ci: fix dev-publish versioning, add pre-merge semver-label check, dedupe CodeQL, cut dev-image refs#582
Merged
Conversation
…upe CodeQL, cut dev-image refs Four release-pipeline fixes: - publish-test.yml: the "Generate dev version" step still grepped/sed'd a static `version = "..."` in pyproject.toml, but the project moved to `dynamic = ["version"]` reading src/synth_panel/__version__.py. The sed silently no-oped, every push rebuilt the identical 1.5.7 wheel, and TestPyPI rejected it (400 File already exists) — 23 consecutive red runs. Now reads/writes the version file directly, asserts the base version is non-empty, and adds a post-build tripwire that fails loud if dist/ contains no .dev-suffixed artifact. - semver-label.yml (new): pre-merge "Semver Label" check that fails unless the PR carries exactly one of semver:patch|minor|major|skip. The post-merge Auto Semver Tag workflow fails loud on a missing label, but only after merge — every merge since v1.5.7 shipped unlabeled and no release was cut. This surfaces the requirement while it is still a one-click fix. (Wired as a required check separately.) - codeql.yml: drop the push-to-main trigger; every change reaches main via PR so each change was scanned twice. PR trigger + weekly cron stay. - Cut retiring dev-image refs: delete .devcontainer/ (based on ghcr.io/dataviking-tech/ai-dev-base, which the org is retiring), drop the stale devcontainer mentions from Dockerfile comments, .gitignore, .dockerignore, and docs/agent-integration-landscape.md. The published runtime image already builds FROM python:3.12-slim — no rebase needed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Deploying synthpanel with
|
| Latest commit: |
2bd35fa
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://bdb8295a.synthpanel.pages.dev |
| Branch Preview URL: | https://ci-release-pipeline-fixes.synthpanel.pages.dev |
claude-dataviking
requested review from
openclaw-dv and
the-data-viking
as code owners
July 18, 2026 18:02
claude-dataviking
enabled auto-merge (squash)
July 18, 2026 18:02
claude-dataviking
added a commit
that referenced
this pull request
Jul 18, 2026
#583) PR #581 merged without a semver label, so its Auto Semver Tag run failed (as designed). The recovery rerun — after labeling semver:minor — got as far as pushing the bump commit, but the rerun replays the original event payload: its checkout pinned main at PR #581's merge, and main has since advanced (PR #582), so the push was rejected non-fast-forward. Reruns always replay the same stale SHA, so that path cannot succeed anymore. This PR takes auto-tag.yml's documented escape hatch instead: pre-bump every version artifact to 1.6.0 in the PR itself. On merge, the auto-tag run finds the artifacts already at the new version, skips the release-bot push, and proceeds straight to tag + GitHub Release + publish dispatch. Rendered via the same scripts auto-tag runs (render_site.py, render_site_markdown.py, render_server_card.py). Also picks up server.json, which render_server_card.py rewrites but auto-tag's git-add list does not stage. Co-authored-by: njord <njord@njords-Mac-mini.localdomain> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The release pipeline has been silently stalled since v1.5.7 (Jun 5): zero releases despite 23 merges. Two independent failures, both red on every single merge:
semver:*labels, and the post-merge workflow fails loud on a missing label. By the time it goes red, the merge has already shipped; nobody circled back.version = "..."inpyproject.toml, but the project moved todynamic = ["version"]readingsrc/synth_panel/__version__.py. The sed silently no-ops, every push rebuilds the identical 1.5.7 wheel, and TestPyPI rejects the re-upload (400 File already exists).Separately, the org is retiring its dev-container images (
ghcr.io/dataviking-tech/ai-dev-base), so all refs must go, and CodeQL was scanning every change twice (PR + push-to-main).What
publish-test.yml: read the base version fromsrc/synth_panel/__version__.py, assert it is non-empty, write{base}.dev{run_number}back to the version file (the sourcepyproject.tomlactually reads). Post-build tripwire: fail loud ifdist/contains no.dev-suffixed artifact, so a future version-source move can never silently no-op again.semver-label.yml(new): pre-merge Semver Label check onpull_request[opened, reopened, synchronize, labeled, unlabeled]— fails unless exactly one ofsemver:patch|minor|major|skipis present (labels read from the event payload viatoJSON+jq). Moves the auto-tag failure from post-merge (too late) to the PR (one click to fix). Will be wired as a required check separately.codeql.yml: drop thepush: branches: [main]trigger; keep PR trigger + weekly cron. Every change reaches main via PR, so the push scan was a pure duplicate..devcontainer/(imageghcr.io/dataviking-tech/ai-dev-base:edge), drop devcontainer mentions from theDockerfileheader comment,.gitignore,.dockerignore, anddocs/agent-integration-landscape.md. The published runtime image already buildsFROM python:3.12-slim— no rebase needed.README.mdcontains no devcontainer/dev-image references (itsghcr.iomentions are the published synthpanel image itself). CHANGELOG history untouched.auto-tag.ymldeliberately untouched (separate fix landing in dataviking-infra).Verification
BASE=1.5.7extracted,1.5.7.dev999written back, resolved by the sameattrpath setuptools uses.semver:*— correct pass/fail on each.grep -ri 'devcontainer|ai-dev-base'clean outside CHANGELOG.This PR carries
semver:skip: CI/docs only, nothing in the published package changes, and the un-stall release (re-running PR #581's auto-tag withsemver:minor) follows once this merges.🤖 Generated with Claude Code