Repository navigation
ci: guard independent component distribution contracts - #190
rodri-oliveira-dev wants to merge 2 commits into
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 589b9a9e05
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Superseded by #192. All distribution review findings are resolved in the consolidated PR: the public README and changelog agree with Marketplace 1.0.1, every workflow is scanned for Marketplace publishing indicators, and the 21-day assertion is bound to each actual VSIX upload-artifact step. Negative mutations verify that a decoy retention marker and a newly added publish workflow are rejected. |
Problem
The repository documents independent CLI, MCP, and VS Code version streams, but CI did not have one focused check tying those identities to the VSIX distribution policy. A future workflow edit could shorten artifact retention, add Marketplace publication, or blur published and candidate states without a targeted failure.
During PR validation, Trivy also identified two newly disclosed, fixed medium-severity curl vulnerabilities in the pinned Azure Linux runtime layer used by every branch.
Solution
scripts/component-distribution-policy-test.shto verify distinct component IDs and stable SemVer values from their authoritative manifests;The policy check reads
AdrGuard.csproj,AdrGuard.Mcp.csproj,extensions/vscode/package.json, and the two VS Code workflows rather than duplicating builds or package validation already performed elsewhere in CI.Compatibility
No product runtime, public schema, command, configuration, exit code, or package identity changes. The VSIX remains an artifact retained for 21 days and is never published automatically to Marketplace. The container remains on .NET 10.0.13 and Azure Linux 3.0; only the pinned base-image digest changes.
Validation
bash scripts/component-distribution-policy-test.sh: passed for CLI 1.8.0, MCP 1.0.0, VS Code 1.1.0, 21-day retention, and no Marketplace publicationdocker buildx imagetools inspect mcr.microsoft.com/dotnet/runtime:10.0.13-azurelinux3.0: resolved the pinned multi-platform digesttrivy image --image-src remote ...@sha256:0f82...: passed with 0 medium/high/critical findings in the updated runtime basenpm ci(website): passed, 0 vulnerabilitiesnpm run sync:docs: passed, 78 documents synchronizednpm run validate: passed; Astro check clean, 6 tests, 116 pages, 46 bilingual routes, links/SEO/HTML validnpm run test:spelling: passed, 53 files and 0 issuesgit diff --check: passedRisk
The policy check intentionally covers stable manifest/workflow contracts only. It does not query mutable public registries during ordinary CI and does not duplicate package or VSIX builds. The immutable runtime digest will continue to require Dependabot or maintainer refreshes when upstream security fixes are published.