Repository navigation
Streamline Android release workflow - #243
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b2e6b6407f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if expected.get("requirePullRequest") and not actual.get("required_pull_request_reviews"): | ||
| errors.append(f"branch {name} does not require pull requests") | ||
| contexts = set((actual.get("required_status_checks") or {}).get("contexts", [])) | ||
| missing_checks = sorted(set(expected.get("requiredChecks", [])) - contexts) |
There was a problem hiding this comment.
When dev requires pull requests or has any required status check, this audit still reports success because requirePullRequest: false is never compared and an expected empty check set can never produce missing_checks. The release workflow later creates a new merge commit locally and pushes it directly to dev, so either live restriction can reject that push after publication and leave the development branch unsynchronized; validate the false/empty expectations as well.
Useful? React with 👍 / 👎.
| actual_policies = policy_keys(bundle.get("policies", {})) | ||
| for required in expected.get("allowedRefs", []): | ||
| key = (required["name"], required.get("type")) | ||
| legacy_key = (required["name"], None) | ||
| if key not in actual_policies and legacy_key not in actual_policies: |
There was a problem hiding this comment.
If either environment contains the expected master and v* policies plus an additional branch or wildcard policy, this one-way membership check returns no error even though the environment is no longer limited to the configured refs. That makes the advertised protection audit pass while workflows from unintended refs can enter the release or production environment, undermining the trust boundary this audit is intended to verify; compare the complete policy set instead.
Useful? React with 👍 / 👎.
1 participant
Summary
Validation
This PR changes release automation only; it does not publish a release by itself.