[BenCodez]

Summary

• replace the race-prone tag/release trigger with a GitHub UI workflow_dispatch release flow
• accept and validate an explicit release version
• reject public/unowned releases and conflicting tags
• safely resume workflow-owned drafts and orphan tags from interrupted runs
• reject dispatches outside main; reused tags must pin a commit contained in main
• pin Maven output timestamps to that commit and verify the shaded JAR is byte-reproducible before upload
• require an active, no-bypass refs/tags/v* ruleset that restricts updates and deletions
• reuse only digest-identical assets; never clobber or delete release/tag state
• reassert the expected tag, target, title, body, and verified asset manifest while publishing
• require GitHub to report the resulting release as immutable

One-time repository settings required

1. Settings → General → Releases → Enable release immutability.
2. Add an Actions repository secret named RELEASE_SETTINGS_TOKEN containing a fine-grained token scoped to this repository with Administration: read-only. The workflow uses it only to fail closed if immutability is off; release writes continue to use GITHUB_TOKEN.
3. Settings → Rules → Rulesets → New tag ruleset:
   • Enforcement: Active
   • Target: Tags matching v* (refs/tags/v*)
   • Bypass list: empty
   • Enable Restrict updates and Restrict deletions
4. Treat drafts containing the workflow-run marker as workflow-owned: do not edit their metadata or assets while a release run is active.

GitHub UI release flow after merge

1. Open Actions → Publish release.
2. Select Run workflow on main.
3. Enter a version without v, such as 0.1.1.
4. The workflow validates, tests, then creates v0.1.1 with the JAR and SHA-256 assets.

A failed attempt never leaves an incomplete public release. Its private workflow-owned draft/tag checkpoint remains resumable: rerunning the same version rebuilds the pinned commit, reuses only matching asset digests, and completes that same immutable release safely.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T04:35:53.509849Z	cc4bbf5	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 03c9e2d1a3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

@codex review

Please re-review exact head 446d4eb4743a6226d1a20c16f60c487ea836e27b. The release now stays draft through checkout, Maven verification, staging, and asset upload, and is published only afterward. Check correctness, failure recovery, duplicate-release behavior, GitHub UI draft flow, permissions, and rerun safety.

[chatgpt-codex-connector]

💡 Codex Review

VotingPlugin-Control/.github/workflows/release.yml

Lines 4 to 6 in 446d4eb

	push:
	tags:
	- 'v*'

Prevent the GitHub UI from publishing before validation

When an operator follows the normal draft UI flow and clicks Publish release, GitHub makes the release public before this tag-push workflow can validate or upload anything; for an existing tag there is no new push at all, and for a tag created by publication the later run reaches the draft lookup after the release is already non-draft and exits without uploading assets. The only safe path is the undocumented hybrid sequence of saving the UI draft and then pushing its tag externally. Fresh evidence at this exact head is the move back to a tag-push trigger combined with the hard failure when no draft remains, so the workflow still permits the original incomplete-public-release outcome through the GitHub UI.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

Addressed the exact-head Codex finding in 44570e589d. The workflow no longer depends on either release publication or a tag-push/UI race. It is now manually launched from GitHub Actions with a validated version, builds and verifies the selected main commit first, rejects existing tags/releases, then creates the tag and public release together with both verified assets. A failed pre-release step creates nothing public.

[BenCodez]

@codex review

Please perform the final merge-readiness review of exact head 44570e589d48884ae8df5e67564b04fa18db3105. The workflow is now a GitHub UI workflow_dispatch: it validates a version, rejects existing tags/releases, runs Maven verification, stages the JAR/checksum, and only then creates the tag and public release at the exact built commit. Check correctness, concurrency/races, permissions, input safety, failure recovery, rerun behavior, and incomplete/duplicate release prevention.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 44570e589d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

@codex review

Please perform a final merge-readiness review of exact head a37f65dbc51106de28e27d395e098f240a9b2f6e. The manual release workflow now atomically creates the tag at the tested $GITHUB_SHA, creates a verified draft, uploads both assets, revalidates the tag target, and then publishes. Its error trap removes only its own still-draft release and only a tag still pointing at the tested commit. Check tag/source binding, publication ordering, cleanup/failure recovery, concurrent writers, permissions, shell/input safety, and rerun behavior.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a37f65dbc5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

@codex review

Please perform the final merge-readiness review of exact head 6bd25cd63b94a67eccfdd3393cb4a03d86cd40f9. The manual workflow now creates its draft through the API and captures the returned ID directly, embeds a unique workflow-run marker for ownership-safe recovery if the response is interrupted, and routes EXIT, INT, and TERM through cleanup until publication completes. Cleanup deletes only its still-draft owned release and only its tag still pointing at the tested commit; ambiguous API state is preserved rather than destructively guessed. Check cancellation semantics, draft ownership/ID recovery, tag/source binding, publication ordering, concurrency, permissions, shell/input safety, and rerun behavior.

[BenCodez]

@codex review

Please review the new exact head f5e49df6678546472e249ec9d1875f3ecc5a03f8; it supersedes the prior request. In addition to direct draft-ID capture, workflow-run ownership markers, and EXIT/INT/TERM cleanup, cleanup now verifies that no release references the tag before removing it. If release-state inspection fails, it preserves the tag rather than making a destructive guess. Please give a final merge-readiness verdict covering cancellation, ownership-safe cleanup, tag/source binding, concurrent writers, publication ordering, shell/input safety, and reruns.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f5e49df667

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

@codex review

Please perform the final merge-readiness review of exact head 0acdd53c32d62d5452bd7f7bafdda3efa94d27bb. This supersedes prior requests. Cleanup never deletes remote tags, eliminating check-then-delete races. If a failed/canceled attempt already created a lightweight tag, the next dispatch treats it as a durable checkpoint, checks out and rebuilds that exact pinned commit (even after main advances), then finishes the owned draft/upload/publish flow. Owned-draft recovery captures the creation response ID and falls back to a unique run marker across all paginated release pages. Check source/tag binding, cancellation and reruns, concurrent tag/release writers, publication ordering, pagination, permissions, shell/input safety, and incomplete/duplicate release prevention.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0acdd53c32

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

@codex review

Please perform the final merge-readiness review of exact head 68704c8b84d0254f8b5d6cab81fa5a265346279f. This supersedes prior requests. Preflight paginates all releases, rejects public/unowned entries, and recognizes a single stale workflow-owned draft from its hidden run marker. It resumes that draft by ID, rebuilds the exact commit pinned by an existing lightweight tag, verifies the draft/tag again after the build, replaces partial assets with --clobber, and publishes only after tag/source verification. Ordinary failures delete only the owned draft; hard-kill leftovers remain resumable; tags are never deleted. Check stale-draft recovery, races, source binding, publication ordering, cancellation, pagination, shell/input safety, permissions, and duplicate/incomplete release prevention.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 68704c8b84

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

@codex review

Please perform the final merge-readiness review of exact head 787d627bb2e16269df7b85ce36ba0f8f52019c41. This supersedes prior requests. Recovered drafts now get a job-level always() cleanup on ordinary pre-publish failure/cancellation. Live draft ownership (draft, exact tag, and workflow marker) is revalidated before asset clobber, immediately before publication, and before either cleanup path may delete. Hard-kill leftovers remain recoverable on the next run; tags are never deleted; release scans paginate fully; reused tags pin the source commit being rebuilt. Check conditions/cancellation behavior, ownership races, cleanup, source binding, pagination, publication order, permissions, input safety, and duplicate/incomplete release prevention.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 787d627bb2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

@codex review

Please perform the final merge-readiness review of exact head df008ed8c1875793ee674486aa6159be8fa4cd87. This supersedes prior requests. The workflow performs no release/tag DELETE operations, eliminating destructive ownership races. Failed/canceled runs leave a private workflow-owned draft/tag checkpoint; preflight paginates all releases, rejects public/unowned state, and resumes that same draft. It rebuilds the tag's exact pinned commit, validates live draft ownership before replacing assets and again before publication, verifies the tag/source, and publishes only after success. Check resumability, ownership races, source binding, publication order, cancellation, pagination, permissions, input safety, and duplicate/incomplete public release prevention.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df008ed8c1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

@codex review

Please perform the final code-level merge-readiness review of exact head 963a9a75da54a24e66dad267000580b6663d8b65. This supersedes prior requests. The workflow fails closed unless an active no-bypass tag ruleset exactly targets refs/tags/v* and restricts updates/deletions, then revalidates it before publication. Asset resume is non-destructive: absent assets are uploaded without clobber; existing assets must have exact GitHub SHA-256 digests; both digests are revalidated. Publication reasserts the expected tag, target commit, title, owned body, and digest manifest in the same PATCH, and requires immutable=true in GitHub's response. Repository release immutability is an explicit one-time prerequisite. Check ruleset validation, asset races, draft ownership, tag/source binding, publication ordering, resumability, pagination, permissions, input safety, and incomplete/duplicate release prevention.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 963a9a75da

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

@codex review

Please review exact head f00da146244c67cbb4f13ad15e8967d6529d74d5. In particular, verify the workflow YAML remains valid after the indented printf -v change and that the final ETag/If-Match conditional publication closes the draft-asset mutation race without weakening the no-delete, digest, tag-ruleset, or immutable-release guarantees.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f00da14624

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 206b7f930f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e5a0780737

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".