[mikea]

No description provided.

[clanky-the-clanker]

💬 Approved with comments — The Python release workflows now refresh the lockfile. One WARNING remains: the V8 update docs don't include the just update-lockfile step that --lockfile_mode=error now requires.

Findings: 1 warning · 1 info

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

🔧 Fix with your agent

Paste the following into your coding agent to investigate and fix these issues.

Fix the following code review issues found in pull request #8031.

Before making changes, review each issue and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g., the fix would require disproportionate changes
  for minimal ROI, or the finding is factually incorrect), explain why
- If you need to clarify something before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

## WARNING (1)

### [Documentation] docs/v8-updates.md and .opencode/skills/update-v8/SKILL.md have no `just update-lockfile` step after the dependency edits. With `--lockfile_mode=error` (.bazelrc:53), the next Bazel command in a V8 update fails.
- **File:** docs/v8-updates.md:77

## INFO (1)

### [Code Quality] Not reviewed for correctness: MODULE.bazel.lock.

---

📋 Code Quality: 💬 1 info

The Python release workflows now refresh and stage MODULE.bazel.lock, which fixes the earlier warning.

Recommendation: ✅ Approve

• [INFO] Not reviewed for correctness: MODULE.bazel.lock.

View full review

Fixed since the last review: both Python release workflows (.github/workflows/release-python-runtime.yml:77-82 and .github/workflows/release-python-snapshots.yml) now run the same command as just update-lockfile and git add MODULE.bazel.lock before they commit. This review did not check that Bazel is available on those runners, because the workflow setup steps are not part of the diff.

This review did not check MODULE.bazel.lock for correctness.

---

📝 Documentation: ⚠️ 1 warning

The V8 update docs still don't include the lockfile refresh that is now required before running Bazel.

Recommendation: 📝 Minor Comments

• [WARNING] docs/v8-updates.md and .opencode/skills/update-v8/SKILL.md have no just update-lockfile step after the dependency edits. With --lockfile_mode=error (.bazelrc:53), the next Bazel command in a V8 update fails. (docs/v8-updates.md:77)

View full review

V8 update docs are missing the lockfile step (docs/v8-updates.md:77-78, .opencode/skills/update-v8/SKILL.md)

• .bazelrc:53 now sets common --lockfile_mode=error, so Bazel rejects a stale lockfile.
• docs/v8-updates.md:77-78 tells readers to update deps.jsonc and run update-deps.py directly. Neither step refreshes MODULE.bazel.lock, so the next Bazel command in a V8 update fails.
• .opencode/skills/update-v8/SKILL.md has the same gap.
• Fix: add a just update-lockfile step after the dependency edits, or point readers to just update-deps, which now runs it. Listing just update-lockfile with the other Just commands in AGENTS.md would also help.

---

_{Reviewed commit: 9ac777a1}

[ask-bonk]

Since last review: 0 resolved, 1 still open, 1 new.

Lockfile refreshes were added to the Python release and WPT workflows.

Not re-run: docs, tests (no author changes in their files since the last review)

---

_{Reviewed commit: 9ac777a1 · github run}

[github-actions]

The generated output of @cloudflare/workers-types matches the snapshot in types/generated-snapshot 🎉

[ask-bonk]

[BLOCKING] build/deps/gen is still an allowed agent-authored path, and this rebase runs Bazel after replaying each such commit. Root MODULE.bazel includes shared_deps.MODULE.bazel; its http.archive tags accept patch_cmds, which build/exts/http.bzl forwards to http_archive. An agent that has processed untrusted upstream content can therefore commit a generated module fragment whose repository setup runs an arbitrary patch command in this write-token job. Regenerating the lockfile after invoking Bazel does not constrain that input. Reject dependency-metadata changes before the rebase (and align the agent contract/allowlist with that policy), or generate and validate these files from trusted inputs before this invocation.

Suggested change

	git rebase --autostash "$bump" --exec "git diff --quiet HEAD~ HEAD -- build/deps/shared_deps.jsonc || { $update_lockfile && { git diff --quiet -- MODULE.bazel.lock || git commit --amend --no-edit MODULE.bazel.lock; }; }"
	# Triage commits may not modify dependency metadata before this privileged job invokes Bazel.
	git diff --quiet "$bump..HEAD" -- build/deps/shared_deps.jsonc build/deps/gen || {
	echo "::error::Triage commits must not modify dependency metadata."
	exit 1
	}
	# The commits cannot carry MODULE.bazel.lock, which would let them redirect any
	# repository, so it is regenerated for each commit that changes the dependency
	# metadata, keeping every commit buildable. The same as `just update-lockfile`.

[ask-bonk]

[BLOCKING] A snapshot update replaces its content-addressed filename in python_metadata.bzl. The Pyodide extension derives pyodide-snapshot-<filename> repository names from that value, but build/deps/pyodide.MODULE.bazel has a fixed use_repo list that its own header says bazel mod tidy maintains. Updating the lockfile alone leaves that manifest pointing at the removed repository (and omits the new one), so the new Bazel invocation or the committed snapshot update cannot resolve the extension output.

Suggested change

	# python_metadata.bzl is an input of the pyodide module extension, so the lockfile has
	# to change with it. The same as `just update-lockfile`.
	bazel build --lockfile_mode=update --nobuild //... //build/deps/formatters:rustfmt@rule
	# Commit and push the changes
	git add build/python_metadata.bzl
	git add build/python_metadata.bzl MODULE.bazel.lock
	# Snapshot file names determine the Pyodide extension's repository names, so refresh the
	# corresponding use_repo list before regenerating its lockfile entry.
	bazel mod tidy --lockfile_mode=update
	bazel build --lockfile_mode=update --nobuild //... //build/deps/formatters:rustfmt@rule
	# Commit and push the changes
	git add build/python_metadata.bzl build/deps/pyodide.MODULE.bazel MODULE.bazel.lock