feat(release): add deployment manifest commands - #62
Conversation
|
@codex review |
|
To use Codex here, create a Codex account and connect to github. |
![autohive-ai-beta[bot]](https://avatars.githubusercontent.com/in/4631178?s=60&v=4){kind=small}
There was a problem hiding this comment.
| Verdict | Errors | Warnings | Suggestions |
|---|---|---|---|
| Reviewed | 0 | 1 | 0 |
Reviewed
Summary
PR adds hiveup release-plan/release-manifest commands and a new release.py module that resolves a safe integration selection and writes a checksummed deployment manifest with GitHub provenance; version bumped to 2.5.0 throughout. Static review of the diff and the checked-out repo found the logic sound overall (path/identity validation, duplicate detection, and safe selection resolution all check out), but dynamic test execution wasn't possible because pip install -e . failed offline on the private autohive-integrations-sdk dependency, so tests/test_release.py could not be run in this environment.
Observations
- Both new CLI commands only catch
ReleaseManifestError(cli.py lines ~310, ~344); any other exception raised fromrelease.py(e.g. a nonexistent--repository-root, which raisesFileNotFoundErrorfromiterdir()) will surface as a raw Python traceback instead of the clean, exit-code-2 error UX the rest of the command demonstrates. Consider validating/normalizing inputs earlier or widening the except clause at the CLI boundary.
Review powered by Autohive
| f"source identity for '{source_path}' must be 1-128 letters, numbers, spaces, '.', '_', or '-'" | ||
| ) | ||
| package_type = override.get("package_type", "preserve") | ||
| if package_type not in PACKAGE_TYPES: |
There was a problem hiding this comment.
package_type is taken directly from an untyped JSON override (override.get("package_type", "preserve")) and checked with package_type not in PACKAGE_TYPES. Every other override field (source_id, the config-loaded dict itself, etc.) is guarded with an isinstance check before use, but this one isn't: if .github/autohive-release.json sets package_type to a list or dict (e.g. "package_type": ["zip"]), the in check on a set raises an unhandled TypeError: unhashable type, crashing the CLI with a raw traceback instead of the intended graceful ReleaseManifestError that keeps a release from being created. Add an isinstance(package_type, str) guard before the membership check, consistent with the source_id validation just above it.
| if package_type not in PACKAGE_TYPES: | |
| package_type = override.get("package_type", "preserve") | |
| if not isinstance(package_type, str) or package_type not in PACKAGE_TYPES: | |
| raise ReleaseManifestError( | |
| f"package_type for '{source_path}' must be one of: {', '.join(sorted(PACKAGE_TYPES))}" | |
| ) |
1 participant
Closes #61
Summary
release-planselection for one, several, or all top-level integrationsrelease-manifestwith stable source identity, package type, full commit/workflow provenance, byte size, and SHA-256Testing
python -m pytest tests/test_release.py -q(9 passed)hiveup-2.5.0wheel and source distributionRollout dependency
After merge, publish the immutable
2.5.0tag before enabling the dependent integrations workflow.