GH#34710: pin reviewed aggregate for release recovery behind main by marcusquinn · Pull Request #34743 · marcusquinn/aidevops

marcusquinn · 2026-10-15T00:57:16Z

Summary

recover-aggregate gains --aggregate-commit SHA. The release worktree is checked out at the pinned reviewed aggregation merge, which must be an ancestor of origin/main and carry its immutable aggregator manifest; resolve-source --pinned-aggregate keeps every PR-record, reviewed-base and manifest check. version-manager accepts the pin only for recover-aggregate (remote-sync, provenance and bump-parent checks), and the replacement tag records a signed Aidevops-Aggregate-Pin trailer so protected-main publication may trail main only for that exact aggregate parent and matching aggregator PR. Pinned recovery runs the operator's installed tooling because the pin can predate pin support. Docs: corrected the stale claim that ordinary merges are blocked during recovery (lane merge guard is a no-op since #31472). Files: release-provenance-helper.sh, full-loop-release-helper.sh, full-loop-release-aggregate-recovery.sh, version-manager.sh, version-manager-git.sh, version-manager-release.sh, version-manager-protected-main.sh, reference/release-aggregation-recovery.md.

Files Changed

.agents/reference/release-aggregation-recovery.md, .agents/scripts/full-loop-release-aggregate-recovery.sh, .agents/scripts/full-loop-release-helper.sh, .agents/scripts/release-provenance-helper.sh, .agents/scripts/tests/test-full-loop-release-aggregate-recovery.sh, .agents/scripts/tests/test-version-manager-protected-main-fallback.sh, .agents/scripts/version-manager-git.sh, .agents/scripts/version-manager-protected-main.sh, .agents/scripts/version-manager-release.sh, .agents/scripts/version-manager.sh

Runtime Testing

Risk level: Critical
Verification: runtime-verified — Runtime: the real resolver, recovery preparation (detached worktree at the pin) and signed-tag publication gate were executed against real git repositories with real SSH-signed tags. test-full-loop-release-aggregate-recovery.sh passes including new pinned cases (exact tip refused after an ordinary merge; pin resolves; non-aggregate pin, snapshot+pin, rewritten main and unmerged side-commit pins refused). test-version-manager-protected-main-fallback.sh passes including signed pin acceptance and refusal of mismatched aggregator PR, wrong pin and unpinned aggregate. shellcheck clean; 17 related release/version-manager suites pass locally. test-version-manager-aggregate-recovery.sh and test-release-snapshot-migration.sh fail identically on unmodified origin/main locally (signing-preflight environment: gh admin:ssh_signing_key scope), so CI is authoritative for those. Production verification follows merge: pinned recovery of v3.39.31 against reviewed aggregate chore(release): aggregate v3.39.31 recovery after #34682 and #34688 #34690.

Resolves #34710

aidevops.sh v3.39.31 plugin for OpenCode v1.19.0 with claude-opus-5-5 spent 8h 30m and 539,792 tokens on this with the user in an interactive session.

Exact-tip aggregate recovery starved while ordinary merges outpaced aggregate CI. recover-aggregate now accepts --aggregate-commit SHA: the reviewed aggregation merge must be an ancestor of origin/main and carry its immutable manifest; every PR-record, reviewed-base and manifest check still applies. The replacement tag records a signed Aidevops-Aggregate-Pin so protected-main publication may trail main only for that exact aggregate parent. Pins are honoured only by recovery. Resolves #34710

coderabbitai · 2026-10-15T00:57:26Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 1

🚫 Excluded labels (none allowed): 1

no-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: marcusquinn/aidevops/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 8ea81e48-3dc3-4d50-9dc1-b96a0d1a001c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

marcusquinn · 2026-10-15T00:57:27Z

Completion Summary

What: recover-aggregate gains --aggregate-commit SHA. The release worktree is checked out at the pinned reviewed aggregation merge, which must be an ancestor of origin/main and carry its immutable aggregator manifest; resolve-source --pinned-aggregate keeps every PR-record, reviewed-base and manifest check. version-manager accepts the pin only for recover-aggregate (remote-sync, provenance and bump-parent checks), and the replacement tag records a signed Aidevops-Aggregate-Pin trailer so protected-main publication may trail main only for that exact aggregate parent and matching aggregator PR. Pinned recovery runs the operator's installed tooling because the pin can predate pin support. Docs: corrected the stale claim that ordinary merges are blocked during recovery (lane merge guard is a no-op since Snapshot releases without blocking concurrent PR merges #31472). Files: release-provenance-helper.sh, full-loop-release-helper.sh, full-loop-release-aggregate-recovery.sh, version-manager.sh, version-manager-git.sh, version-manager-release.sh, version-manager-protected-main.sh, reference/release-aggregation-recovery.md.
Issue: fix(release): signed-tag aggregate recovery starves under concurrent merges (exact-tip requirement) #34710
Files changed: .agents/reference/release-aggregation-recovery.md, .agents/scripts/full-loop-release-aggregate-recovery.sh, .agents/scripts/full-loop-release-helper.sh, .agents/scripts/release-provenance-helper.sh, .agents/scripts/tests/test-full-loop-release-aggregate-recovery.sh, .agents/scripts/tests/test-version-manager-protected-main-fallback.sh, .agents/scripts/version-manager-git.sh, .agents/scripts/version-manager-protected-main.sh, .agents/scripts/version-manager-release.sh, .agents/scripts/version-manager.sh
Testing: Runtime: the real resolver, recovery preparation (detached worktree at the pin) and signed-tag publication gate were executed against real git repositories with real SSH-signed tags. test-full-loop-release-aggregate-recovery.sh passes including new pinned cases (exact tip refused after an ordinary merge; pin resolves; non-aggregate pin, snapshot+pin, rewritten main and unmerged side-commit pins refused). test-version-manager-protected-main-fallback.sh passes including signed pin acceptance and refusal of mismatched aggregator PR, wrong pin and unpinned aggregate. shellcheck clean; 17 related release/version-manager suites pass locally. test-version-manager-aggregate-recovery.sh and test-release-snapshot-migration.sh fail identically on unmodified origin/main locally (signing-preflight environment: gh admin:ssh_signing_key scope), so CI is authoritative for those. Production verification follows merge: pinned recovery of v3.39.31 against reviewed aggregate chore(release): aggregate v3.39.31 recovery after #34682 and #34688 #34690.
Key decisions: Explicit pin rather than auto-discovery: the operator names the reviewed aggregate; nothing is inferred from ancestry. Exact-tip behaviour is unchanged when no pin is given. No merge freeze. Extracted _release_provenance_source_head, _release_provenance_dispatch and two full-loop command helpers to keep functions under the 100-line complexity gate.

aidevops.sh v3.39.31 plugin for OpenCode v1.19.0 with claude-opus-5-5 spent 8h 31m and 539,792 tokens on this with the user in an interactive session.

github-actions · 2026-10-15T00:58:19Z

Markdown Lint (changed-line scoped)

No new violations in changed lines (0 pre-existing in touched files — ignored).

Metric	Base (`d6075e8`)	Head (`c04b319`)
Total in touched files	—	0
New (in changed lines)	—	0

codacy-production · 2026-10-15T00:58:22Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

github-actions · 2026-10-15T00:59:24Z

Bash 3.2 Compatibility Regression Gate

✅ No regression — no new bash 3.2-incompatible construct(s).

Metric	Base (`d6075e8`)	Head (`c04b319`)
Total bash 3.2-incompatible construct(s)	0	0

release_signing_preflight required the admin:ssh_signing_key token scope, blocking recovery for an operator whose signing key is registered. The public users/<login>/ssh_signing_keys (and gpg_keys) listing returns the same keys for the authenticated login; the preflight still fails closed on unregistered keys or unavailable reads.

github-actions · 2026-10-15T00:59:27Z

Shell Function Complexity Regression Gate

✅ No regression — no new function(s) >100 lines.

Metric	Base (`d6075e8`)	Head (`c04b319`)
Total function(s) >100 lines	0	0

github-actions · 2026-10-15T00:59:32Z

Qlty Smell Regression Gate

✅ No change — smell count unchanged.

Metric	Base (`d6075e8`)	Head (`c04b319`)	Delta
Total smells	65	65	+0

marcusquinn · 2026-10-15T00:59:59Z

Added c04b3195c2: release_signing_preflight (.agents/scripts/release-signing-helper.sh) now falls back to the public users/<login>/ssh_signing_keys / gpg_keys listing for the authenticated login when user/ssh_signing_keys needs the admin:ssh_signing_key scope.

Why: the pinned recovery of v3.39.31 would have stopped at the signing preflight. The operator's signing key is registered on GitHub, but the gh token has only repo/workflow/admin:org/gist scopes. The fallback returns the same keys for the same login. It still refuses unregistered or different keys and unavailable reads.

Verification: test-release-signing-preflight.sh passes, including new checks that the public listing accepts the registered key and rejects a different key. The real preflight against the operator config prints REAL_PREFLIGHT_OK.

aidevops.sh v3.39.31 plugin for OpenCode v1.19.0 with claude-opus-5-5

github-actions · 2026-10-15T01:05:06Z

🔍 Code Quality Report

�[0;35m[MONITOR]�[0m Code Review Monitoring Report

SonarCloud: 0 bugs, 0 vulnerabilities, 1 code smells

Thu Oct 15 01:02:31 UTC 2026: Code review monitoring started
Thu Oct 15 01:02:31 UTC 2026: SonarCloud - Bugs: 0, Vulnerabilities: 0, Code Smells: 1
Thu Oct 15 01:04:57 UTC 2026: Codacy analysis completed - issues found (exit 2)

📈 Current Quality Metrics

BUGS: 0
CODE SMELLS: 1
VULNERABILITIES: 0

Generated on: Thu Oct 15 01:04:58 UTC 2026

Generated by AI DevOps Framework Code Review Monitoring

github-actions · 2026-10-15T01:06:02Z

Shell Nesting Depth Regression Gate

✅ No regression — no new file(s) with nesting depth >8.

Metric	Base (`d6075e8`)	Head (`c04b319`)
Total file(s) with nesting depth >8	0	0

github-actions · 2026-10-15T01:06:10Z

File Size Regression Gate

✅ No regression — no new non-README Markdown file(s) >1000 lines at root / >500 elsewhere.

Metric	Base (`d6075e8`)	Head (`c04b319`)
Total non-README Markdown file(s) >1000 lines at root / >500 elsewhere	0	0

marcusquinn added the origin:interactive Created by interactive user session label Oct 15, 2026

marcusquinn added the status:in-review Non-draft PR ready for review/merge label Oct 15, 2026

marcusquinn marked this pull request as ready for review October 15, 2026 00:57

vladimirdulov mentioned this pull request Oct 15, 2026

[Supervisor:vladimirdulov] 1 open PR, 0 issues assigned, 0 local workers — changed 2026-10-19 04:58 UTC #23855

Open

marcusquinn merged commit 5fd72df into main Oct 15, 2026
55 checks passed

marcusquinn deleted the bugfix/34710-pinned-aggregate-recovery branch October 15, 2026 01:09

github-actions Bot added status:done Task is complete and removed status:in-review Non-draft PR ready for review/merge labels Oct 15, 2026

github-actions Bot mentioned this pull request Oct 15, 2026

fix(release): signed-tag aggregate recovery starves under concurrent merges (exact-tip requirement) #34710

Closed

5 of 9 tasks

marcusquinn mentioned this pull request Oct 15, 2026

fix(release): recover-aggregate rebuilds a missing authorization record from the fenced lane #34746

Closed

Navigation Menu

Repository navigation

GH#34710: pin reviewed aggregate for release recovery behind main - #34743

GH#34710: pin reviewed aggregate for release recovery behind main#34743
marcusquinn merged 2 commits into
mainfrom
bugfix/34710-pinned-aggregate-recovery

marcusquinn commented Oct 15, 2026

Uh oh!

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

Review skipped

Uh oh!

marcusquinn commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

codacy-production Bot commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

marcusquinn commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

marcusquinn commented Oct 15, 2026

Summary

Files Changed

Runtime Testing

Uh oh!

coderabbitai Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

marcusquinn commented Oct 15, 2026

Completion Summary

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Markdown Lint (changed-line scoped)

Uh oh!

codacy-production Bot commented Oct 15, 2026

Up to standards ✅

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bash 3.2 Compatibility Regression Gate

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Shell Function Complexity Regression Gate

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Qlty Smell Regression Gate

Uh oh!

marcusquinn commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

🔍 Code Quality Report

📈 Current Quality Metrics

Uh oh!

github-actions Bot commented Oct 15, 2026

Shell Nesting Depth Regression Gate

Uh oh!

github-actions Bot commented Oct 15, 2026

File Size Regression Gate

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading