[coisa]

Replace the repository PHP channel updater with Actions-R-Us/actions-tagger@v2 on genuine stable release: published and release: edited events. Major channels are branches v0/v1; latest is the action's native tag, enabled only for the globally newest stable version. Concrete version tags remain unchanged.

The currently resolved v2 bundle (330ddfac760021349fef7ff62b372f2f691c20fb, blob 0e8ec35de217f085b99b6f27e63343c3b9202c96) force-downgrades branches on old edited events by itself. A 17-line inline github-script step parses concrete stable versions, paginates tags and compares their three numeric components. It relies on the real Changelog release event and on exclusive publication/immutable fulltags as activation prerequisites; redundant live release/SHA rechecks were removed as approved. Only the newest version in a major reaches App token creation/the action; only the global newest enables latest. A later 0.x after 1.x can advance v0 without moving latest.

Remove the PHP class/entrypoint, three updater-only test/fixture files, orphan .github/update-release-channels.md and stale references, plus updater-only HttpClient dependencies. Keep shared checking/distribution guarantees and add executable fixtures for the real inline guard. Reconcile current main 159cdcca916e18c3d76853d093a20e3607856526, preserving the merged runner/Composer metadata and CPX-autoload changes; those public workflows/runtime have no PR90 diff against main.

Blocked draft for activation. The common repository-scoped channel App/environment template is code only. Read-only metadata confirms App5513989 installation176263242 already covers all organization repositories, with the needed Contents/Workflows write and PR read permissions. No new installation/permission expansion is indicated. CS use, its missing environment, sensitive key transmission and remote rules still require separate approval; no configuration was changed. Publication still needs a verified published Changelog publication-only credential contract so its release event actually triggers the channel workflow. Existing v0 stays a branch; no branch-to-tag migration. See docs/automation.rst for activation requirements and limits.

The guard is not CAS: selection and forced writes can race other tag/ref writers; branch provenance/ancestry and post-write state are not verified. Major/latest writes are separate. Native non-fast-forward/deletion protections remain proposed without bypass; acceptance of the action's forward force:true request needs separately authorized server qualification. No release or channel ref was moved as a test.

Validation:

• Locked Composer install without plugins/scripts; strict Composer validation; full PHP style/syntax; actionlint; diff whitespace check: pass.
• Main-reconciliation suite: 260 tests / 2383 assertions / 6 skips, no failures, PHP8.5.12. Final inline guard fixtures: 6/6, including incomparable-version failure and major/global selection. No heavy suite was repeated for the 17-line simplification.
• Exact distributed bundle on Node24.22.1, local API only: baseline demonstrates downgrade; guarded scenarios prove fresh0.x, older0.x/1.x no-ops, later0.x preserving global latest, and1.x preserving v0 and all concrete tags.
• Composer's installed VersionParser rejects latest as a version, while normalizing v0 and v0.4.2; no claim that latest adds a numeric stable Composer release.
• Independent review of exact HEAD 21e8b1a838efc9859f74289d96a52536629cf9e9: no remaining findings. Remote CI/Codex/CodeRabbit remain separate merge gates.

Closes #88

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 34 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d14092be-5abe-44ef-b2fa-14c50efccb50

Commits

Reviewing files that changed from the base of the PR and between 159cdcc and 21e8b1a.

Files ignored due to path filters: 1

• composer.lock is excluded by !**/*.lock

Files selected for processing: 19

• .changelog/actions-tagger-release-channels.md
• .gitattributes
• .github/ReleaseChannelUpdater.php
• .github/update-release-channels.md
• .github/update-release-channels.php
• .github/workflows/repository-changelog.yml
• .github/workflows/repository-release-channels.yml
• AGENTS.md
• composer.json
• docs/automation.rst
• docs/getting-started/installation.rst
• docs/instruction-map.rst
• tests/Automation/ReleaseChannelGuardTest.cjs
• tests/Automation/WorkflowContextTest.php
• tests/Automation/WorkflowTest.php
• tests/Distribution/ArchiveTest.php
• tests/ReleaseChannel/EntryPointTest.php
• tests/ReleaseChannel/ReleaseChannelFixture.php
• tests/ReleaseChannel/ReleaseChannelUpdaterTest.php

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Changelog

✅ Contribution check passed.

Head: 21e8b1a838efc9859f74289d96a52536629cf9e9

Base: 159cdcca916e18c3d76853d093a20e3607856526

Contribution: 1 new valid fragment(s). Policy: ordinary.

• actions-tagger-release-channels.md — changed, patch

  Replace the repository PHP channel updater with actions-tagger@​v2 on stable published/edited release events in branch mode; select the newest stable tag per major before promoting v0/v1 branches and enable the native latest tag only for the global newest version. Publication credentials and channel protections require separate approval.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T21:36:52.144556Z	21e8b1a	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-28T21:41:12.021598Z	21e8b1a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.