Skip to content

feat(validatereleasetag): validate release tag - #69

Merged
MicheleNan merged 43 commits into
masterfrom
feature/22954-ValidateReleaseTag
Sep 3, 2026
Merged

feat(validatereleasetag): validate release tag#69
MicheleNan merged 43 commits into
masterfrom
feature/22954-ValidateReleaseTag

Conversation

@jacopocinaark

@jacopocinaark jacopocinaark commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

ref: AB#22954

Copilot AI lite review requested due to automatic review settings August 18, 2026 08:58
@jacopocinaark
jacopocinaark requested a review from a team as a code owner August 18, 2026 08:58

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds explicit release-tag validation to the GitHub Actions publish flow so PyPI publishing only proceeds for GA-style tags (vX.Y.Z), aligning the workflow trigger/conditions with tag-based releases.

Changes:

  • Broadened workflow tag trigger to v* (GitHub Actions tag patterns are glob-based).
  • Restricted the publish job to run only on tag pushes (refs/tags/v...), not master pushes.
  • Added a bash validation step that hard-fails publishing when the tag is not exactly v<major>.<minor>.<patch>.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread .github/workflows/python-tests.yml Outdated
Comment thread .github/workflows/python-tests.yml
Comment thread .github/workflows/python-tests.yml Outdated
Copilot AI review requested due to automatic review settings August 19, 2026 12:19

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

.github/workflows/python-tests.yml:104

  • The validation hard-codes master in both the fetch and the ancestry check. This adds another place to update if the default branch name changes; the workflow already has access to the repo default branch via the event payload.
          git fetch origin master

          if ! git merge-base --is-ancestor "$GITHUB_SHA" "origin/master"; then
            echo "::error::Release tag $TAG does not point to a commit contained in master."
            exit 1

Comment thread .github/workflows/python-tests.yml Outdated
Copilot AI review requested due to automatic review settings August 25, 2026 09:40
Comment thread .github/workflows/python-tests.yml Fixed
Comment thread .github/workflows/python-tests.yml Fixed
Comment thread .github/workflows/python-tests.yml Fixed

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

Suppressed comments (3)

.github/workflows/python-tests.yml:12

  • on.push.tags uses glob patterns (not regex). Patterns like v[0-9]+\.[0-9]+\.[0-9]+ will not match normal SemVer tags (the + and backslashes are treated literally), so tag pushes may never trigger this workflow. Use a broad glob (e.g. v*) and keep strict validation inside the publish jobs.
    tags:
      - 'v[0-9]+\.[0-9]+\.[0-9]+'
      - 'v[0-9]+\.[0-9]+\.[0-9]+-beta\.[0-9]+'
      - 'v[0-9]+\.[0-9]+\.[0-9]+-PR[0-9]+\.[0-9]+'

.github/workflows/python-tests.yml:147

  • Publishing jobs should depend on the test/typecheck jobs. Without needs: [build, pyright], the package can be published even if the matrix tests or pyright fail, and it may run in parallel before quality gates complete.
    runs-on: ubuntu-latest

    if: >
      github.event_name == 'push' &&

.github/workflows/python-tests.yml:230

  • Publishing jobs should depend on the test/typecheck jobs. Without needs: [build, pyright], the package can be published even if the matrix tests or pyright fail, and it may run in parallel before quality gates complete.
    runs-on: ubuntu-latest

    if: >
      github.event_name == 'push' &&

Comment thread .github/workflows/python-tests.yml
Comment thread .github/workflows/python-tests.yml
Comment thread .github/workflows/python-tests.yml Outdated
This workflow installs Python dependencies, runs tests, and publishes packages for stable, beta, and PR preview releases.
Copilot AI review requested due to automatic review settings August 25, 2026 09:54
Comment thread .github/workflows/publish_nuget_dryrun.yml Fixed
Comment thread .github/workflows/publish_nuget_dryrun.yml Fixed
Comment thread .github/workflows/publish_nuget_dryrun.yml Fixed
Comment thread .github/workflows/publish_nuget_dryrun.yml Fixed
Comment thread .github/workflows/publish_nuget_dryrun.yml Fixed

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

Suppressed comments (4)

.github/workflows/python-tests.yml:12

  • on.push.tags patterns are treated as glob patterns (not regex). The current patterns include + and \. which won’t match real tags like v1.2.3, so tag pushes may never trigger this workflow. Use a glob pattern (and keep the bash regex validation for strictness).
    branches: [master]
    tags:
      - 'v[0-9]+\.[0-9]+\.[0-9]+'
      - 'v[0-9]+\.[0-9]+\.[0-9]+-beta\.[0-9]+'
      - 'v[0-9]+\.[0-9]+\.[0-9]+-PR[0-9]+\.[0-9]+'

.github/workflows/python-tests.yml:86

  • Publish jobs no longer depend on the test/lint matrix, so a tag push can publish even if build/pyright failed (or while they’re still running). Add needs: [build, pyright] so publishing is gated on CI.
    name: "Publish Stable"
    runs-on: ubuntu-latest

    if: >
      github.event_name == 'push' &&

.github/workflows/python-tests.yml:229

  • Same gating issue as publish-stable: without needs, preview publishing can run even if tests/lint failed. Add needs: [build, pyright].
  publish-preview:
    name: "Publish PR Preview"
    runs-on: ubuntu-latest

    if: >

.github/workflows/python-tests.yml:146

  • Same gating issue as publish-stable: without needs, beta publishing can run even if tests/lint failed. Add needs: [build, pyright].
  publish-beta:
    name: "Publish Beta"
    runs-on: ubuntu-latest

    if: >

Comment thread .github/workflows/python-tests.yml Outdated
Comment thread .github/workflows/publish_nuget_dryrun.yml Outdated
Comment thread .github/workflows/publish_nuget_dryrun.yml Outdated
Comment thread .github/workflows/publish_nuget_dryrun.yml Outdated
Refactor Python dependency installation and version handling.
Copilot AI review requested due to automatic review settings August 25, 2026 12:21

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (13)

Previously missed (4) — in code that hasn't changed since the last review.

.github/workflows/python-tests.yml:12

  • on.push.tags patterns are written like regex (use of + and escaped \.), but GitHub Actions tag filters use glob patterns. As written, tag pushes like v1.2.3 / v1.2.3-beta.1 / v1.2.3-PR12.1 may not trigger this workflow at all.
    tags:
      - 'v[0-9]+\.[0-9]+\.[0-9]+'
      - 'v[0-9]+\.[0-9]+\.[0-9]+-beta\.[0-9]+'
      - 'v[0-9]+\.[0-9]+\.[0-9]+-PR[0-9]+\.[0-9]+'

.github/workflows/python-tests.yml:115

  • Using GITHUB_SHA for tag ancestry checks can break for annotated tags (SHA may be the tag object, not the commit). Resolve the commit the tag points to before calling git merge-base.

This issue also appears on line 175 of the same file.

          if ! git merge-base --is-ancestor "$GITHUB_SHA" "origin/master"; then

.github/workflows/python-tests.yml:309

  • PR preview tags (vX.Y.Z-PR...) are not a PEP 440 version, and this repo uses setuptools_scm for versioning. Building/publishing without overriding the version is likely to fail or produce a version PyPI rejects. Set SETUPTOOLS_SCM_PRETEND_VERSION for preview builds (similar to the dryrun workflow).
        run: |
          python -m build

.github/workflows/publish_nuget_dryrun.yml:115

  • Using GITHUB_SHA for tag ancestry checks can break for annotated tags (SHA may be the tag object, not the commit). Resolve the commit the tag points to before calling git merge-base.

This issue also appears on line 175 of the same file.

          if ! git merge-base --is-ancestor "$GITHUB_SHA" "origin/master"; then

.github/workflows/python-tests.yml:84

  • publish-stable can run even if the build/pyright jobs fail because it no longer declares needs. This can publish a broken release despite CI failures.
    name: "Publish Stable"
    runs-on: ubuntu-latest

.github/workflows/python-tests.yml:145

  • publish-beta can run even if the build/pyright jobs fail because it has no needs. This can publish a broken beta despite CI failures.
    name: "Publish Beta"
    runs-on: ubuntu-latest

.github/workflows/python-tests.yml:228

  • publish-preview can run even if the build/pyright jobs fail because it has no needs. This can publish a broken preview despite CI failures.
    name: "Publish PR Preview"
    runs-on: ubuntu-latest

.github/workflows/python-tests.yml:175

  • Using GITHUB_SHA for tag ancestry checks can break for annotated tags (SHA may be the tag object, not the commit). Resolve the commit the tag points to before calling git merge-base.
          if ! git merge-base --is-ancestor "$GITHUB_SHA" "origin/develop-beta"; then

.github/workflows/publish_nuget_dryrun.yml:12

  • on.push.tags patterns are written like regex (use of + and escaped \.), but GitHub Actions tag filters use glob patterns. As written, tag pushes like v1.2.3 / v1.2.3-beta.1 / v1.2.3-PR12.1 may not trigger this workflow at all.
    tags:
      - 'v[0-9]+\.[0-9]+\.[0-9]+'
      - 'v[0-9]+\.[0-9]+\.[0-9]+-beta\.[0-9]+'
      - 'v[0-9]+\.[0-9]+\.[0-9]+-PR[0-9]+\.[0-9]+'

.github/workflows/publish_nuget_dryrun.yml:145

  • publish-beta can run even if the build/pyright jobs fail because it has no needs. This can publish a broken beta despite CI failures.
    name: "Publish Beta"
    runs-on: ubuntu-latest

.github/workflows/publish_nuget_dryrun.yml:228

  • publish-preview can run even if the build/pyright jobs fail because it has no needs. This can publish a broken preview despite CI failures.
    name: "Publish PR Preview"
    runs-on: ubuntu-latest

.github/workflows/publish_nuget_dryrun.yml:175

  • Using GITHUB_SHA for tag ancestry checks can break for annotated tags (SHA may be the tag object, not the commit). Resolve the commit the tag points to before calling git merge-base.
          if ! git merge-base --is-ancestor "$GITHUB_SHA" "origin/develop-beta"; then

.github/workflows/publish_nuget_dryrun.yml:5

  • This new workflow duplicates .github/workflows/python-tests.yml (same name: Artesian SDK Python, same triggers, and real PyPI publish steps). If both workflows exist, tag pushes will run/publish twice, increasing CI load and risking failed or duplicated releases.
name: Artesian SDK Python

Comment thread .github/workflows/publish_nuget_dryrun.yml Outdated
Copilot AI review requested due to automatic review settings August 25, 2026 13:08

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (8)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/python-tests.yml:12

  • on.push.tags uses regex-like patterns (e.g. + and \.). GitHub Actions tag filters are glob patterns, so these strings won’t match intended semver tags and can prevent the workflow from triggering on releases. Easiest: trigger on any v* tag and rely on the job-level bash validations to enforce the exact formats.
    branches: [master]
    tags:
      - 'v[0-9]+\.[0-9]+\.[0-9]+'
      - 'v[0-9]+\.[0-9]+\.[0-9]+-beta\.[0-9]+'
      - 'v[0-9]+\.[0-9]+\.[0-9]+-PR[0-9]+\.[0-9]+'

.github/workflows/python-tests.yml:84

  • publish-stable no longer depends on build/pyright (previously the publish job had needs). As written, publishing can start (and succeed) even if tests/type-check fail, because jobs run in parallel by default.
  publish-stable:
    name: "Publish Stable"
    runs-on: ubuntu-latest

.github/workflows/python-tests.yml:145

  • publish-beta is not gated on build/pyright. This allows beta artifacts to be published even when CI fails.
  publish-beta:
    name: "Publish Beta"
    runs-on: ubuntu-latest

.github/workflows/python-tests.yml:228

  • publish-preview is not gated on build/pyright, so preview packages can publish even if tests/type-check fail.
  publish-preview:
    name: "Publish PR Preview"
    runs-on: ubuntu-latest

.github/workflows/publish_nuget_dryrun.yml:5

  • This workflow file name implies a NuGet dry-run, but it is a full Python build/test + PyPI publish workflow (and has the same name: as the main workflow). This is confusing in the Actions UI and makes it easy to run/publish the wrong pipeline.
# This workflow will install Python dependencies, run tests and lint with a single version of Python
# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions

name: Artesian SDK Python

.github/workflows/publish_nuget_dryrun.yml:16

  • This workflow publishes to PyPI on push tags. Since .github/workflows/python-tests.yml also publishes on stable vX.Y.Z tags, creating a release tag will trigger two publish attempts for the same version (one will fail, and it’s easy to accidentally publish twice if configurations diverge). If this file is intended as a dry run, it should not run on push tags.
on:
  push:
    branches: [master]
    tags:
      - 'v[0-9]+\.[0-9]+\.[0-9]+'
      - 'v[0-9]+\.[0-9]+\.[0-9]+b[0-9]+'
      - 'v[0-9]+\.[0-9]+\.[0-9]+a[0-9]+\.[0-9]+'
  pull_request:
    branches: [master]
  workflow_dispatch:

.github/workflows/publish_nuget_dryrun.yml:199

  • Same =~ regex operator issue in the beta publish job if: condition; it will not parse in GitHub Actions expressions. Rely on the bash validation step (or use supported functions like contains()/startsWith()).
    if: >
      github.event_name == 'push' &&
      startsWith(github.ref, 'refs/tags/v') &&
      github.ref_name =~ '^v[0-9]+\.[0-9]+\.[0-9]+b[0-9]+$'

.github/workflows/publish_nuget_dryrun.yml:303

  • Same =~ regex operator issue in the preview publish job if: condition; it will not parse in GitHub Actions expressions.
    if: >
      github.event_name == 'push' &&
      startsWith(github.ref, 'refs/tags/v') &&
      github.ref_name =~ '^v[0-9]+\.[0-9]+\.[0-9]+a[0-9]+\.[0-9]+$'

Comment thread .github/workflows/publish_nuget_dryrun.yml Outdated
Copilot AI review requested due to automatic review settings August 25, 2026 13:26
Comment thread .github/workflows/python-tests.yml Outdated
Copilot AI review requested due to automatic review settings August 31, 2026 09:09

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

.github/workflows/validate_tag.sh:6

  • With set -u, calling this script with missing args fails with a generic “unbound variable” error. Add an explicit arg-count check and a usage error so workflow failures are actionable.
set -euo pipefail

TAG="$1"
TYPE="$2"

.github/workflows/python-tests.yml:269

  • "Validate next minor version" compares only major/minor and can incorrectly accept tags like v4.3.5b1 even though the error message/documentation expects patch 0 (".0bN"). Enforce patch == 0 (and/or compare full X.Y.Z) so the policy is actually validated.
          MASTER_MAJOR=$(echo "$MASTER_VERSION" | cut -d. -f1)
          MASTER_MINOR=$(echo "$MASTER_VERSION" | cut -d. -f2)

          BETA_MAJOR=$(echo "$BETA_VERSION" | cut -d. -f1)
          BETA_MINOR=$(echo "$BETA_VERSION" | cut -d. -f2)

          EXPECTED_MAJOR="$MASTER_MAJOR"
          EXPECTED_MINOR="$((MASTER_MINOR + 1))"

          if [[ "$BETA_MAJOR" != "$EXPECTED_MAJOR" ||
                "$BETA_MINOR" != "$EXPECTED_MINOR" ]]; then
            echo "::error::Beta version $BETA_VERSION is not the next minor version after master GA $MASTER_VERSION."
            echo "::error::Expected: ${EXPECTED_MAJOR}.${EXPECTED_MINOR}.0bN"
            exit 1
          fi

Comment thread .github/workflows/validate_branch.sh
Copilot AI review requested due to automatic review settings September 1, 2026 15:28

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/python-tests.yml:460

  • Preview tag parsing uses sed substitutions that do not fail when the tag doesn't match; in that case PR_NUMBER/ITERATION become the full tag string and the workflow attempts to checkout refs/pull/<tag>/merge (guaranteed failure). Parse + validate in one step and hard-fail with a clear error before checkout.
          TAG="${GITHUB_REF_NAME}"

          PR_NUMBER=$(echo "$TAG" | sed -E 's/^v[0-9]+\.[0-9]+\.[0-9]+a([0-9]+)\.[0-9]+$/\1/')
          ITERATION=$(echo "$TAG" | sed -E 's/^v[0-9]+\.[0-9]+\.[0-9]+a[0-9]+\.([0-9]+)$/\1/')

Comment thread .github/workflows/python-tests.yml
Comment thread .github/workflows/python-tests.yml Outdated
Copilot AI review requested due to automatic review settings September 1, 2026 15:37

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Suppressed comments (4)

Previously missed (2) — in code that hasn't changed since the last review.

.github/workflows/python-tests.yml:460

  • The preview tag parsing uses sed substitutions that return the original tag when the regex doesn’t match. That can produce a non-numeric PR_NUMBER, causing checkout to fail before the later tag validation step runs (poor error signal). Parse/validate in one step and fail with an explicit ::error:: if the tag doesn’t match the expected preview format.
          TAG="${GITHUB_REF_NAME}"

          PR_NUMBER=$(echo "$TAG" | sed -E 's/^v[0-9]+\.[0-9]+\.[0-9]+a([0-9]+)\.[0-9]+$/\1/')
          ITERATION=$(echo "$TAG" | sed -E 's/^v[0-9]+\.[0-9]+\.[0-9]+a[0-9]+\.([0-9]+)$/\1/')

.github/workflows/validate_tag.sh:6

  • With set -u, calling this script with missing arguments fails with an unhelpful “unbound variable” error. Add an explicit usage/argc check (like validate_branch.sh) so failures are reported as a GitHub Actions error annotation.
TAG="$1"
TYPE="$2"

.github/workflows/python-tests.yml:8

  • on.push.tags uses glob matching. This pattern only triggers for tags that happen to look like 3 dotted segments, so malformed tags (which this PR aims to validate) may not trigger the workflow at all. Use a broad trigger (e.g. v*) and rely on the job-level validation scripts to fail with a clear error.
    tags:
      - "v[0-9]*.[0-9]*.[0-9]*"
  pull_request:

.github/workflows/python-tests.yml:16

  • Top-level workflow permissions are very broad (contents/statuses/checks/id-token: write) and are inherited by jobs that don’t override them (e.g. publish-stable/beta). This increases blast radius unnecessarily; prefer least-privilege defaults and grant write permissions only on the specific jobs/steps that need them.
permissions:
  id-token: write
  contents: write
  statuses: write
  checks: write

Comment thread .github/workflows/validate_branch.sh
Copilot AI review requested due to automatic review settings September 2, 2026 07:16

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The workflow currently references non-existent artifact action versions and has needs wiring that will skip key reporting jobs in normal CI runs.

Review details

Suppressed comments (5)

Previously missed (2) — in code that hasn't changed since the last review.

.github/workflows/python-tests.yml:144

  • Because publish-preview is skipped for normal branch/PR runs, having it in needs causes this job to be skipped as well. If the report should run for regular CI, drop publish-preview from needs (or otherwise make it non-optional).

This issue also appears on line 184 of the same file.
.github/workflows/python-tests.yml:455

  • This step extracts PR_NUMBER/ITERATION before any validation. If the tag doesn't strictly match the preview format, the sed commands return the full tag string and the checkout ref becomes invalid (or points to an unintended ref). Parse with a regex and fail fast on mismatch.

.github/workflows/validate_tag.sh:6

  • With set -u, calling this script with missing args will fail with an unhelpful "unbound variable" error. Add an explicit argc/usage check before reading $1/$2 so the workflow emits a clear ::error:: message.
TAG="$1"
TYPE="$2"

.github/workflows/python-tests.yml:16

  • Workflow-level permissions grant write access to contents/statuses/checks for all jobs that don't override permissions (including publish jobs). Narrow the default to least-privilege and keep write scopes only on the specific jobs that need them.
permissions:
  id-token: write
  contents: write
  statuses: write
  checks: write

.github/workflows/python-tests.yml:186

  • Because publish-preview is skipped for normal branch/PR runs, having it in needs causes this job to be skipped as well. If coverage should run for regular CI, drop publish-preview from needs (or otherwise make it non-optional).
    needs:
      - build
      - publish-preview
  • Files reviewed: 3/3 changed files
  • Comments generated: 0 new
  • Review effort level: Lite

Copilot AI review requested due to automatic review settings September 2, 2026 07:34

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The workflow trigger and default permissions configuration introduce avoidable operational noise and overly broad write permissions that should be tightened before merging.

Review details

Suppressed comments (2)

.github/workflows/python-tests.yml:7

  • on.push.tags patterns are glob filters (not regex). The current pattern (v[0-9]*.[0-9]*.[0-9]*) still matches many unintended tags (e.g., v1foo.2bar.3) and adds no real safety because tag validity is already enforced by validate_tag.sh in the publish jobs. Prefer a simple v* tag trigger and keep strict validation in the jobs.
    branches: [master]
    tags:
      - "v[0-9]*.[0-9]*.[0-9]*"

.github/workflows/python-tests.yml:16

  • Workflow-level permissions are currently granting broad write access (id-token, contents, statuses, checks) to all jobs, even though most jobs override permissions and publish jobs can operate with read-only repo contents when using an API token. Reduce default permissions to least-privilege and keep write permissions only on the specific jobs that need them.
permissions:
  id-token: write
  contents: write
  statuses: write
  checks: write
  • Files reviewed: 3/3 changed files
  • Comments generated: 0 new
  • Review effort level: Lite

AndreaCuneo
AndreaCuneo previously approved these changes Sep 2, 2026
arkcecchi
arkcecchi previously approved these changes Sep 2, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The workflow currently references non-existent action versions (actions/*-artifact@v7) and has brittle script invocations that can fail if executable bits aren’t set.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (4)

.github/workflows/python-tests.yml:8

  • on.push.tags is a glob pattern, and v[0-9]*.[0-9]*.[0-9]* does not mean “digits only” (e.g. [0-9]* matches a digit followed by any characters). This filter is harder to reason about and doesn’t reliably communicate intent; rely on the job-level tag validators instead.
  push:
    branches: [master]
    tags:
      - "v[0-9]*.[0-9]*.[0-9]*"
  pull_request:

.github/workflows/python-tests.yml:16

  • Top-level workflow permissions are very broad (contents/statuses/checks/id-token write) and apply to all jobs/events; this violates least-privilege and increases blast radius if a job is compromised. Prefer contents: read globally and grant write permissions only on the specific jobs/steps that need them.
permissions:
  id-token: write
  contents: write
  statuses: write
  checks: write

.github/workflows/python-tests.yml:335

  • These scripts are invoked directly; that requires the executable bit to be set in git. To avoid workflow failures due to file mode differences, invoke them explicitly via bash.
        run: .github/workflows/validate_tag.sh "$GITHUB_REF_NAME" beta

      - name: "Validate release commit is contained in develop-beta"
        shell: bash
        run: .github/workflows/validate_branch.sh "develop-beta"

.github/workflows/python-tests.yml:475

  • This script is invoked directly; that requires the executable bit to be set in git. To avoid workflow failures due to file mode differences, invoke it explicitly via bash.
      - name: "Validate PR Preview tag"
        shell: bash
        run: .github/workflows/validate_tag.sh "$GITHUB_REF_NAME" preview
  • Files reviewed: 3/3 changed files
  • Comments generated: 1
  • Review effort level: Lite

Comment thread .github/workflows/python-tests.yml Outdated

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The workflow’s tag trigger pattern won’t run on PR preview tags and the workflow-level permissions are overly broad.

Review details

Suppressed comments (2)

.github/workflows/python-tests.yml:16

  • Workflow-level permissions are overly broad (id-token: write, contents: write, statuses: write, checks: write) and apply to all jobs by default, increasing blast radius if any job is compromised. Set a minimal workflow default (e.g. contents: read) and keep elevated permissions only on the specific jobs that require them.
permissions:
  id-token: write
  contents: write
  statuses: write
  checks: write

.github/workflows/python-tests.yml:7

  • on.push.tags filter won’t match PR preview tags like v4.3.0a69.1 (extra .1 segment), so the workflow won’t run for preview releases. Also the current pattern is a glob, not a regex; it’s safer to trigger on all v* tags and rely on the job-level validate_tag.sh checks to gate publish steps.
on:
  push:
    branches: [master]
    tags:
      - "v[0-9]*.[0-9]*.[0-9]*"
  • Files reviewed: 3/3 changed files
  • Comments generated: 0 new
  • Review effort level: Lite

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants