Repository navigation
fix(ci): adopt patched release and Go tools - #631
Conversation
Upstream release review: semantic-release 25.0.3 → 25.0.9; Go 1.26.6/1.26.8 → 1.26.9 and the scanner compiler 1.27.1 → 1.27.2. The complete semantic-release patch range was read: 25.0.4, 25.0.5, 25.0.6, 25.0.7, 25.0.8, and 25.0.9. Output redaction and input-handling security fixes are adopted here. Commit-message null handling and the patch-line consistency/revert fixes need no caller adaptation. The supported Node requirement remains compatible with the production Node 22 installation. No new caller-facing interface or local workaround replacement was identified. The official Go release history covers the intervening 1.26.7/1.26.8 fixes and the 1.26.9/1.27.2 security and bug fixes. All eight module files that select catalogue compilers now choose 1.26.9. The production TODO compiler is aligned; scanner installation and the current scanner test matrix use 1.27.2. Caller-selected scan execution still uses GOTOOLCHAIN=local. Compatibility-only module declarations and intentionally vulnerable dependencies remain intact; the retained 1.25 compatibility matrix is not a claim of patched-toolchain adoption. Automated tracking remains #627. Local evidence at the signed candidate: required manifest render and fourteen baseline checks passed, seven affected Go modules passed race tests and vet with Go 1.26.9, and complete CI credential traversal passed. The actual updated release command passed eleven release decisions and eight stable/default-branch decisions with unchanged files and refs. The existing configuration assertion failed before the production pin update and passed afterward. Independent static review found no correctness/security findings. Hosted acceptance remains outstanding: this host has no Docker executable for the native TODO replay. A scanner retry process-name fixture also cannot identify its test process on this host; its assertions were not changed. Required hosted CI must demonstrate those runtime paths before promotion. No publication, consumer rollout or completed delivery is claimed yet. |
Code coverage overviewLanguages: Go, C# Go / code-coverage/test
C# / code-coverage/dotnet
Go / code-coverage/go
ℹ️ Calculations represent line coverage. Results may change as calculations are updated. Updated |
@coderabbitai full review |
✅ Action performedFull review finished. |
Native user-path acceptance passed at head
Every readable required check/workflow passed. The configured code-quality rule remains unreadable through the completeness API ( |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Walkthrough
Priority: ⬆️ High Severity of issue fixed: High Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Linked Issues check |  |
For #625, the supplied change summary shows all three semantic-release pins at 25.0.9, the fixed Go paths at 1.26.9, and the scanner installer and 1.27 matrix at 1.27.2. The summary also reports the… |
Provide hosted CI results for the native TODO replay and the scanner retry fixture. Then confirm that the affected action jobs pass. |
-
Check name Status Explanation Out of Scope Changes check The changed files update the release pins, Go selectors, Go module directives, release fixtures, and validation matrices identified by #625. The fixture and assertion updates support verification of t…Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3… Title check The title clearly and concisely describes the main changes: adopting patched release tooling and updated Go tools for CI. Description check The description is directly related to the changeset. It explains the security-driven updates to release tooling and Go compilers and notes the preserved CI behavior. Full details: Out of Scope Changes check
-
Explanation
The changed files update the release pins, Go selectors, Go module directives, release fixtures, and validation matrices identified by
#625. The fixture and assertion updates support verification of those version changes. The PR does not claim or implement the automated embedded-tool-version tracking assigned to#627.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3 files. (12 skipped: 12 unsupported.)
-
Full details: Linked Issues check
-
Explanation
For
#625, the supplied change summary shows all threesemantic-releasepins at 25.0.9, the fixed Go paths at 1.26.9, and the scanner installer and 1.27 matrix at 1.27.2. The summary also reports the required local validation. However, hosted acceptance for the native TODO replay and the scanner retry fixture remains outstanding, so the requirement that the affected native action jobs pass is not established.Resolution
Provide hosted CI results for the native TODO replay and the scanner retry fixture. Then confirm that the affected action jobs pass.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Ready at exact head Native merge state is CLEAN. The configured code-quality gate is still API-unverifiable, so no claim of API completeness is made; ordinary protected promotion/merge remains the provider decision. After merge I will verify the exact merged source and the patch publication before closing the delivery record. Consumer adoption is not claimed by producer CI. |
1 participant
Why
The shared release and validation tools are behind published security fixes. Every consumer inherits those older tools when it uses the catalogue.
What
Updates the release tool and the Go compilers used by the catalogue while preserving existing checks, permissions and consumer settings. Automated tracking of embedded tool versions remains a separate follow-up.
Fixes #625