fix: adopt the combined runtime and preserve version PR recovery by coisa · Pull Request #102 · php-fast-forward/code-standards

coisa · 2026-10-29T05:13:23Z

Version preparation still loaded an older runtime that could not inspect missing original squash-PR heads. The caller now selects the reviewed combined provider at 42bc58fbab55596ee03d480ebf71d2a3dfc48fb4 from Changelog PR78, including the publication-only API, authenticated object acquisition and combined-review credential validation fix.

It also binds the valid RELEASE_CHANNEL_APP_PRIVATE_KEY secret, pins actions-tagger to verified immutable commit 330ddfac760021349fef7ff62b372f2f691c20fb (v2.0.3), and reserves changelog/version-recovery-98 for fresh signed Bot preparation. The 17-line selection guard and managed PR author remain unchanged.

Closes #101.

Validation at 7ea21cdefccfd105ef6e00928dae8c6155023cdb, base 4d0068a68e0d22ea009ab8d3f6992844e4dde968: independent review found no code findings; 6 workflow tests/89 assertions, 11 effective provider API/auth checks, actionlint, changed-PHP style and diff checks passed. Current-head functional CI passed. Remote review state remains a separate gate.

Provider composition is documented in PR78: exact union of PR76@db545cf2 and PR77@81e3a8f4 at41020df, followed by the intentional four-file review-fix delta. The provider's 442 workflow cases and 7 impact checks pass. Explicit keys remain visible to authentication so incomplete App pairs fail closed; only the environment fallback is gated by App ID.

PR98 remains at its original human merge48119d8. Its patch/tree preservation is independently proved. The corrected source refuses that unowned head; a dry-run on the reserved recovery branch plans0.10.0 without diagnostics. No live recovery or release has occurred. The human merge004c3d42 in this development branch is preserved in ancestry; updates are ordinary fast-forwards.

This PR remains unmerged. It requires its own current-head reviews and integration authority. No publication, rerun, channel movement, settings/credential operation or inherited managed-branch rewrite is authorized here.

coderabbitai · 2026-10-29T05:13:33Z

📝 Summary

Summary by CodeRabbit

Documentation
- Updated release automation guidance with current configuration, environment-secret naming requirements, verification status, and recovery steps for version-preparation failures.
- Clarified the distinction between environment-secret names and workflow input names.
Chores
- Updated release automation to use verified, fixed action and workflow references and a shared environment-secret configuration.
- Added release notes covering version preparation and release-channel updates. Release-channel behavior remains unchanged.

The Changelog and release-channel workflows now use RELEASE_CHANNEL_APP_PRIVATE_KEY. The Changelog workflow uses a new pinned revision and managed branch. Tests, documentation, and patch changelog entries describe these changes and version-preparation recovery guidance.

Changes: Release automation updates

Layer / File(s)	Summary
Workflow secret and reference contract `.github/workflows/*`, `tests/Automation/WorkflowTest.php`, `.changelog/valid-release-app-secret.md`	Both workflows use `RELEASE_CHANNEL_APP_PRIVATE_KEY`. The Changelog workflow uses a new pinned revision and managed branch. The release-channel workflow uses a pinned tagger action. Tests check the shared secret name and pinned references.
Automation documentation and recovery guidance `docs/automation.rst`, `.changelog/refresh-version-runtime.md`	The documentation describes the secret contract, workflow references, configuration checks, verification limits, and version-PR recovery procedures. The patch changelog entry describes version-preparation and channel-update changes.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Possibly related issues

Verify reviewed 0.x Changelog lifecycle and release gates #6: The secret binding affects the Changelog publication lifecycle, but this change does not implement the issue’s full release verification.

Possibly related PRs

php-fast-forward/code-standards#13: PR #13 introduced the release-channel workflow and connected it to the Changelog publication job; this PR updates those workflow callers.
php-fast-forward/code-standards#50: PR #50 changed the pinned Changelog workflow revision; this PR updates that workflow revision contract.
php-fast-forward/code-standards#7: PR #7 introduced the repository Changelog and release-channel workflows; this PR updates their secret contract and Changelog revision.

Merge Risk: Minimal · up to 7ea21

No concrete merge-blocking defect is established in the changed workflows, tests, or documentation.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Out of Scope Changes check		The PR includes changes that are separate from `#101`'s secret-contract defect. The caller adopts a combined runtime containing the missing-original-PR provenance fix, adds `managed-branch: changelog/ve…	Remove the version-recovery runtime, `managed-branch`, recovery documentation/changelog, and unrelated `actions-tagger` pin from this issue's change set, or link the separate recovery and action-reference requirements to active issues and r…

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title names the two main changes: adopting the combined runtime from Changelog draft PR78 and preserving version PR recovery. Both match the changeset and the PR objectives. It uses the 'fix:' pre…
Linked Issues check		Issue `#101` requires the valid `RELEASE_CHANNEL_APP_PRIVATE_KEY` secret name, publication-only App routing, the unchanged stable-release selector, and provider-interface validation. The caller forwards…
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Description check		The description is directly related to the changeset. It states the author's goal of adopting the combined Changelog provider at a pinned commit, binding the RELEASE_CHANNEL_APP_PRIVATE_KEY secret, pi…

Full details: Title check

Explanation

The title names the two main changes: adopting the combined runtime from Changelog draft PR78 and preserving version PR recovery. Both match the changeset and the PR objectives. It uses the 'fix:' prefix and is one sentence, though it is somewhat long at 64 characters.

Full details: Linked Issues check

Explanation

Issue #101 requires the valid RELEASE_CHANNEL_APP_PRIVATE_KEY secret name, publication-only App routing, the unchanged stable-release selector, and provider-interface validation. The caller forwards secrets.RELEASE_CHANNEL_APP_PRIVATE_KEY to the reviewed Changelog workflow and keeps the publication client ID and release-channels environment. The release-channel workflow reads the same secret for its repository-scoped App token. It does not change the 17-line selector. WorkflowTest checks the shared secret name, rejects secrets.app-private-key, preserves the routing constraints, and checks the workflow references. The PR reports 10 provider API/auth checks and combined-provider test results. No coding requirement from #101 remains unmet.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 2 functions across 1 files. (4 skipped: 4 unsupported.)

Full details: Description check

Explanation

The description is directly related to the changeset. It states the author's goal of adopting the combined Changelog provider at a pinned commit, binding the RELEASE_CHANNEL_APP_PRIVATE_KEY secret, pinning actions-tagger to commit 330ddfac, and reserving changelog/version-recovery-98. It also lists validation results and scope limits, and it closes issue #101. The changeset's workflow, documentation, and test edits match these points. The description is specific and detailed enough to pass this lenient check.

Full details: Out of Scope Changes check

Explanation

The PR includes changes that are separate from #101's secret-contract defect. The caller adopts a combined runtime containing the missing-original-PR provenance fix, adds managed-branch: changelog/version-recovery-98, and adds recovery documentation and a separate recovery changelog entry. The release-channel workflow also changes the actions-tagger reference and documents that security pin. #101 explicitly separates the missing PR-head problem and excludes recovery work. The secret-name documentation and related tests are in scope, but these recovery and action-reference changes are not connected to the linked issue.

Resolution

Remove the version-recovery runtime, managed-branch, recovery documentation/changelog, and unrelated actions-tagger pin from this issue's change set, or link the separate recovery and action-reference requirements to active issues and review them as separate scope.

Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the secret name,
Then pins the tagger all the same.
A branch holds version work in place,
Tests confirm the shared key’s case.
The changelog notes each careful trace.}

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-29T05:14:01Z

Changelog

✅ Contribution check passed.

Head: 7ea21cdefccfd105ef6e00928dae8c6155023cdb

Base: 4d0068a68e0d22ea009ab8d3f6992844e4dde968

Contribution: 2 new valid fragment(s). Policy: ordinary.

refresh-version-runtime.md — fixed, patch

Refreshes version preparation with authenticated, verified original implementation PR objects and a new exclusive managed branch, preserving the human-merged PR98 head and strict signed Bot ownership. Selects the verified immutable actions-tagger commit verified for v2.0.3 for channel updates.
valid-release-app-secret.md — fixed, patch

Use the valid RELEASE_CHANNEL_APP_PRIVATE_KEY environment secret name for repository publication and release-channel authentication through a compatible Changelog workflow revision, while preserving publication-only App routing and channel selection.

chatgpt-codex-connector · 2026-10-29T12:08:47Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T14:44:09.640395Z	`7ea21cd`	New commits
🔒 Security Review	✅ Completed 2026-10-29T14:46:58.719787Z	`7ea21cd`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

coderabbitai

🔇 Additional comments: 1

.changelog/refresh-version-runtime.md-1-6: 1

1-6: Minor · Maintainability & Code Quality · Quick win

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Resolve the Markdown lint warning before merging.

markdownlint-cli2 reports MD041 because the YAML front matter is followed by body text without a top-level heading. Preserve the front matter required by the changelog parser. Configure front-matter handling or exclude .changelog entries from this rule.

Source: Linters/SAST tools

Review info

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 400167d8-974a-4223-9518-8c0f0823c864

Commits

Reviewing files that changed from the base of the PR and between 004c3d4 and 7ea21cd.

Files selected for processing: 5

.changelog/refresh-version-runtime.md
.github/workflows/repository-changelog.yml
.github/workflows/repository-release-channels.yml
docs/automation.rst
tests/Automation/WorkflowTest.php

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

* origin/main: chore(release): php-fast-forward/code-standards v0.9.2 → v0.10.0 (#103) fix: adopt the combined runtime and preserve version PR recovery (#102) refactor: reuse native Rector report validation (#95)

fix: use the valid release App environment secret contract

31564ed

coisa mentioned this pull request Oct 29, 2026

ci: promote guarded branch channels with actions-tagger v2.0.3 php-fast-forward/changelog#76

Closed

coisa marked this pull request as ready for review October 29, 2026 12:08

Merge branch 'main' into codex/valid-release-app-secret

004c3d4

coisa changed the title ~~fix: bind release App workflows to the valid environment secret~~ fix: adopt the combined runtime and preserve version PR recovery Oct 29, 2026

coisa added 5 commits October 29, 2026 09:21

fix: adopt the combined version runtime on a preserved recovery branch

e1a301a

fix: qualify authenticated provenance in the combined runtime

d5f840f

docs: adopt the corrected publication key reference

7e8587e

fix: pin the verified release channel action commit

30cc9ac

fix: adopt the reviewed publication credential guard

7ea21cd

coderabbitai Bot reviewed Oct 29, 2026

View reviewed changes

coisa merged commit 7736432 into main Oct 29, 2026
25 checks passed

coisa deleted the codex/valid-release-app-secret branch October 29, 2026 23:33

Navigation Menu

Repository navigation

fix: adopt the combined runtime and preserve version PR recovery - #102

fix: adopt the combined runtime and preserve version PR recovery#102
coisa merged 7 commits into
mainfrom
codex/valid-release-app-secret

coisa commented Oct 29, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

coisa commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changelog

Uh oh!

chatgpt-codex-connector Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coisa commented Oct 29, 2026 •

edited

Loading

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading

github-actions Bot commented Oct 29, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 29, 2026 •

edited

Loading