 2026
Merged
Conversation
- Token-Permissions: replace top-level permissions with job-level scoped permissions in release-cut.yml, release-from-tag.yml, ci-verify.yml - Pinned-Dependencies: pin Snyk CLI install to snyk/actions/setup@SHA instead of npm install -g in security-snyk-weekly.yml - Auto-tag: initialize release_level/next_version before use and add guard clause to prevent unbound variable crash when no releasable commits exist (was failing CI Verify overall conclusion)
- Token-Permissions: replace top-level permissions with job-level scoped permissions in release-cut, release-from-tag, ci-verify - Pinned-Dependencies: pin Snyk CLI to snyk/actions/setup@SHA - Auto-tag: filter pre-release tags (v1.5.0-rc2) when resolving latest stable version — release-next-version.mjs only accepts X.Y.Z - Auto-tag: distinguish "no releasable commits" (skip) from real script errors (fail) instead of silently swallowing all failures - Load test: lower request_rate floor from 10 to 5 req/s - QA artifact: remove run_attempt suffix so re-runs find the artifact
- Filter v* tags to stable-only (X.Y.Z) when resolving latest version, preventing release-next-version.mjs from crashing on pre-release suffixes like v1.5.0-rc2 - Distinguish "no releasable commits" (expected, skip) from script errors (unexpected, fail) instead of silently swallowing all failures - Lower load test request_rate floor from 10 to 5 req/s - Remove run_attempt suffix from QA image artifact names
- Token-Permissions: scope top-level permissions to {} in release-cut,
release-from-tag; jobs already had job-level blocks
- Pinned-Dependencies: extract Snyk CLI setup into composite action
(setup-snyk) with SHA-pinned snyk/actions/setup
- Extract CI wait-for-successful-branch-ci into composite action
- Refactor release-from-tag verify job to use composite actions
- release-next-version.mjs: handle pre-release version inputs, improve error messages, expand test coverage - release-tag.mjs: new script for computing release tags with stable version filtering
s-b-e-n-s-o-n
requested review from
ALARGECOMPANY and
biggest-littlest
as code owners
s-b-e-n-s-o-n
temporarily deployed
to
ci-codecov
GitHub Actions
Inactive
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
ALARGECOMPANY
approved these changes
Mar 30, 2026
ALARGECOMPANY
approved these changes
Mar 30, 2026
biggest-littlest
approved these changes
Mar 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
{}in release-cut, release-from-tag, ci-verifysetup-snykcomposite action with SHA-pinned installrelease-tag.mjswith pre-release validation, rejects legacyrc2format (enforcesrc.2)run_attemptfrom QA artifact nameswait-for-successful-branch-ciandsetup-snykContext
RC2 release failed because: (1) auto-tag crashed on
v1.5.0-rc2pre-release tag, failing CI Verify overall; (2) release workflow couldn't find a passing CI run; (3) load test absolute floor too high for shared runners; (4) Playwright artifacts broke on re-runs.Test plan
node scripts/release-tag.mjs --tag v1.5.0-rc.2outputs correct metadatanode scripts/release-tag.mjs --tag v1.5.0-rc2fails with correction message