Skip to content

Remove obsolete repository release flow - #1097

Merged
mariusvniekerk merged 2 commits into
mainfrom
t3code/remove-repo-release-flow
Aug 25, 2026
Merged

Remove obsolete repository release flow#1097
mariusvniekerk merged 2 commits into
mainfrom
t3code/remove-repo-release-flow

Conversation

@mariusvniekerk

@mariusvniekerk mariusvniekerk commented Aug 25, 2026

Copy link
Copy Markdown
Collaborator

RoboRev releases are now orchestrated by the central distribution repository. This removes the old local changelog, maintenance, and tag scripts, along with the tag-triggered publisher, so one tag cannot start a second release path.

The existing asset verifier still runs automatically when a GitHub Release is published. It also remains available on its daily schedule and through manual dispatch. .goreleaser.yaml and make release-snapshot-check remain for local, non-publishing package validation.

The central distribution repository now owns changelog generation, maintenance
pull requests, tagging, release creation, and artifact publication. Keeping
RoboRev's tag-triggered publisher would start a second release path for the
same tag.

The scheduled and manual asset verifier remains available. Local GoReleaser
snapshot validation also remains unchanged.

Generated with Codex
Co-authored-by: Codex <noreply@openai.com>
@roborev-ci

roborev-ci Bot commented Aug 25, 2026

Copy link
Copy Markdown

roborev: Combined Review (ab49509)

Verdict: High-risk removal of release automation leaves releases without publishing and immediate asset verification safeguards.

High

  • .github/workflows/release.yml:1 — Deleting the only tag-triggered release workflow removes the automation that creates or publishes GitHub release artifacts; .goreleaser.yaml is no longer invoked. Keep or replace it with the intended release dispatcher before removing the repository-owned workflow.

Medium

  • .github/workflows/release-verify.yml:7-16 — Removing the automatic post-release verification trigger allows a compromised or malformed release asset to remain available until the next scheduled or manual check. Restore verification tied to the actual release publisher and pass the exact release tag after all assets are uploaded.

Reviewers: 2 done | Synthesis: codex, 8s | Total: 3m6s

Release publication moved out of this repository, but the asset verifier must
still check each release as soon as it becomes public. Trigger it from the
published release event and use that event's exact tag.

Scheduled verification and manual tag selection remain unchanged.

Generated with Codex
Co-authored-by: Codex <noreply@openai.com>
@roborev-ci

roborev-ci Bot commented Aug 25, 2026

Copy link
Copy Markdown

roborev: Combined Review (b049279)

Verdict: One medium-severity reliability issue was identified; no exploitable security weaknesses were found.

Medium

  • .github/workflows/release-verify.yml:8-10, 65-78 — The release.published trigger may run before the external publisher finishes uploading assets, causing the immediate download to fail without automatic retry. Trigger verification after publication completes or retry until SHA256SUMS and all expected assets are available.

Reviewers: 2 done | Synthesis: codex, 7s | Total: 7m24s

@mariusvniekerk
mariusvniekerk merged commit 28db0e7 into main Aug 25, 2026
21 checks passed
@mariusvniekerk
mariusvniekerk deleted the t3code/remove-repo-release-flow branch August 25, 2026 18:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant