fix(release): ignore fork PRs in dev bump guard

[luvs01]

Summary

Prevent fork-origin pull requests from satisfying the dev version-bump workflow's repository-owned idempotency guard.

Problem

The release workflow checks for an existing bump pull request with:

gh pr list --base dev --head "${branch}"

The --head filter matches pull requests by branch name, including heads from forks. Because the generated codex/dev-version-${NEXT_VERSION} name is predictable, a fork pull request using that name can make the check exit early even though the repository-owned bump has not been queued.

Changes

• Query the repository pulls endpoint with state, base, and repository-owner-qualified head filters applied on the server.
• Limit the already-scoped response to one result instead of filtering a paginated client-side list.
• Add regression coverage that pins the server-side owner filter and rejects the prior client-side query.

Verification

Rebased onto current dev and re-ran the local gates on the rebased head 871ae50:

• bun test tests/bump-dev-version.test.ts — 10 pass, 1 skip, 0 fail, 39 expect() calls (Bun 1.4.0). The single skip is the platform-conditional unwritable-target case.
• bun run typecheck (bun x tsc --noEmit) — clean, no diagnostics.
• git diff --check and git diff 330d6c4..HEAD --check — clean, no whitespace errors.
• Live GitHub API readback confirmed that a fork PR can share the branch name while an owner-qualified head selects only the repository-owned branch.
• Exact rebase readback confirmed HEAD 871ae50 has current dev 330d6c4 as its parent, is exactly 1 commit ahead of dev, and touches exactly 2 files (.github/workflows/dev-version-bump.yml, tests/bump-dev-version.test.ts).
• The rebase was a content-preserving replay: the diff against the new base hashes identically to the diff against the old base (git hash-object a47ac52 before and after), and the patch ID is still the reviewed cc096d7.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

No documentation or release-note change is needed because this is a release-workflow guard correction with focused regression coverage.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes
  • Improved reliability of automated development-version pull request checks by applying repository and branch filters directly when querying open pull requests.
  • Prevented incorrect matches from pull requests originating outside the repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: c43b2026-cc2d-4911-9e75-1bed4823fba7

📥 Commits

Reviewing files that changed from the base of the PR and between 5364ce0 and 871ae50.

📒 Files selected for processing (2)

• .github/workflows/dev-version-bump.yml
• tests/bump-dev-version.test.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The workflow now uses the GitHub API to detect open pull requests with a repository-owned head filter. The test reads the workflow and verifies the API query parameters and removal of the previous gh pr list logic.

Changes

Development version bump

Layer / File(s)	Summary
Open pull request query and validation .github/workflows/dev-version-bump.yml, tests/bump-dev-version.test.ts	The workflow queries repos/${GITHUB_REPOSITORY}/pulls with state=open, base=dev, an owner-scoped head, per_page=1, and --jq 'length'. The test verifies these filters and rejects gh pr list and isCrossRepository usage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 871ae

The development version-bump guard now ignores same-named fork pull requests while continuing to recognize repository-owned bump pull requests. The change is narrowly scoped with matching regression coverage and no remaining merge-blocking risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing fork pull requests from satisfying the development version-bump guard.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: .github/workflows/dev-version-bump.yml.

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request has been marked Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently.
Maintainers notified: @lidge-jun @Ingwannu

[luvs01]

@Ingwannu Could you review this focused release-workflow guard and apply the maintainer-sponsored label if the boundary is acceptable? The change only filters the existing PR idempotency query by isCrossRepository and adds a regression. Focused Bun verification is 10 pass, 1 platform-conditional skip, 0 fail; live readback confirmed fork heads are excluded while same-repository heads remain counted; an independent focused review found no permissions, quoting, fail-open, or TOCTOU regression.

[lidge-jun]

리뷰 · 우선순위 63 / 80

설명

이 PR은 dev 버전 bump 워크플로의 “이미 bump PR이 열려 있으면 아무것도 하지 않는다”는 멱등 가드가, 같은 이름의 포크 PR에도 속아 early-exit 할 수 있는 구멍을 막는다. 지금 dev HEAD ff1ac6b8c의 .github/workflows/dev-version-bump.yml은 대략 이렇게 센다: gh pr list --base dev --head "${branch}" --state open --json number --jq 'length'. 여기서 ${branch}는 codex/dev-version-${NEXT_VERSION}처럼 예측 가능하다. gh pr list --head는 브랜치 이름만 보므로, 포크가 같은 이름으로 PR을 열어 두면 길이이 0이 아니게 되어 저장소 소유 bump가 조용히 생략될 수 있다.

패치는 isCrossRepository를 같이 받아 [.[] | select(.isCrossRepository == false)] | length로 같은 저장소 헤드만 센다. 테스트는 워크플로 파일에 그 쿼리 문자열이 들어 있는지 고정한다. 방향은 맞다. 릴리즈 자동화·워크플로 표면이라 intake: hygiene-blocked / unsponsored_surface가 걸린 것도 MAINTAINERS.md 규칙과 일치한다. draft이고 체크리스트가 비어 있으며 review-ready가 없다. enforce-target도 실패한 상태다.

dev가 방금 Meta 직접 프로바이더(#3321)를 받은 뒤라 버전 bump 멱등은 릴리즈 열차와 직접 맞닿아 있다. 제품 코드는 안 건드린다. types/config 분할과 무관하다. 다만 메인테이너 스폰서 없이 머지할 표면이 아니다.

.github/workflows/dev-version-bump.yml open_prs 가드 - isCrossRepository == false 필터는 “포크가 예측 가능한 bump 브랜치 이름으로 가드를 선점”하는 실패 모드를 직접 제거한다. 주석도 그 위협을 설명한다.

tests/bump-dev-version.test.ts - 워크플로 소스 문자열 containment라 동작 통합 테스트는 아니다. 이 저장소의 다른 워크플로 가드 테스트 스타일과는 같고, 쿼리가 되돌아가면 깨진다. gh 필드명이 바뀌는 날까지는 버티지만, mock list fixture까지는 없다.

draft + 미체크 체크리스트 + hygiene unsponsored_surface - 코드 리뷰와 별개로 게이트가 막아 둔 상태다. 내용이 맞아도 스폰서 라벨과 ready 전환이 필요하다.

메인테이너의 판단이 필요한 지점

• 보안/릴리즈 리뷰 후 maintainer-sponsored를 붙일지 (워크플로 표면이라 규칙상 필요)
• draft를 유지한 채 스폰서만 할지, 체크리스트를 채우고 ready로 올린 뒤 머지할지
• 문자열 containment 테스트로 충분한지, 아니면 isCrossRepository fixture JSON을 한 줄 넣는 단위 테스트를 더 요구할지

너의 추천
내용은 머지할 가치가 있다. 예측 가능한 bump 브랜치 이름을 포크가 가로채 early-exit 하는 것은 실제 릴리즈 멱등 버그 후보다. 다만 지금 상태로는 머지하지 말고, 메인테이너가 워크플로 diff를 확인한 뒤 maintainer-sponsored를 붙이고, 체크리스트를 채운 다음 draft를 해제한 뒤에 랜딩하는 편이 맞다. 테스트 강화는 필수는 아니다.

이 댓글은 grok-bot이 작성했습니다

[luvs01]

@Ingwannu Correction to my sponsorship note above: the current patch no longer uses isCrossRepository. It now scopes the server-side pulls query with base=dev and the repository-owner-qualified head=${owner}:${branch}, then limits the response to one result. I rebased the unchanged patch onto current dev (8b60e4c; PR head e0491c4); the focused test remains 10 pass, 1 platform-conditional skip, 0 fail, and git diff HEAD^..HEAD --check is clean. The sponsorship request is unchanged.

[lidge-jun]

Triaged in the 260904 bug-backlog closeout, and sponsored as maintainer.

The fix is correct. The old branch-name-only gh pr list lookup could be satisfied by a same-named branch on a fork, so a fork PR could make the repository-owned idempotency guard believe a bump already existed. Qualifying head with the repository owner in the server-side query fixes that at the source, and per_page=1 is safe once the filter is exact.

Both failing checks report unsponsored_surface for one reason: .github/workflows/dev-version-bump.yml is a release-automation surface, which AGENTS.md routes to explicit maintainer security review. I have reviewed it as that reviewer. The change adds no new permissions, introduces no new secret usage, pins no mutable third-party action, and narrows rather than widens what the guard accepts. I am applying maintainer-sponsored on that basis.

Rebase onto current dev and tick the readiness boxes, and the two checks should go green on the next run.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[lidge-jun]

Approving, with the maintainer security review this surface requires.

.github/workflows/dev-version-bump.yml is release automation, which AGENTS.md routes to explicit review — I sponsored it earlier and I am the reviewer here. The change adds no permissions, introduces no new secret usage, pins no mutable third-party action, and narrows what the idempotency guard accepts rather than widening it. Qualifying head with ${GITHUB_REPOSITORY_OWNER} on the server is the correct fix: a same-named fork branch could previously satisfy a check meant to detect this repository's own open bump PR, and per_page=1 is safe once the filter is exact.

The workflow regression asserting the block's shape is a good call, since this is a path no test can execute directly. bun test tests/bump-dev-version.test.ts is 10 pass / 1 skip / 0 fail.