Repository navigation
Conversation
The version/changelog rule was only checked after a tag existed, in the release workflow's verify-release job, so a mismatched tag reached a failed publish before anyone noticed. Move the rule into one script and run it on pull requests too: a PR that changes the workspace version fails until CHANGELOG.md has a '## [X.Y.Z]' heading for it. PRs that leave the version alone pass without checking anything. The release workflow and `mise run release` call the same script, so the three can't drift. The script reads the version from [workspace.package] rather than the first `version =` line, and only accepts the heading at the start of a line. This prepares for release-plz, whose release PR bumps the version while the changelog stays hand-written. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cipherstash-agent
left a comment
cipherstash-agent
left a comment
There was a problem hiding this comment.
Review attestation
Reviewed 9fc1745 · posted from Claude Code (scheduled routine) · claude-sonnet-5-5 · effort medium
Sources: code-review (medium, read of the full diff against head; no subagents) · claude-sonnet-5-5
Skills: code-review, review-cross-check, review-post
No findings.
Checked: workspace-version parsing under [workspace.package], the ## [X.Y.Z] prefix match (3.0.1 vs 3.0.10), check-pr against the fetched base ref, the release.yml and mise run release call sites, and the test script's temp-repo cleanup. The PR had no existing review feedback to cross-check. The script and tests were not executed in this run.
Generated by Claude Code
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Toby
Summary
A PR that changes the workspace version now fails a new
Release metadatacheck untilCHANGELOG.mdhas a## [X.Y.Z]heading for the new version.Until now that rule ran only after tagging, in the release workflow's
verify-releasejob, so a mismatched tag got as far as a failed publish.PRs that don't touch the version pass without checking anything.
This is groundwork for release-plz: its release PR will bump the version, and a person renames
## [Unreleased]in that PR before merging, because the changelog stays hand-written.Changes
.github/scripts/release-metadata.sh: one script withversion,check [vX.Y.Z]andcheck-pr BASE_REF.It reads the version from
[workspace.package](not the firstversion =line in the file) and only accepts the changelog heading at the start of a line, so3.0.1no longer counts as a section for3.0.10..github/scripts/release-metadata.test.sh: 15 cases in throwaway git repos, run bymise run test:release-metadataand in CI..github/workflows/release-metadata.yml: runs on every PR (no branch or path filter, so it always reports), tests the script, then runscheck-pragainst the base branch.release.ymlverify-releaseandmise run releasenow call the same script instead of their own copies of the check.DEVELOPMENT.md: documents the PR check.Verification
bash .github/scripts/release-metadata.test.sh: 15/15 pass. The tests were written first and failed before the script existed.shellcheckis clean on both scripts.release-metadata.sh checkandcheck v3.0.1pass on current main.## [3.0.2]section was added, it passed.Review notes
verify-releasenow rejects a tag that isn'tvX.Y.Z[-pre].mise run releasealready enforced that format.Acknowledgment
By submitting this pull request, I confirm that CipherStash can use, modify, copy, and redistribute this contribution, under the terms of CipherStash's choice.
🤖 Generated with Claude Code