[don-petry]

Closes #1054

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• New Features

  • Canary rollout promotions now handle cross-repo agents by updating tags on the configured host when needed.
  • Dry-run output now reflects whether a promotion would use a remote host or local Git flow.

• Bug Fixes

  • Improved tag promotion reliability for agents working outside the current repository.
  • Added coverage to ensure promotions target the expected commit and avoid unintended local writes in dry-run mode.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 50 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5590d944-6455-416b-9e23-4615de6514d6

📥 Commits

Reviewing files that changed from the base of the PR and between 3d1909d and d762a66.

📒 Files selected for processing (1)

• scripts/canary-rollout.sh

📝 Walkthrough

Walkthrough

Adds a _gh_move_tag helper in canary-rollout.sh that force-moves a GitHub tag ref via gh api, and updates cmd_promote to branch between host-based API promotion (for cross-repo agents) and existing local git tag -f/push behavior (for this-repo agents). New bats tests cover both paths.

Changes

Cross-repo tag promotion

Layer / File(s)	Summary
gh_move_tag helper and promote branching scripts/canary-rollout.sh	Adds _gh_move_tag to force-update or create a tag ref via gh api PATCH/POST, and updates cmd_promote to use it for cross-repo hosts while retaining local git tag -f/push for this-repo agents, including matching dry-run output.
Test coverage for cross-repo promote and dry-run tests/canary_rollout.bats	Adds _crossrepo_promote_stub to fail local git tag/push calls and log gh API tag-move calls, plus tests verifying cross-repo promote moves the tag via gh and that --dry-run performs no API or git writes.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant cmd_promote
  participant _gh_move_tag
  participant GitHubAPI
  participant LocalGit

  User->>cmd_promote: promote agent
  cmd_promote->>cmd_promote: resolve agent host
  alt host differs from this repo
    cmd_promote->>_gh_move_tag: move tag(repo, tag, sha)
    _gh_move_tag->>GitHubAPI: PATCH refs/tags/tag force=true
    GitHubAPI-->>_gh_move_tag: 200 or 404
    alt ref not found
      _gh_move_tag->>GitHubAPI: POST git/refs
    end
    GitHubAPI-->>cmd_promote: tag moved on host
  else host is this repo
    cmd_promote->>LocalGit: git tag -f
    cmd_promote->>LocalGit: git push --force
    LocalGit-->>cmd_promote: tag moved locally
  end
  cmd_promote-->>User: expose move to GITHUB_OUTPUT

Loading

Suggested labels: initiative

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the cross-repo canary-rollout PROMOTE fix and matches the main code and test changes.
Linked Issues check	✅ Passed	The PR implements [#1054] by routing cross-repo promotion through a host-aware GitHub API tag move and adds bats coverage for that path.
Out of Scope Changes check	✅ Passed	The changes stay focused on canary-rollout promotion logic and its tests, with no unrelated code paths introduced.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-1054-20260703-1706

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #1055
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-03T17:46:56Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-07-03T17:46:56Z

[gemini-code-assist]

Code Review

This pull request introduces host-aware tag promotion for cross-repo agents, moving tags via the GitHub API instead of local git commands when the agent's host differs from the current repository. This change is accompanied by new integration tests in canary_rollout.bats. The review feedback suggests validating that the required positional parameters are provided in the new _gh_move_tag function to prevent potential unbound variable crashes under set -u.

[Copilot]

Pull request overview

This PR fixes cross-repo canary promotion failures by making the PROMOTE write path host-aware: when an agent’s host is not this repository, promotion now moves the channel tag on the host repo via the GitHub API instead of attempting a local git tag -f + git push (which fails when the candidate commit isn’t in the local object database).

Changes:

• Add _gh_move_tag to move/create refs/tags/<tag> on an arbitrary <host> repo via gh api.
• Update cmd_promote to route cross-repo promotions through _gh_move_tag (and keep the local git path for in-repo agents).
• Add Bats coverage to ensure cross-repo promotion uses the host GitHub API and that --dry-run touches neither git nor the API.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
scripts/canary-rollout.sh	Implements host-aware promotion writes by moving tags on the agent’s host repo via gh api when host != THIS_REPO.
tests/canary_rollout.bats	Adds regression tests that fail if promotion regresses to the local git tag -f / git push path for cross-repo agents.

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[don-petry]

Note

@don-petry I received your request but all AI engines are currently rate-limited. I'll retry automatically once the rate limit clears.
Rate limit resets at: unknown

[don-petry]

Dev-Lead — rate-limited (intent: review-changes)

PR: #1055
The retry cron will re-attempt automatically.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: d762a6605b94f1260294dd5b0da5fba85efba445
Review mode: triage-approved (single reviewer)

Summary

Fixes #1054: canary-rollout PROMOTE now uses a host-aware write path for cross-repo agents. New _gh_move_tag moves the channel tag on the agent's host repo via the GitHub API (PATCH force-move or POST create), mirroring the #1049 host-aware read split and the existing cut-release.sh primitive; this-repo agents keep the local git tag path. Bats regression tests verify the API path is used (git stub fails loudly on tag -f/push) and that --dry-run performs no mutations. Triage cleared this as low-risk; confirmation review agrees the change is correct and well-tested — classified MEDIUM as a non-trivial logic change to the promotion write path.

Linked issue analysis

Linked issue #1054 (P1: cross-repo agents can be evaluated but not promoted — local git tag -f fails on nonexistent object and would target the wrong repo) is substantively addressed. The fix follows the issue's prescribed approach: replicate cut-release.sh's gh_move_tag against the agent's host, keep the local path for this-repo agents, and add bats coverage proving promotion moves the tag on the host rather than failing locally. Dry-run output was also made host-aware.

Findings

No blocking findings. Prior bot feedback resolved: Gemini's medium finding (unbound-variable crash in _gh_move_tag under set -u) was fixed by moving the $# guard before the local assignments; the review thread is resolved. Copilot generated no comments; CodeRabbit approved. API usage is correct (singular git/ref read vs plural git/refs write; force=true passed as -F boolean). Secret-scanning MCP tool unavailable in this environment; gitleaks CI check is green.

CI status

All required checks green: bats, unit-tests, shellcheck (x2), Lint, CodeQL (actions + python), SonarCloud, gitleaks secret scan, Agent Security Scan, agent-shield, holdout-guard, template-drift, validate-agent-profiles, gh-aw-compile, review/review. Cancelled dev-lead/dispatch run superseded by a successful run of the same check; dependency-audit sub-jobs skipped (no matching ecosystems). Mergeable; blocked only on review.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: d762a6605b94f1260294dd5b0da5fba85efba445
Review mode: triage-approved (single reviewer)

Summary

Makes the canary-rollout promote write path host-aware for cross-repo agents (companion to the #1049 read fix). Adds _gh_move_tag — mirroring the existing gh_move_tag in cut-release.sh (#959/#992) — and splits cmd_promote: agents with host != THIS_REPO get their channel tag moved on the host via the GitHub API (PATCH with force, or POST if absent), while this-repo agents keep the local git tag -f && git push --force path. Dry-run output is accurate in both branches. Two bats regression tests use a git stub that fails loudly on any local tag -f/push, proving the promote goes through the host API and that --dry-run has zero side effects.

Linked issue analysis

Closes #1054 (P1: cross-repo agents could be gate-evaluated but not promoted — local git tag -f failed with "nonexistent object" and would target the wrong repo). The fix follows the issue's prescribed approach exactly: replicate cut-release.sh's gh_move_tag against host, keep the local path for this-repo agents, and add a bats case asserting the tag moves on the host rather than failing on a nonexistent local object. Substantively addressed.

Findings

• No blocking findings.
• Correctness: API usage is right — singular git/ref/tags/<tag> for the existence read, PATCH git/refs/tags/<tag> with force=true to move, POST git/refs to create. Under set -euo pipefail an API failure aborts the promote non-zero, as desired. Deployment-recording output (GITHUB_OUTPUT) still fires for both paths.
• Security: repo/tag/sha interpolations are quoted and sourced from repo-controlled config (agents.json) and gh/git output — no untrusted-input injection surface. Requires contents:write on the host repo, consistent with the existing cut-release.sh flow; token minting stays in the workflow. Gitleaks passed; the run_secret_scanning MCP tool was unavailable in this run (noted, non-blocking).
• Tests: the git stub exits 128 on tag -f/push, so a regression to the local path fails the suite — a precise guard for the #1054 failure mode. MOVELOG asserts the PATCH targeted git/refs/tags/auto-rebase/stable with the candidate SHA on the host.
• Review threads: the single thread (gemini, set -u positional-param concern) is resolved via the $# -lt 3 guard in _gh_move_tag. CodeRabbit approved. No unanswered human questions.
• Triage's low-risk assessment is confirmed; risk is MEDIUM (non-trivial logic in promotion automation), within auto-approve bounds.

CI status

All substantive checks green: shellcheck, bats, unit-tests, Lint, CodeQL (actions + python), SonarCloud quality gate, gitleaks, AgentShield, Agent Security Scan, holdout-guard, template-drift, gh-aw-compile, validate-agent-profiles. The CANCELLED dev-lead / dispatch / ci-relay entries are superseded dev-lead automation runs (a later dev-lead / dispatch run succeeded), not merge gates.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.