Repository navigation
chore(deps): bump gpustack-runner to 0.1.31 and fix dependabot alerts - #34
Conversation
gpustack-runner >= 0.1.29 -> >= 0.1.31. Lock-only upgrades of transitive dependencies close the open Dependabot alerts: urllib3 2.7.0 -> 2.8.0 covers GHSA-gh4c-6fx4-qh6g, GHSA-8988-9cw3-xx77 and GHSA-vxq7-64xx-v4gw; virtualenv 21.7.7 -> 21.14.7 covers GHSA-94p9-xgh2-xp45 and GHSA-9h9j-4vrj-gf7g; oauthlib 3.3.1 -> 4.0.0 covers GHSA-xpv3-w29h-x7cv and GHSA-hj66-6f7g-4r5v. Signed-off-by: thxCode <thxcode0824@gmail.com>
Document the release procedure modeled on the runner repo's runner-release skill, cut down to this repository's workflow: final tags publish immediately as latest (no promotion gate), the workflow generates no baseline notes, so curating the GitHub Release notes is the required final step. The canonical skill lives in .agents/skills and is exposed to Claude Code through a tracked .claude/skills symlink; the gitignore un-ignores only that path. AGENTS.md points at the skill. Signed-off-by: thxCode <thxcode0824@gmail.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new runtime-release agent skill to document and guide the process of cutting a gpustack-runtime package release, along with updating .gitignore, AGENTS.md, and creating a symlink under .claude/skills/. It also bumps the gpustack-runner dependency version to >=0.1.31 and updates the uv.lock file. The review feedback suggests a helpful improvement to the release skill documentation to explicitly instruct saving drafted notes to notes.md in step 3, ensuring consistency with the command in step 5.
There was a problem hiding this comment.
🟡 Changes recommended
The release procedure contains incorrect target selection, version comparison, and workflow-retry instructions.
1 open finding
What changed in this PR
Updates dependencies to resolve seven Dependabot alerts and adds repository-specific release automation guidance.
Changes:
- Raises
gpustack-runnerto 0.1.31 and refreshes transitive dependencies. - Adds the
runtime-releaseskill and Claude Code symlink. - Documents and selectively tracks the release skill.
| File | Description |
|---|---|
pyproject.toml |
Raises the runner dependency floor. |
uv.lock |
Locks runner and security-related dependency upgrades. |
.agents/skills/runtime-release/SKILL.md |
Adds the package-release procedure. |
.claude/skills/runtime-release |
Exposes the release skill through a symlink. |
.gitignore |
Allows only the release-skill symlink under .claude. |
AGENTS.md |
Links maintainers to the release skill. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Both review findings are addressed in fixup commit 0b9f0b1 on this branch (docs-only;
Both threads carry per-thread replies and are resolved. The fixup folds into the feat commit on squash merge, so no history work is needed. |
Signed-off-by: thxCode <thxcode0824@gmail.com>
5b2158d to
0b9f0b1
Compare
Bump the gpustack-runner floor to >= 0.1.31 and regenerate uv.lock, closing the seven open Dependabot alerts with lock-only upgrades of transitive dependencies: urllib3 2.7.0 -> 2.8.0 (GHSA-gh4c-6fx4-qh6g, GHSA-8988-9cw3-xx77, GHSA-vxq7-64xx-v4gw), virtualenv 21.7.7 -> 21.14.7 (GHSA-94p9-xgh2-xp45, GHSA-9h9j-4vrj-gf7g), and oauthlib 3.3.1 -> 4.0.0 (GHSA-xpv3-w29h-x7cv, GHSA-hj66-6f7g-4r5v). The only declared constraint change is gpustack-runner.
Add the runtime-release skill at .agents/skills/runtime-release/, modeled on the runner repo's runner-release skill and cut down to this repository's release.yml: a final tag publishes the GitHub Release as latest immediately and the workflow generates no baseline notes, so curating the release notes is the required final step. A tracked .claude/skills/runtime-release symlink exposes the skill to Claude Code, with .gitignore un-ignoring only that path while nested .claude directories stay ignored; AGENTS.md points at the skill.