ci(release): settle directly, gated by the release environment - #379
Conversation
Troublor
added
spec:unchanged
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Claude review status
✅ Review clean Last reviewed: New this round: 0 finding(s), 0 question(s) · Resolved this round: 0 · Open questions: 0 |
🧬 Mutation testing — ✅ PASSNothing to test — no mutants were generated on the changed lines. |
The settle dispatch is now the settlement decision: the `release` environment's required reviewers approve the run, the action checks the dispatcher's admin permission (settlers: admin), and the job commits the changelog to the release branch and publishes the tag and Release itself; on-release.yml then runs the publish targets as before. No settle branch or PR any more; release-publish.yml stays for PR mode only and its header says so. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
🧬 Mutation testingNo results at |
There was a problem hiding this comment.
🔵 Needs a closer look
It changes release/tag publishing control-flow and approval gates in CI, which is high-impact and should receive final human verification of permissions/environment protections.
Pull request overview
Updates the release automation to settle releases directly from release-settle.yml, with the settlement decision gated by the repository’s release environment protections (instead of merging a settle PR).
Changes:
- Switch
release-settle.ymlto direct settlement (settle_mode: direct) and require an admin dispatcher (settlers: admin), with a job-levelenvironment: releasegate. - Update workflow documentation/comments to reflect that settlement now commits the changelog and publishes the tag + GitHub Release as part of the settle job.
- Clarify in
release-publish.ymlthat it only applies to legacy PR-based settlement mode.
File summaries
| File | Description |
|---|---|
| .github/workflows/release-settle.yml | Adds environment: release gate and switches the settle action to direct mode with admin-only dispatch. |
| .github/workflows/release-publish.yml | Updates header comments to document that PR-mode is now legacy and direct mode publishes from release-settle.yml. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![mega-maxwell[bot]](https://avatars.githubusercontent.com/u/138558126?s=60&v=4){kind=small}
There was a problem hiding this comment.
0 blocking · 1 should-fix · 0 suggestion(s) · 0 open question(s)
Reviewed head f5ec33e7.
Findings without inline anchors:
.claude/skills/bump-version-release/SKILL.md:16— [Major] bump-version-release skill still documents the settle-by-PR flow A human or agent following this skill to run the next mega-evm release will wait for a settle PR that never opens and expect an on-merge publish workflow that never fires, while the dispatch has already committed to the release branch, pushed the tag, and created the GitHub Release. Follow-on steps (approving the settle PR, watching release-publish for the tag) will be skipped or misordered against a release that has, in fact, already shipped. Suggested fix: Update Step 2 to reflect direct-mode settlement: dispatchingrelease-settle.yml --ref main -f version=X.Y.Z -f commit=<tip>is the release approval, gated by thereleaseenvironment reviewer plus thesettlers: admincheck on the dispatcher, and the same job commits the changelog to the release branch, pushes the annotatedvX.Y.Ztag, and publishes the GitHub Release with those notes. Drop Step 3 (or fold it into Step 2) sincerelease-publish.ymlno longer fires.
…angelog preamble Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 277c782215
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Switches settlement from settle-by-PR to direct mode with an environment gate (org templates: megaeth-labs/.github#37).
release-settle.yml:environment: releaseon the settle job,settle_mode: direct,settlers: admin. Dispatching is the settlement decision: the environment's required reviewer approves the run before it starts, the action checks the dispatcher's admin permission, and the job then commits the changelog to the release branch and publishes the annotated tag and the GitHub Release itself.on-release.ymlruns the publish targets on that Release exactly as before. No settle branch or PR exists any more.release-publish.yml: header notes that only PR-mode settlement reaches it.The
releaseenvironment already exists here (reviewer Troublor, self-review allowed, deployments frommainonly) and is separate frompublish, which keeps holding the credentials with itsv*tag policy. The app is already a bypass actor on the release-branch and tag rulesets. Workflow-only change; direct mode is exercised first on mega-agents 0.2.0 before a mega-evm release uses it.🤖 Generated with Claude Code