Repository navigation
fix: allow native releases from main (TASK-22472) - #3081
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/chip review |
Code-analysis diffPainscore total: 8914.96 → 8914.96 (0) |
🧪 UI test report — ✅ all greenSuites
📊 Coverage (unit)
⏱ 10 slowest test cases
|
![chip-peanut-bot[bot]](https://avatars.githubusercontent.com/in/2915219?s=60&v=4){kind=small}
There was a problem hiding this comment.
Chip review — no blocking findings — this is not an approval
The widened release guards work as implemented, but the repository's release runbook still documents the old dev-only policy.
Findings
- MAJOR · .github/workflows/release-native.yml:3 · Update the release runbook for the widened branch policy
docs/NATIVE-RELEASE.mdstill says all three dispatches must run fromdev, claimsmainis rejected, and instructs Android replacements to usedev. After this change acceptsmainandrelease/android-kyc, an operator following the repository runbook will reject the supported production flow or select the wrong source branch. Update theCutting a releasesection and its branch-readiness guidance in this PR so the operational source matches the guards.
Checked clean
- Verified the detached worktree head and merge base exactly match the supplied SHAs.
- Exercised the three shell guards conceptually against their accepted and rejected branch sets; the focused exact-head unit gate passed.
- Checked release version resolution, native compatibility and OTA-surface guards, the production release mutex, downstream secret-bearing jobs, and isolated tag-write permissions.
- Checked exact-head CI: aggregate CI, unit, typecheck, lint, format, native export, provenance, analysis, review, bot-approval, and preview deployment all completed successfully.
Security review by moonshotai/kimi-k3: 0 finding(s), marked with the model name. It reads the diff only and answers only security, privacy and money, so treat its findings as advice.
Third opinion by claude-opus: 0 finding(s), marked with the model name. It answers only product truth, missing tests and the cross-repo contract, so treat its findings as advice.
Exact head: b22fc4b63d31 · Context: repo · Took 13m
|
/chip review |
There was a problem hiding this comment.
Chip review — no blocking findings — this is not an approval
The widened release-branch guards are consistent across all three manual workflows, preserve the existing release-safety checks, and are documented in the native release runbook. No actionable defects found.
Checked clean
- Verified the detached worktree HEAD and merge base exactly match the supplied head and base SHAs.
- Checked the three changed branch guards with accepted and rejected ref names; dev, main, and release/android-kyc pass while unrelated and empty refs fail closed.
- Confirmed prior finding P1 is fixed: docs/NATIVE-RELEASE.md names all supported branches, requires release-readiness checks, preserves newer production fixes during KYC integration, and routes production OTA through Release OTA.
- Reviewed release version resolution, production-release concurrency, Android replacement scope checks, native OTA compatibility checks, and post-success tagging; the branch-policy change leaves these controls intact.
- Checked the native OTA incident runbook relevant to this release path; production environment protection is currently procedural, so the workflow change warrants a dedicated security pass.
- Exact-head CI completed green, including ci-success, unit, native-export, typecheck, format, eslint, and human-authors.
Security review by moonshotai/kimi-k3: 0 finding(s), marked with the model name. It reads the diff only and answers only security, privacy and money, so treat its findings as advice.
Third opinion by claude-opus: 0 finding(s), marked with the model name. It answers only product truth, missing tests and the cross-repo contract, so treat its findings as advice.
Exact head: 61af0a3b200d · Context: repo, ops · Took 9m
There was a problem hiding this comment.
Chip review — no blocking findings — this is not an approval
The widened release-branch guards are consistent across all three manual workflows, preserve the existing release-safety checks, and are documented in the native release runbook. No actionable defects found.
Checked clean
- Verified the detached worktree HEAD and merge base exactly match the supplied head and base SHAs.
- Checked the three changed branch guards with accepted and rejected ref names; dev, main, and release/android-kyc pass while unrelated and empty refs fail closed.
- Confirmed prior finding P1 is fixed: docs/NATIVE-RELEASE.md names all supported branches, requires release-readiness checks, preserves newer production fixes during KYC integration, and routes production OTA through Release OTA.
- Reviewed release version resolution, production-release concurrency, Android replacement scope checks, native OTA compatibility checks, and post-success tagging; the branch-policy change leaves these controls intact.
- Checked the native OTA incident runbook relevant to this release path; production environment protection is currently procedural, so the workflow change warrants a dedicated security pass.
- Exact-head CI completed green, including ci-success, unit, native-export, typecheck, format, eslint, and human-authors.
Security review by moonshotai/kimi-k3: 0 finding(s), marked with the model name. It reads the diff only and answers only security, privacy and money, so treat its findings as advice.
Third opinion by claude-opus: 0 finding(s), marked with the model name. It answers only product truth, missing tests and the cross-repo contract, so treat its findings as advice.
Exact head: 61af0a3b200d · Context: repo, ops · Took 4m
Pull request was converted to draft
|
/chip review |
There was a problem hiding this comment.
Chip review — no blocking findings — this is not an approval
No actionable defects found. The widened release-branch guards are consistent across all three workflows, and the previously raised runbook drift is fixed at this head.
Checked clean
- Verified the detached worktree head and merge base exactly match the supplied SHAs; the diff is limited to the three release workflows, their runbook, and branch-guard tests.
- Reproduced all 24 branch-guard cases directly: dev, main, and release/android-kyc are accepted, while four unrelated refs are rejected in each workflow.
- Checked release version resolution, the production-release concurrency mutex, reusable-workflow secret inheritance, Production environment placement, and repository write-permission boundaries; the branch widening does not bypass the existing release gates.
- Confirmed prior finding P1 is fixed: docs/NATIVE-RELEASE.md now documents all supported branches, main readiness checks, preservation of later production fixes, and the version-resolving Release OTA path.
- Exact-head CI is green, including unit, native-export, typecheck, format, eslint, ds-lint, human-authors, bot-approval, and ci-success. Local Jest dependencies were absent, so the focused guard cases were reproduced with Node and Bash instead.
Security review by moonshotai/kimi-k3: 0 finding(s), marked with the model name. It reads the diff only and answers only security, privacy and money, so treat its findings as advice.
Third opinion by claude-opus: 0 finding(s), marked with the model name. It answers only product truth, missing tests and the cross-repo contract, so treat its findings as advice.
Exact head: 2ff4dd2b1a82 · Context: repo · Took 8m
There was a problem hiding this comment.
Chip review — no blocking findings — this is not an approval
No actionable defects found. The widened release-branch guards are consistent across all three workflows, and the previously raised runbook drift is fixed at this head.
Checked clean
- Verified the detached worktree head and merge base exactly match the supplied SHAs; the diff is limited to the three release workflows, their runbook, and branch-guard tests.
- Reproduced all 24 branch-guard cases directly: dev, main, and release/android-kyc are accepted, while four unrelated refs are rejected in each workflow.
- Checked release version resolution, the production-release concurrency mutex, reusable-workflow secret inheritance, Production environment placement, and repository write-permission boundaries; the branch widening does not bypass the existing release gates.
- Confirmed prior finding P1 is fixed: docs/NATIVE-RELEASE.md now documents all supported branches, main readiness checks, preservation of later production fixes, and the version-resolving Release OTA path.
- Exact-head CI is green, including unit, native-export, typecheck, format, eslint, ds-lint, human-authors, bot-approval, and ci-success.
Security review by moonshotai/kimi-k3: 0 finding(s), marked with the model name. It reads the diff only and answers only security, privacy and money, so treat its findings as advice.
Third opinion by claude-opus: 0 finding(s), marked with the model name. It answers only product truth, missing tests and the cross-repo contract, so treat its findings as advice.
Exact head: 2ff4dd2b1a82 · Context: repo · Took 6m
This branch was successfully deployed
1 participant
Summary
Allow manual Release OTA, Release Native, and Android same-version replacement runs from
main, while retainingdevandrelease/android-kyc. Update the native release runbook to match the supported branches and require verification of the selected commit before dispatch.Version resolution, compatibility checks, signing, and production locking remain unchanged. Current dev includes the reviewed Android KYC fixes through #3083. This branch retains the Cordova registry keep rule, final-AAB assertions, and narrow Android caller permission from #3080 and #3082.
Task and release gates
TASK-22472 · Sprint 159 release
Before a release from main, verify it contains these reviewed native and KYC changes and completes native release QA. Use Release OTA for resolved production OTA versions. Android Release with blank versionName retains its narrow replacement checks; Release Native builds both platforms.
Revert #3078 is closed without merge. Later production app fixes and the content pointer are preserved. This PR does not dispatch a release.
QA