Repository navigation
ci: harden CI and releases, refresh governance docs - #271
Conversation
Pin every GitHub Action to a full commit SHA, run on push, pull_request and merge_group with read-only default permissions, and split the Windows clippy and test legs so they run in parallel behind a strict CI Success gate. Replace release-please.yml with release.yml: one same-run, draft-until-green pipeline that waits for exact-SHA CI, builds and smoke-tests six platform archives, publishes SHA256SUMS and build attestations, and verifies the remote assets before the draft is published. Release notes come from release-please only; git-cliff and version.txt are retired. The shell and PowerShell installers now always verify the downloaded archive against SHA256SUMS; the CODEGRAPH_SKIP_CHECKSUM bypass is removed. Add make check / make pre-ci as the single local and CI entry point, with docs-check, workflow lint, action-pin and script-contract fixtures. Rewrite the English and Chinese README landing pages, consolidate agent guidance in AGENTS.md with a CLAUDE.md import, add contributor, security and conduct documents, and record the 2026-09-15 upstream audit.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d5419734e4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| needs: release-please | ||
| if: needs.release-please.outputs.build_artifacts == 'true' | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 35 |
There was a problem hiding this comment.
When release CI takes longer than 35 minutes, this job is terminated before it can observe a valid result: the required linux and windows-test jobs allow 45 and 40 minutes respectively, and the polling body itself permits up to 60 minutes. A slow but successful tag build therefore leaves the release as a draft and requires manual recovery; set this timeout above the longest required CI path plus scheduling overhead.
AGENTS.md reference: AGENTS.md:L179-L182
Useful? React with 👍 / 👎.
| status=((cov.get('coverage') or {}).get('status') or {}) | ||
| for name,cfg in status.items(): |
There was a problem hiding this comment.
If coverage.status is removed or becomes empty, status becomes {} and this loop performs no checks, after which the guard still reports coverage (informational). That allows a future configuration edit to silently restore Codecov's default status behavior while coverage remains excluded from CI Success; require a non-empty status mapping before iterating, as the previous implementation did.
AGENTS.md reference: AGENTS.md:L155-L157
Useful? React with 👍 / 👎.
taiki-e/install-action has no actionlint manifest, so the pinned release binary is now downloaded and accepted only on a pinned SHA-256 match. The workspace-version gate strips the CR that Windows jq appends to every output line, and the coverage job no longer inherits a sccache wrapper it never configures.
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #271 +/- ##
==========================================
- Coverage 95.34% 95.34% -0.01%
==========================================
Files 145 145
Lines 85751 85751
==========================================
- Hits 81763 81760 -3
- Misses 3988 3991 +3 see 1 file with indirect coverage changes 🚀 New features to boost your workflow:
|
ShellCheck 0.9.0 on the hosted runner reports SC2015 for the A && B || C form; newer local releases do not.
rust-toolchain.toml, every CI and release job, the scaffold placeholder, and the MSRV (Cargo rust-version and clippy msrv) move from 1.96 to 1.98 together, as #271 set them. Building from source now needs Rust 1.98 or newer. Local shells that export RUSTUP_TOOLCHAIN=1.98.0 now build with the toolchain CI uses.
Summary
First of two PRs that land the 2026-09-15 upstream-sync and engineering work. This one carries only engineering and governance changes; no graph, resolver, CLI, or MCP behavior changes.
.github/workflows/ci.yml): every action pinned to a full commit SHA;push,pull_requestandmerge_grouptriggers; read-only default permissions andpersist-credentials: false; explicitubuntu-24.04/windows-2025runners; Windows clippy and tests run in parallel; strictCI Successgate over all required jobs; coverage stays informational..github/workflows/release.yml, replacesrelease-please.yml): one same-run, draft-until-verified pipeline — exact tag-SHACI Successwait, six platform build/package/unpack/smoke legs,SHA256SUMS, build attestations, remote asset verification, then publication. Release notes come from release-please only; git-cliff andversion.txtare retired. release-please keepsrelease-type: simplewith explicit extra-files, because the virtual workspace has no root[package].scripts/install.shandscripts/install.ps1always verify the archive againstSHA256SUMS; theCODEGRAPH_SKIP_CHECKSUMbypass is removed and a missing hash tool, sums file, or entry fails the install.make check/make pre-ciare the single entry point (version consistency, tool versions, rustfmt + oxfmt, docs-check, workflow lint, clippy, tests, release build, guardrail, script fixtures, archive smoke). The pre-push hook calls the same target.rust-toolchain.tomlpins 1.96.0.publish = false.AGENTS.mdrewritten as the single agent guide withCLAUDE.md=@AGENTS.md,docs/AGENTS.md,docs/README.md, benchmark method,CONTRIBUTING.md,SECURITY.md, Code of Conduct, issue/PR templates, Dependabot and CODEOWNERS. The 2026-09-15 upstream audit (POST_V1_6_MAIN_2026-09-15.md) and its ledger entry are recorded; nothing is marked implemented or LANDED.Docs that describe behavior shipped by the follow-up product PR (architecture, CLI, MCP, languages, equivalence) keep their current text here and move with that PR, so
mainstays AS-BUILT.Verification
env -u RUSTUP_TOOLCHAIN make pre-cion this tree: all checks passed; 3,578 tests passed, 0 failed; archive smoke printscodegraph 0.50.3. The pre-push hook re-ran the same gate before the push.cargo audit --no-yanked: no vulnerabilities (448 crates).python3 scripts/docs-check.py: OK (33 markdown files).cargo metadata --locked: lockfile consistent with the manifests.The release pipeline itself is proven only by the next real release; remote repository settings are unchanged.
BEGIN_COMMIT_OVERRIDE
fix(install)!: always verify release archive checksums
The CODEGRAPH_SKIP_CHECKSUM bypass is removed; a missing hash tool, SHA256SUMS file, or matching entry now fails the install.
fix(deps): update rustls to 0.23.45 for RUSTSEC-2026-0285
ci: pin actions to full SHAs and gate on a strict CI Success check
ci: publish releases from one draft-until-verified run with checksums and attestations
docs: rewrite the README landing pages and consolidate agent guidance in AGENTS.md
END_COMMIT_OVERRIDE
🤖 Generated with Claude Code