ci: scope legacy release builds to the v* tag series by yashvardhannanavati · Pull Request #1385 · release-engineering/iib

yashvardhannanavati · 2026-09-10T22:46:21Z

Releases have only ever been cut from master, so both release workflows assumed every tag in the repo belonged to the legacy track. Cutting the first release from main (containerized IIB) breaks that assumption.

build.yml triggers on release: published, and GitHub cannot filter release events by tag name under on:. A release published from main would therefore be checked out and pushed as latest -- the channel the legacy track promotes to the prod tag on Quay from. Guard the job so it only builds v* releases.

build_on_tag.api.yml triggers on tags: '*', so any tag would rebuild iib-api:qe. Narrow it to v*.

The scheduled and manual paths in build.yml need no guard: they resolve their tag via find-latest-tag with prefix 'v', which already excludes the ocp-v* series used by main. Leaving that step untouched also keeps the weekly base-layer rebuild pinned to the legacy release, so the images feeding prod keep receiving RPM/CVE refreshes.

qodo-for-releng · 2026-09-10T22:47:02Z

PR Summary by Qodo

Scope legacy release builds to v* tags

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Restrict legacy release builds to the v* tag series.
• Prevent ocp-v* releases from overwriting legacy latest and qe image channels.
• Preserve scheduled and manual rebuilds against the latest legacy release.

Diagram

graph TD
  R["Published release"] --> G{"Tag starts v?"}
  G -->|Yes| L["Legacy image build"] --> Q["Quay channels"]
  G -->|No| S["Skip legacy build"]
  M["Manual or schedule"] --> L
  T["v tag push"] --> A["API QE build"] --> Q

High-Level Assessment

The selected approach is optimal: use a job-level condition where GitHub cannot filter release events by tag, and use the native tag filter for push events. Splitting the release workflow or adding step-level guards would duplicate configuration or risk partial execution without improving isolation.

Files changed (2) +17 / -1

Bug fix (2) +17 / -1

build.ymlGuard legacy release builds by tag series +13/-0

Guard legacy release builds by tag series

• Adds a job-level condition that permits published releases only when their tag starts with 'v'. Scheduled and manually dispatched builds remain enabled and continue resolving the latest legacy tag.

.github/workflows/build.yml

build_on_tag.api.ymlLimit API QE builds to v* tags +4/-1

Limit API QE builds to v* tags
• Narrows the tag-push trigger from every tag to 'v*', preventing containerized IIB tags from overwriting the legacy 'iib-api:qe' image.
.github/workflows/build_on_tag.api.yml

fullsend-ai-review · 2026-09-10T22:47:23Z

🤖 Finished Review · ✅ Success · Started 10:47 PM UTC · Completed 10:59 PM UTC

Commit: 8f6f8bb · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.20

qodo-for-releng · 2026-09-10T22:48:37Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can turn these tips off under Display preferences

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

fullsend-ai-review · 2026-09-10T22:59:14Z

Risk Assessment: moderate (2/5)

Details

Small, targeted CI-only change (2 files, 18 lines) by a known contributor with no security-sensitive or dependency modifications; PROTECTED_PATH_COUNT=2 and CI_WORKFLOW_CHANGED=true reflect inherent CI file risk, but the minimal blast radius and stable git history keep the score at moderate.

Previous run

Risk Assessment: moderate (2/5)

Details

Small CI workflow change (2 files, 18 lines) from an established author on low-churn, stable files; protected-path and CI-change signals moderately elevate risk but the minimal scope and clean git history keep the score at moderate.

fullsend-ai-review · 2026-09-10T22:59:15Z

Review

Findings

High

[protected-path] .github/workflows/build.yml, .github/workflows/build_on_tag.api.yml — Both changed files are under .github/, a protected path requiring human approval. The PR has no linked issue providing explicit authorization for modifying governance/infrastructure files. Human review is required regardless of the change's merit.
Remediation: Link a tracking issue that authorizes CI workflow modifications, or obtain explicit human approval for the protected-path changes.

Low

[missing-authorization] .github/workflows/build.yml — No linked issue backs this change. The PR body is thorough and explains the motivation (upcoming first release from main using the ocp-v* series would otherwise contaminate the legacy latest/prod Quay channel), but the project's standard authorization trail — a GitHub issue or ADR — is absent for a non-trivial CI workflow modification.
Remediation: Open a tracking issue describing the two-track release strategy (legacy v* from master, containerized ocp-v* from main) and reference it in this PR. This also anchors future maintainers who need to understand why the guards exist.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

[protected-path] .github/workflows/build.yml, .github/workflows/build_on_tag.api.yml — This PR modifies files under the .github/ protected path. No linked issue exists to authorize changes to governance/infrastructure files. Human approval is always required for protected-path changes.

Low

[missing-authorization] .github/workflows/build.yml — No linked issue exists for this CI change. While the PR body explains the motivation clearly, the project has no issue trail authorizing the dual-track release strategy (master v* vs. main ocp-v*) that this guard implements. A linked issue or ADR would establish the authorization chain and aid future reviewers.
Remediation: Open or reference an issue (or ADR) documenting the decision to split release tracks between master (v*) and main (ocp-v*).

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

yashvardhannanavati · 2026-09-16T03:38:14Z

/fs-fix-stop

Releases have only ever been cut from master, so both release workflows assumed every tag in the repo belonged to the legacy track. Cutting the first release from main (containerized IIB) breaks that assumption. build.yml triggers on `release: published`, and GitHub cannot filter release events by tag name under `on:`. A release published from main would therefore be checked out and pushed as `latest` -- the channel the legacy track promotes to the `prod` tag on Quay from. Guard the job so it only builds `v*` releases. build_on_tag.api.yml triggers on `tags: '*'`, so any tag would rebuild iib-api:qe. Narrow it to `v*`. The scheduled and manual paths in build.yml need no guard: they resolve their tag via find-latest-tag with prefix 'v', which already excludes the `ocp-v*` series used by main. Leaving that step untouched also keeps the weekly base-layer rebuild pinned to the legacy release, so the images feeding `prod` keep receiving RPM/CVE refreshes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Yashvardhan Nanavati <yashn@bu.edu>

github-actions · 2026-09-16T03:38:28Z

Fix agent disabled for this PR. Remove the fullsend-no-fix label or use /fs-fix to re-engage.

fullsend-ai-review · 2026-09-16T03:39:28Z

🤖 Finished Review · ✅ Success · Started 3:39 AM UTC · Completed 3:53 AM UTC

Commit: 37b4e56 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.93

fullsend-ai-review

See the review comment for full details.

fullsend-ai-retro · 2026-09-16T06:25:43Z

🤖 Finished Retro · ✅ Success · Started 6:25 AM UTC · Completed 6:34 AM UTC

Commit: 37b4e56 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.64

fullsend-ai-retro · 2026-09-16T06:34:49Z

Retro: PR #1385 — ci: scope legacy release builds to the v* tag series

Workflow quality: Good overall, with one infrastructure issue inflating cost.

This was a clean, human-authored CI change (+17/−1 across 2 workflow files) by a known contributor. The review agent ran twice (Sep 10 at $3.20 and Sep 16 at $2.93 = $6.13 total), both times producing identical procedural findings — [protected-path] (High) and [missing-authorization] (Low). No code quality or correctness issues were found by any reviewer (agent, Qodo, or human). Human reviewer lipoja approved the PR on Sep 11; the author merged on Sep 16 after using /fs-fix-stop to disable the fix agent.

Timeline

Sep 10 22:46 — PR opened (commit 8f6f8bb), fullsend opened event triggers review
Sep 10 22:59 — Review agent posts findings (protected-path, missing-authorization), submits CHANGES_REQUESTED ($3.20)
Sep 11 06:09 — Human (lipoja) approves on updated commit 37b4e56
Sep 16 03:38 — Author posts /fs-fix-stop, rebases at the same time; synchronize event triggers second review
Sep 16 03:39–03:53 — Second review run starts; pre-fetch-prior-review.sh finds the first review's comment but discards it due to empty expected app client_id (Prior review comment 5626563054 created by app client_id=Iv23li1nIorNLIQy6NWK, expected — discarding (wrong app)). Full re-review produces identical findings, submits CHANGES_REQUESTED again ($2.93)
Sep 16 06:24 — Author merges PR with human approval overriding agent objection

Evidence for existing issues (no new proposals needed)

All identified improvement areas have existing open issues in fullsend-ai/fullsend:

Empty REVIEW_APP_CLIENT_ID silently disables delta review for re-reviews fullsend-ai/fullsend#6911 (Empty REVIEW_APP_CLIENT_ID silently disables delta review): Direct evidence — the second review run's log shows the expected client_id field was blank, causing prior review context to be discarded and forcing a full $2.93 re-review with identical results. This is the root cause of the wasted second run.
Review dispatch should skip re-review when diff is unchanged between pushes fullsend-ai/fullsend#6968, #4401 (Skip re-review when diff is unchanged): The rebase on Sep 16 did not change the effective diff, yet a full re-review ran.
Review agent: downgrade protected-path severity for human-authored PRs fullsend-ai/fullsend#1551, Prepare 10.0.0, the first release of the containerized track #1392 (Protected-path severity for human-authored PRs): The protected-path finding was procedural noise — the PR was already going through human review, which is exactly the remediation the finding requests.
CHANGES_REQUESTED persists indefinitely when re-review infrastructure fails fullsend-ai/fullsend#5380 (CHANGES_REQUESTED persists after satisfaction): The agent's CHANGES_REQUESTED was never dismissed even though the human approval on Sep 11 satisfied the protected-path requirement.
Add .claude/AGENTS.md with domain-specific review guidance #1366 (Add AGENTS.md with domain-specific review guidance): The repo has no AGENTS.md or .claude/ context files. Domain-specific guidance could help the review agent calibrate findings for this repo's CI patterns.

fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Sep 10, 2026

This comment was marked as outdated.

Sign in to view

lipoja approved these changes Sep 11, 2026

View reviewed changes

yashvardhannanavati force-pushed the release-ci-guard-legacy branch from 8f6f8bb to 37b4e56 Compare September 16, 2026 03:38

github-actions Bot added the fullsend-no-fix Skip bot-triggered fix agent runs label Sep 16, 2026

fullsend-ai-review Bot suggested changes Sep 16, 2026

View reviewed changes

yashvardhannanavati merged commit cc2a26b into master Sep 16, 2026
22 checks passed

yashvardhannanavati deleted the release-ci-guard-legacy branch September 16, 2026 06:24

Conversation

yashvardhannanavati commented Sep 10, 2026

Uh oh!

qodo-for-releng Bot commented Sep 10, 2026

PR Summary by Qodo

Uh oh!

fullsend-ai-review Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-for-releng Bot commented Sep 10, 2026

Code Review by Qodo

Great, no issues found!

Uh oh!

fullsend-ai-review Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Findings

High

Low

Review

Findings

High

Low

Uh oh!

This comment was marked as outdated.

Uh oh!

yashvardhannanavati commented Sep 16, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

fullsend-ai-review Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Sep 16, 2026

Retro: PR #1385 — ci: scope legacy release builds to the v* tag series

Timeline

Evidence for existing issues (no new proposals needed)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fullsend-ai-review Bot commented Sep 10, 2026 •

edited

Loading

fullsend-ai-review Bot commented Sep 10, 2026 •

edited

Loading

fullsend-ai-review Bot commented Sep 10, 2026 •

edited

Loading

fullsend-ai-review Bot commented Sep 16, 2026 •

edited

Loading

fullsend-ai-retro Bot commented Sep 16, 2026 •

edited

Loading