fix: /release skill changes based on latest release - #994
Conversation
Address issues like user assumption, branching and more Signed-off-by: Benny Zlotnik <bzlotnik@redhat.com>
📝 WalkthroughWalkthroughThe release skill detects the authenticated GitHub user. Protected version bumps use fork pull requests and merge queues. Bundle generation validates the checkout. Community-operator contributions create required forks and use the detected user. ChangesRelease workflow updates
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseSkill
participant UserFork
participant GitHub
participant ReleaseBranch
ReleaseSkill->>UserFork: Push version-bump branch
ReleaseSkill->>GitHub: Create pull request
GitHub->>GitHub: Process merge queue
ReleaseSkill->>ReleaseBranch: Reset to merged remote branch
ReleaseSkill->>ReleaseBranch: Tag release
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/release/SKILL.md:
- Around line 362-373: Update the branch/version guard in the release
verification section to abort before make bundle when git checkout or git pull
fails, and re-check CURRENT_BRANCH and CURRENT_VERSION after a successful
correction. Continue only when the post-correction values match release-X.Y and
X.Y.Z; otherwise exit with an error.
- Around line 272-274: Update the release workflow around the git add step after
creating BUMP_BRANCH so it stages only the explicitly listed release files from
the earlier file list, rather than using git add -A. Alternatively, validate
that the worktree contains no unexpected changes and abort before staging when
it does; preserve the version-bump commit behavior for the intended files.
- Around line 289-297: Update the Phase 1.5 sync instructions around the git
reset sequence to check for a clean worktree and confirm local state before
executing the destructive reset. Abort when tracked changes or unreviewed local
commits are present, and only run reset --hard after the user explicitly
confirms or preserves that state.
- Around line 41-43: Validate that GITHUB_USER is non-empty immediately after
its assignment from the existing environment value or gh api user lookup. If
resolution fails or produces an empty value, stop the release workflow with a
clear error before any later fork PR or make contribute steps reuse GITHUB_USER.
- Around line 276-285: Update the community-operator pre-checks and fork setup
in .claude/skills/release/SKILL.md at lines 276-285 and 399-406 to verify that
the authenticated GitHub account matches GITHUB_USER before running gh repo
view, gh repo fork, or using the configured fork remote; fail with a clear error
when they differ, preventing creation or use of a fork under the wrong account.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 5c20144e-4372-4364-a9ba-5fed2247ad3e
📒 Files selected for processing (1)
.claude/skills/release/SKILL.md
| ```bash | ||
| GITHUB_USER="${GITHUB_USER:-$(gh api user -q .login)}" | ||
| echo "GitHub user: $GITHUB_USER" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Validate GITHUB_USER before reuse.
If gh api user -q .login fails, the assignment leaves GITHUB_USER empty. Later blocks still use it for fork PRs and make contribute; require a non-empty value before the workflow proceeds.
🧰 Tools
🪛 SkillSpector (2.5.1)
[error] 299: [YR1] YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Remediation: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
(YARA Match (YR1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/skills/release/SKILL.md around lines 41 - 43, Validate that
GITHUB_USER is non-empty immediately after its assignment from the existing
environment value or gh api user lookup. If resolution fails or produces an
empty value, stop the release workflow with a clear error before any later fork
PR or make contribute steps reuse GITHUB_USER.
| git checkout -b "$BUMP_BRANCH" | ||
| git add -A | ||
| git commit -m "chore: bump version to X.Y.Z" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Stage only the intended release files.
Line [273] stages every tracked and untracked change in the checkout. This can include unrelated changes in the version-bump PR, despite the explicit file list in lines [264-266]. Use explicit paths or abort when unexpected worktree changes exist.
🧰 Tools
🪛 SkillSpector (2.5.1)
[error] 299: [YR1] YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Remediation: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
(YARA Match (YR1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/skills/release/SKILL.md around lines 272 - 274, Update the release
workflow around the git add step after creating BUMP_BRANCH so it stages only
the explicitly listed release files from the earlier file list, rather than
using git add -A. Alternatively, validate that the worktree contains no
unexpected changes and abort before staging when it does; preserve the
version-bump commit behavior for the intended files.
| # Push to fork — use the remote pointing to GITHUB_USER's fork. | ||
| # Common names: "upstream" or the user's username. Check with `git remote -v`. | ||
| git push <fork-remote> "$BUMP_BRANCH" | ||
|
|
||
| gh pr create \ | ||
| --title "chore: bump version to X.Y.Z" \ | ||
| --body "Version bump for release X.Y.Z" \ | ||
| --head "${GITHUB_USER}:${BUMP_BRANCH}" \ | ||
| --base release-X.Y | ||
| ``` |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate file =="
git ls-files | grep -F '.claude/skills/release/SKILL.md' || true
echo "== relevant sections =="
if [ -f .claude/skills/release/SKILL.md ]; then
sed -n '240,310p' .claude/skills/release/SKILL.md | cat -n -v
echo "----"
sed -n '360,430p' .claude/skills/release/SKILL.md | cat -n -v
fi
echo "== search GITHUB_USER and fork remotes =="
rg -n "GITHUB_USER|github|fork|gh repo fork|pr create|contribute" .claude/skills/release/SKILL.md || true
echo "== git diff stat/name =="
git diff --stat || true
git diff -- .claude/skills/release/SKILL.md | sed -n '1,220p' || trueRepository: jumpstarter-dev/jumpstarter
Length of output: 8959
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== upstream and contribute files =="
git ls-files | rg '(^|/)Contribution|contribute|Makefile|SKILL\.md$' | sed -n '1,120p'
echo "== search contribute/user/remote/user =="
rg -n "contribute|GITHUB_USER|user=|remote.*user|git remotes|git remote -v|github_pr_create|community-operators|community-operators-prod|user" .claude/skills/release/SKILL.md Makefile Makefile.* controller .github 2>/dev/null || true
echo "== read likely contribute files =="
for f in $(git ls-files | rg 'Contribution|contribute|Makefile' | sed -n '1,30p'); do
echo "---- $f ($(wc -l < "$f") lines) ----"
sed -n '1,260p' "$f" | cat -n | sed -n '1,240p'
doneRepository: jumpstarter-dev/jumpstarter
Length of output: 50384
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== contribution scripts =="
f=controller/deploy/operator/contribute/update-contributions.sh
if [ -f "$f" ]; then
wc -l "$f"
sed -n '1,160p' "$f" | cat -n
fi
echo "== release script environment section =="
f=.claude/skills/release/SKILL.md
if [ -f "$f" ]; then
sed -n '1,60p' "$f" | cat -n
fiRepository: jumpstarter-dev/jumpstarter
Length of output: 9344
🌐 Web query:
GitHub CLI gh repo fork forked repo default branch owner authenticated user --clone=false
💡 Result:
The command gh repo fork with the --clone=false flag creates a fork of the specified repository on your authenticated GitHub account without cloning it locally to your machine [1][2]. By default, the gh repo fork command targets your authenticated user account as the owner of the new fork [1][2]. When running the command: - If you provide a repository argument (e.g., gh repo fork OWNER/REPO --clone=false), it creates a fork of that repository in your account [1][2]. - If you run it without an argument inside a git repository, it forks the current repository to your account [1][2]. The --default-branch-only flag, when included, ensures that only the default branch is copied over to the new fork instead of all branches [1][3][4]. Example command: gh repo fork OWNER/REPO --default-branch-only --clone=false This command is particularly useful for automation and scripting, as it skips interactive prompts that would otherwise appear when running the command without explicit flag settings [5][2].
Citations:
- 1: https://cli.github.com/manual/gh_repo_fork
- 2: https://cli.github.com/manual/examples
- 3: https://man.archlinux.org/man/gh-repo-fork.1.en
- 4: https://manpages.opensuse.org/Leap-15.6/gh/gh-repo-fork.1.en.html
- 5: Clarify
--clonebehaviour ingh repo forkcli/cli#5925
Fail before creating or using community-ops forks when GitHub accounts differ. The community operator flow sets up and reads user remotes from ${GITHUB_USER}, but the pre-check gh repo view "${GITHUB_USER}/..." / gh repo fork "$REPO" only checks the authenticated account state. If those differ, make contribute can create a fork under someone else and later push to ${GITHUB_USER}’s nonexistent fork.
🧰 Tools
🪛 SkillSpector (2.5.1)
[error] 299: [YR1] YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Remediation: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
(YARA Match (YR1))
📍 Affects 1 file
.claude/skills/release/SKILL.md#L276-L285(this comment).claude/skills/release/SKILL.md#L399-L406
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/skills/release/SKILL.md around lines 276 - 285, Update the
community-operator pre-checks and fork setup in .claude/skills/release/SKILL.md
at lines 276-285 and 399-406 to verify that the authenticated GitHub account
matches GITHUB_USER before running gh repo view, gh repo fork, or using the
configured fork remote; fail with a clear error when they differ, preventing
creation or use of a fork under the wrong account.
| #### Phase 1.5: Sync local branch after merge | ||
|
|
||
| After the merge queue merges the PR, the local branch diverges from the merge commit. Sync before tagging: | ||
|
|
||
| ```bash | ||
| git checkout release-X.Y | ||
| git fetch origin | ||
| git reset --hard origin/release-X.Y | ||
| ``` |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Guard the destructive reset.
Line [296] can discard tracked worktree changes and move the local branch away from local commits. Users can modify the checkout while the merge queue runs. Abort on a dirty worktree and preserve or confirm local state before running git reset --hard.
🧰 Tools
🪛 SkillSpector (2.5.1)
[error] 299: [YR1] YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Remediation: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
(YARA Match (YR1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/skills/release/SKILL.md around lines 289 - 297, Update the Phase 1.5
sync instructions around the git reset sequence to check for a clean worktree
and confirm local state before executing the destructive reset. Abort when
tracked changes or unreviewed local commits are present, and only run reset
--hard after the user explicitly confirms or preserves that state.
Source: Linters/SAST tools
| #### Verify correct branch state | ||
|
|
||
| During long CI waits, the user may have switched branches. Before generating the bundle, verify the branch and version are correct — `make bundle` silently uses whatever is checked out: | ||
|
|
||
| ```bash | ||
| CURRENT_BRANCH=$(git branch --show-current) | ||
| CURRENT_VERSION=$(grep '^VERSION ?= ' controller/deploy/operator/Makefile | awk '{print $3}') | ||
| if [ "$CURRENT_BRANCH" != "release-X.Y" ] || [ "$CURRENT_VERSION" != "X.Y.Z" ]; then | ||
| echo "ERROR: Expected branch release-X.Y with VERSION=X.Y.Z" | ||
| echo "Got branch=$CURRENT_BRANCH VERSION=$CURRENT_VERSION" | ||
| git checkout release-X.Y && git pull origin release-X.Y | ||
| fi |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Abort when checkout correction fails.
If git checkout or git pull fails, the && chain stops but the workflow continues to make bundle. The bundle can then use the wrong branch or version, which is the failure this guard is intended to prevent. Exit on either failure and re-check the branch and version after correction.
🧰 Tools
🪛 SkillSpector (2.5.1)
[error] 299: [YR1] YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Remediation: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
(YARA Match (YR1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/skills/release/SKILL.md around lines 362 - 373, Update the
branch/version guard in the release verification section to abort before make
bundle when git checkout or git pull fails, and re-check CURRENT_BRANCH and
CURRENT_VERSION after a successful correction. Continue only when the
post-correction values match release-X.Y and X.Y.Z; otherwise exit with an
error.
1 participant
Address issues like user assumption, branching and more