.github/workflows/faucet_test.yml (1)

1-52: Consider exposing workflow inputs for caller customization.

Adding workflow_call allows reuse from the release pipeline, but the workflow currently defines no inputs. This means external workflows cannot customize the Python versions or other parameters. If the release pipeline needs flexibility (e.g., testing against a subset of Python versions), consider exposing inputs in the workflow_call trigger.

Example enhancement:

 on:
   push:
     branches: [main]
   workflow_dispatch:
   workflow_call:
+    inputs:
+      python-versions:
+        description: "Python versions to test (JSON array)"
+        type: string
+        default: '["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]'

Then update line 19 to use the input:

-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
+        python-version: ${{ fromJson(inputs.python-versions) }}

This is optional; if the faucet tests always run with the full matrix, no changes are needed.

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

.github/workflows/release.yml (2)

576-594: Ensure release tag points to the correct commit.

The gh release create call should use --target $GITHUB_SHA to align the tag with the exact commit that built the artifacts. Currently the tag may default to the default branch HEAD, creating a mismatch.

       - name: Create GitHub Release
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           ARGS=(
             "$PACKAGE_VERSION"
             --repo "$GITHUB_REPOSITORY"
             --generate-notes
+            --target "$GITHUB_SHA"
           )
           if [ "${IS_BETA_RELEASE:-false}" = "true" ]; then
             ARGS+=(--prerelease)
           else
             ARGS+=(--latest)
           fi
           gh release create "${ARGS[@]}" || {
               echo "::error::Failed to create release"
               exit 1
             }

---

43-49: Pin toml-cli version to prevent unexpected breakage.

Line 48 installs toml-cli without a version constraint. This can cause silent failures if a new toml-cli release introduces breaking changes. Pin to a specific version:

       - name: Install toml-cli
         run: |
           set -euo pipefail
           python3 -m venv /tmp/tomlcli
           /tmp/tomlcli/bin/pip install --upgrade pip
-          /tmp/tomlcli/bin/pip install toml-cli
+          /tmp/tomlcli/bin/pip install toml-cli==0.3.2
           echo "/tmp/tomlcli/bin" >> "${GITHUB_PATH}"

(Replace 0.3.2 with your intended version; check https://pypi.org/project/toml-cli/ for the latest stable release.)

RELEASE.md (2)

16-17: Add missing article and backticks for consistency.

Line 16-17 is missing "the" before "version" and [project] should be backtick-enclosed to match other references:

 The workflow automatically differentiates between beta/pre-release versions
-and standard releases by reading version under the [project] section from `pyproject.toml`:
+and standard releases by reading the version under the `[project]` section from `pyproject.toml`:

---

21-21: Standardize "prerelease" vs "pre-release" terminology.

The file mixes command-line flags (--prerelease, which must match the actual gh CLI) with narrative descriptions. Ensure consistency: use --prerelease (backtick-enclosed) when referring to the flag, and "pre-release" or "prerelease" consistently in prose. Currently lines 21 and 58 use different variants.

Recommend reviewing the actual gh release create documentation to determine the canonical flag name and then ensure all references match.

Also applies to: 58-58

.github/workflows/release.yml (3)

158-162: Align Poetry installation with other workflows for consistency.

The commented-out section (lines 148–157) and the active installation (lines 158–162) differ from how integration_test.yml and unit_test.yml install Poetry. For maintainability, ensure all workflows use the same installation method and cache strategy. Review .github/workflows/integration_test.yml to confirm the standard approach, then apply it here.

---

193-194: Pin Trivy action version or check for drift.

The Trivy action is pinned to aquasecurity/[email protected], which is good. Verify this version remains compatible with your CI environment and vulnerability databases; if you update Trivy, test the new SBOM scanning output to ensure the report format remains parseable by downstream steps (e.g., the regex at line 221).

---

623-623: Fix typo: "succesfully" → "successfully".

-          text="xrpl-py ${PACKAGE_VERSION} has been succesfully released and published to pypi. Release URL: ${RELEASE_URL}"
+          text="xrpl-py ${PACKAGE_VERSION} has been successfully released and published to PyPI. Release URL: ${RELEASE_URL}"

Also capitalize "PyPI" for consistency with the rest of the documentation.

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro