fix(release): develop to main

[bedatty]

GitHub Actions Shared Workflows

---

Description

Type of Change

• feat: New workflow or new input/output/step in an existing workflow
• fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
• perf: Performance improvement (e.g. caching, parallelism, reduced steps)
• refactor: Internal restructuring with no behavior change
• docs: Documentation only (README, docs/, inline comments)
• ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
• chore: Dependency bumps, config updates, maintenance
• test: Adding or updating tests
• BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None.

Testing

• YAML syntax validated locally
• Triggered a real workflow run on a caller repository using @this-branch or the beta tag
• Verified all existing inputs still work with default values
• Confirmed no secrets or tokens are printed in logs
• Checked that unrelated workflows are not affected

Caller repo / workflow run:

Related Issues

Closes #

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: c1da3f4d-2af8-40ed-b2a4-157134226a04

📥 Commits

Reviewing files that changed from the base of the PR and between 720f1eb and 143c30e.

📒 Files selected for processing (2)

• src/validate/ungoliant-release-diff/README.md
• src/validate/ungoliant-release-diff/action.yml

---

Summary by CodeRabbit

• New Features
  • Added optional “Ungoliant release diff” phase for Go and JavaScript/TypeScript tag releases, with configurable app/environment/controller settings and authenticated webhook support.
  • Added release-diff integration that reports analysis status, risk, and outcomes, plus detailed CI documentation.
• Security
  • Improved pre-release detection via an optional prerelease regex override.
  • Updated security and scanning workflow action versions.
• Documentation
  • Documented Ungoliant release-diff usage and configuration options for both Go and JS/TS release workflows.

Walkthrough

The change adds an Ungoliant release-diff action and integrates it into Go and JavaScript release workflows, adds configurable prerelease detection with regex validation, and updates pinned Docker, CodeQL, and TruffleHog actions.

Changes

Ungoliant release diff

Layer / File(s)	Summary
Action contract and diff preparation src/validate/ungoliant-release-diff/action.yml, src/validate/ungoliant-release-diff/README.md	Defines inputs and outputs, resolves tags and environments, fetches and bounds diffs, and builds the webhook payload.
Controller execution and reporting src/validate/ungoliant-release-diff/action.yml	Health-checks the controller, supports dry runs, posts release diffs, computes outcomes, and upserts pull-request comments.
Release workflow integration .github/workflows/go-release.yml, .github/workflows/js-release.yml	Adds configurable inputs and secrets, tag-based gates, environment derivation, and Ungoliant job invocation.
Workflow documentation docs/go-release-workflow.md, docs/js-release.md	Documents inputs, secrets, trigger conditions, environment mapping, examples, and related action references.

Configurable prerelease detection

Layer / File(s)	Summary
Pattern override and validation src/security/prerelease-check/action.yml	Adds an optional pattern input, allowlist default, malformed-regex fallback, and Dockerfile matching integration.
Workflow wiring and policy documentation .github/workflows/pr-security-scan.yml, src/security/prerelease-check/README.md, docs/pr-security-scan-workflow.md	Passes PRERELEASE_PATTERN into the action and documents the override and default detection policy.

Pinned action updates

Layer / File(s)	Summary
Workflow action revisions .github/workflows/build.yml, .github/workflows/gitops-update.yml, .github/workflows/go-pr-analysis.yml, .github/workflows/go-security.yml, .github/workflows/pr-security-scan.yml	Updates pinned Docker, CodeQL, and TruffleHog action revisions without changing the surrounding workflow configuration.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• LerianStudio/github-actions-shared-workflows#216: Touches the same prerelease-check composite action and related documentation.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title is release-related but describes the branch merge rather than the workflow changes, so it is misleading for this changeset.	Rename it to summarize the actual workflow update, e.g. "fix(release): add Ungoliant release-diff and tighten release gates".
Description check	⚠️ Warning	The template is mostly unfilled: the Description, Testing, and Related Issues sections are missing concrete details.	Add a real summary of affected workflows and behavior, complete the testing checklist with validation evidence, and link the related issue.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch develop

---

_{Comment @coderabbitai help to get the list of available commands.}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	9 file(s)	✅ success
Action Lint	7 file(s)	✅ success
Pinned Actions	9 file(s)	✅ success
Markdown Link Check	5 file(s)	✅ success
Spelling Check	14 file(s)	✅ success
Shell Check	9 file(s)	✅ success
README Check	9 file(s)	✅ success
Composite Schema	2 file(s)	✅ success
Deployment Matrix	no changes	⏭️ skipped

---

_{🔍 View full scan logs}

[lerian-studio]

🛡️ CodeQL Analysis Results

Languages analyzed: actions

Found 3 issue(s): 3 Medium

Severity	Rule	File	Message
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/gitops-update.yml:160	Potential unsafe checkout of untrusted pull request on non-privileged workflow.
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/gitops-update.yml:172	Potential unsafe checkout of untrusted pull request on non-privileged workflow.
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/build.yml:270	Potential unsafe checkout of untrusted pull request on non-privileged workflow.

---

_{🔍 View full scan logs | 🛡️ Security tab}

[coderabbitai]

Warning

CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.

Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.

👉 Steps to fix this

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/security/prerelease-check/action.yml`:
- Around line 68-81: The prerelease matching pattern incorrectly treats hyphens
as a terminating boundary, missing valid tags such as v1.2.3-beta-1 and
golang:1.21.0-beta1-alpine. Update the pattern and its usage in the
prerelease-check action to detect hyphenated SemVer identifiers, preferably by
separating Go/npm and Docker matching rules, while retaining the -devtools
false-positive protection. Add tests covering both missed cases and the existing
protection.

In `@src/validate/ungoliant-release-diff/action.yml`:
- Around line 248-259: Move the “Health check controller” step to immediately
after the “Resolve config” step, before any GitHub API calls that fetch tags,
comparisons, or diffs. Preserve its existing curl command, timeout, error
handling, and environment configuration so controller availability is validated
before expensive operations begin.
- Around line 148-151: Update the read-only GitHub API curl calls in the tags,
compare, and diff sections to include --retry 2 --retry-delay 2 alongside their
existing timeout and failure options; do not add retries to the webhook POST
call.
- Around line 145-162: Update the previous-tag resolution block around PREV and
the tags API call so it no longer relies on GitHub’s /tags response order or a
single page. Prefer requiring an explicit PREVIOUS value; otherwise paginate all
relevant tags and sort them deterministically according to the project’s version
scheme before selecting the tag immediately preceding VERSION. Preserve the
existing error and resolved-tag messages, and ensure the fallback fails clearly
when no valid predecessor exists.

In `@src/validate/ungoliant-release-diff/README.md`:
- Around line 53-59: Update the canonical “Required permissions” and “Usage as
composite step” examples in the README to grant pull-requests: write alongside
contents: read, matching the documented PR-comment requirement and ensuring
copied configurations enable comment posting.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2f8ace83-7801-4d11-8007-7756d5116c70

📥 Commits

Reviewing files that changed from the base of the PR and between e64a642 and 720f1eb.

📒 Files selected for processing (14)

• .github/workflows/build.yml
• .github/workflows/gitops-update.yml
• .github/workflows/go-pr-analysis.yml
• .github/workflows/go-release.yml
• .github/workflows/go-security.yml
• .github/workflows/js-release.yml
• .github/workflows/pr-security-scan.yml
• docs/go-release-workflow.md
• docs/js-release.md
• docs/pr-security-scan-workflow.md
• src/security/prerelease-check/README.md
• src/security/prerelease-check/action.yml
• src/validate/ungoliant-release-diff/README.md
• src/validate/ungoliant-release-diff/action.yml