[silverbucket]

Summary

• release.md — maintainer docs: environment setup, cut-a-release, version bumps, protected master / Makefile PR flow
• README.md — removed the Releasing section; Install from a release stays for end users
• .github/workflows/release.yml — protected-master behavior from Release workflow: respect protected master (no direct push) #14 (no direct push; infer version from latest release; Makefile sync PR) + comment points to release.md

Supersedes/closes the workflow half of #14; merge this instead of #14 if you want both fixes in one PR.

  

Summary by CodeRabbit

• Documentation

  • Added a new end-to-end release guide and clarified configuration notes; removed the old release section from the main README.
  • Clarified that scan_skip is applied at report time and affects diffs/status/alerts immediately.

• Chores

  • Updated release workflow to compute version from the latest published release with a safe fallback, run publish steps first, then create a post-publish branch/PR to update the repository version, and improved workflow permissions for PR automation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 45a38564-4af0-4bda-96a3-7ecda3893541

📥 Commits

Reviewing files that changed from the base of the PR and between 378170b and ea4bf12.

📒 Files selected for processing (1)

• .github/workflows/release.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

The release workflow is refactored to source the current version from the latest published GitHub release tag (with Makefile fallback), add PR write permissions, remove direct Makefile edits on master, and introduce a post-publish PR workflow to sync the Makefile VERSION. Release documentation moves from README to a dedicated release.md file.

Changes

Release Workflow Restructuring and Documentation

Layer / File(s)	Summary
Workflow input and permissions update .github/workflows/release.yml	The workflow_dispatch bump input description was updated to reflect versioning from the latest GitHub release tag. Pull-requests write permission was added to enable subsequent PR creation and merge operations.
Version detection from GitHub releases with fallback .github/workflows/release.yml	The "Compute release version" step now queries the latest published GitHub release via gh release list (with GH_TOKEN), parses the semver from that tag when available, and falls back to Makefile VERSION only when no releases exist. Semver format validation is retained. The prior Makefile-derived current-version log was removed.
Release flow restructuring to PR-based version sync .github/workflows/release.yml	Removed the previous step that directly edited and committed the Makefile on master. Added a new post-publish step that creates a chore/bump-version-* branch, updates the Makefile VERSION, pushes the branch, opens a PR, and attempts auto-merge (with fallback to manual review).
Release documentation updates README.md, release.md	Removed the "## Releasing" section from README.md. Added comprehensive release.md documentation covering repository setup (release environment), workflow execution (patch/minor/major bumps), version source behavior (latest GitHub release tag with Makefile fallback), and the post-publish PR flow for Makefile synchronization.

Sequence Diagram(s)

Not applicable. The changes are workflow configuration updates and documentation migration without distinct multi-component interactions that would benefit from sequence visualization.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• silverbucket/dwatch#13: Both PRs modify .github/workflows/release.yml's version-bump logic and use Makefile VERSION/semver with tag computation as part of the release workflow.
• silverbucket/dwatch#12: Both PRs modify .github/workflows/release.yml's release-version/tag derivation and validation logic around GitHub release tag handling.

Poem

🐰 Release workflows hop with new grace,
GitHub tags lead the pace,
Makefile falls back when tags are shy,
PRs now sync VERSION on high,
Docs migrate to files so spry!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and accurately summarizes the two main changes: moving release documentation to a new file and fixing the protected-master workflow implementation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/release-md-docs-91b9

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Stale comment

Security review complete: no medium, high, or critical vulnerabilities found in the added or modified workflow/docs.

Reviewed the release workflow changes for privilege expansion, secret exposure, command injection, and branch/protection bypass. The workflow-dispatch input remains a bounded choice, version/tag/branch values are derived from validated X.Y.Z numeric components, actions are pinned, and the release environment gate is preserved. No prior automation review threads were present to re-report.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 46-53: The current LATEST_TAG selection can pick
drafts/prereleases like v1.4.0-rc1 which breaks semver checks; update the gh
release list invocation used to set LATEST_TAG so it excludes drafts and
prereleases and only returns a semver tagName (e.g., add --exclude-drafts
--exclude-prereleases and/or a jq filter to match ^v[0-9]+\.[0-9]+\.[0-9]+$),
keeping the rest of the fallback to reading Makefile VERSION into CURRENT
unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 39858bac-06f8-45cd-8400-1e5512950c0f

📥 Commits

Reviewing files that changed from the base of the PR and between 4914449 and 378170b.

📒 Files selected for processing (3)

• .github/workflows/release.yml
• README.md
• release.md

💤 Files with no reviewable changes (1)

• README.md

[cursor]

Security review complete: no medium, high, or critical vulnerabilities found in the added or modified workflow/docs.

Validated the current release workflow changes for command injection, privilege expansion, secret leakage, and protected-branch bypass. The new privileged operations only consume workflow choice input or semver-filtered version/tag values, actions remain pinned, the release environment gate remains in place, and the previous workflow reliability thread is already addressed/resolved. No new finding comments are being left.

  

_{Sent by Cursor Automation: Find vulnerabilities}