docs: establish repository maintenance baseline - #2
Conversation
|
Warning Review limit reached
Next review available in: 46 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (17)
📝 WalkthroughWalkthroughThe change establishes repository guidance and accessibility documentation, adds Swift tooling and CI maintenance validation, introduces shared shell maintenance utilities, and implements synchronization and standard/submodule release workflows with GitHub gating and publishing steps. ChangesRepository Maintenance
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Maintainer
participant release.sh
participant GitHub
participant Git
Maintainer->>release.sh: start standard release with version
release.sh->>Git: validate worktree, bump version, push branch
release.sh->>GitHub: create or update pull request
GitHub-->>release.sh: expose checks and review state
release.sh->>GitHub: merge approved pull request
release.sh->>Git: fast-forward base and push release tag
release.sh->>GitHub: create and verify GitHub release
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f65759ec0c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🧹 Nitpick comments (1)
.github/workflows/validate-repo-maintenance.yml (1)
18-18: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDisable credential persistence in checkout action.
By default,
actions/checkoutpersists theGITHUB_TOKENin the local Git configuration. It is a security best practice to disable this unless subsequent steps require it to push changes.🔒️ Proposed fix to prevent credential persistence
# This is a validated floor, not a ceiling; update to newer stable official versions when validated. - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@v6.0.2 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/validate-repo-maintenance.yml at line 18, Update the actions/checkout step in the repository maintenance workflow to set persist-credentials to false, while preserving the existing checkout action version and behavior.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/repo-maintenance/release.sh`:
- Around line 95-103: The release tag checks in ensure_semver_tag and
release/10-preflight.sh use permissive duplicated globs instead of strict
validation. Add or reuse one shared, anchored SemVer validator in
scripts/repo-maintenance/release.sh, update ensure_semver_tag to call it, and
make scripts/repo-maintenance/release/10-preflight.sh call the same validator
rather than maintaining its own pattern; preserve the existing failure behavior
for invalid tags.
- Around line 434-443: Restrict the merged-branch cleanup after remote pruning
to deleting only the local branch identified by release_branch_name. Replace the
loop over all branches merged into base_branch with a targeted deletion while
preserving the existing warning behavior for branches that cannot be deleted.
- Around line 352-363: The review-comments acknowledgement must not bypass newly
added feedback on the current PR. Update the review gate around review_decision
and comment_count to validate unresolved review threads or bind
review_comments_addressed to the current PR head SHA, while preserving the
existing CHANGES_REQUESTED handling and failure messages.
In `@scripts/repo-maintenance/release/20-tag-release.sh`:
- Around line 8-14: Update the tag SHA lookup in the release script to
dereference refs/tags/$RELEASE_TAG to the tagged commit before comparing it with
head_sha. Keep the existing idempotent behavior in the tag-exists branch,
including logging and exiting when the dereferenced commit matches HEAD.
In `@scripts/repo-maintenance/release/40-github-release.sh`:
- Around line 13-16: Update the gh availability check in the release flow so a
missing gh command exits with failure when GitHub publication is requested,
rather than returning success after only warning. Preserve the successful skip
behavior exclusively through the --skip-gh-release path.
In `@scripts/repo-maintenance/syncing/README.md`:
- Line 15: Update the setup guidance in README.md to remove “executable” from
the description of repo-specific .sh files, since run_dispatch_dir() executes
matching scripts via sh without checking execute permissions. Keep the guidance
focused on adding scripts only when deterministic shared-sync follow-up steps
are required.
In `@scripts/repo-maintenance/validations/50-markdown-links.sh`:
- Line 43: Update the Markdown link target resolution around target so
root-relative path_text values beginning with “/” are resolved against
repo_root, while preserving markdown_path.parent resolution for
non-root-relative paths.
---
Nitpick comments:
In @.github/workflows/validate-repo-maintenance.yml:
- Line 18: Update the actions/checkout step in the repository maintenance
workflow to set persist-credentials to false, while preserving the existing
checkout action version and behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: a887b013-9375-49ba-b043-67c00e81fb3a
📒 Files selected for processing (27)
.github/dependabot.yml.github/workflows/validate-repo-maintenance.yml.swiftformat.swiftlint.ymlACCESSIBILITY.mdAGENTS.mdCONTRIBUTING.mdREADME.mdROADMAP.mdscripts/repo-maintenance/config/profile.envscripts/repo-maintenance/config/release.envscripts/repo-maintenance/config/validation.envscripts/repo-maintenance/hooks/pre-commit.samplescripts/repo-maintenance/lib/common.shscripts/repo-maintenance/release.shscripts/repo-maintenance/release/10-preflight.shscripts/repo-maintenance/release/20-tag-release.shscripts/repo-maintenance/release/30-push-release.shscripts/repo-maintenance/release/40-github-release.shscripts/repo-maintenance/sync-shared.shscripts/repo-maintenance/syncing/README.mdscripts/repo-maintenance/validate-all.shscripts/repo-maintenance/validations/10-toolkit-layout.shscripts/repo-maintenance/validations/20-agents-guidance.shscripts/repo-maintenance/validations/30-ci-wrapper.shscripts/repo-maintenance/validations/40-swift-package.shscripts/repo-maintenance/validations/50-markdown-links.sh
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e8e3e18804
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: abcd46e451
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| return 0 | ||
| fi | ||
|
|
||
| gh pr merge "$pr_number" --merge --delete-branch |
There was a problem hiding this comment.
If a collaborator or bot pushes to the release branch after watch_ci and check_pr_comments complete but before this command runs, this merges that newer, unreviewed head and the later tag publishes it. Branch protection may mitigate this only when configured to require fresh checks/approvals, but the script neither verifies that policy nor ties its review gate to a revision. Capture the PR headRefOid before the gates and pass it through --match-head-commit; the GitHub CLI manual describes that option as requiring the PR head to match the supplied commit SHA before merging.
Useful? React with 👍 / 👎.
1 participant
Summary
Verification
Summary by CodeRabbit
New Features
Documentation
Chores