[khaliqgant]

Summary

• add workflow_dispatch and component-published intake for Sessions, Control, and Webapp
• fail closed on strict SemVer, digest, source commit, component/repository allowlist, and GitHub build-provenance verification
• maintain a versioned release values overlay plus provenance ledger on release/agent-relay-X.Y.Z
• open or update the release PR with an idempotent verified-pins table

Safety

• dispatch data cannot choose a registry, source repository, workflow, branch path, or repository path
• candidate values remain separate from approved customer profiles until acceptance
• this PR does not tag, publish, or deploy anything

Verification

• 5 focused unit tests pass
• generated overlay parses and an EKS/RDS umbrella renders with all expected image surfaces
• actionlint 1.7.12 passes
• live provenance spot-check: current Control and Webapp pins pass exact-source verification; the older Sessions alpha.5 pin has no GitHub attestation and is correctly rejected

Follow-up

The acceptance/approval tag gate and release install-pack assets will land as separate reviewed PRs.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Automates Agent Relay release candidate intake: a new workflow and companion script verify component build provenance, pin the verified images to release/agent-relay-X.Y.Z branches, and keep the tracking PR updated. Nothing is tagged, published, or deployed by this PR; the acceptance/approval tag gate will land separately.

New Features

• Ingests component pins from manual workflow dispatch or component-published events for sessions-pipeline, relay-control, and relay-webapp; 8 focused unit tests now run in the lint workflow.
• Fails closed on strict SemVer, lowercase sha256 digest, full source commit, allowlisted component/repository pairs, GitHub attestation verification, a blocked-digest list for withdrawn relayscrubber sessions images, and a scrub-bindgen pin fetched from the exact source revision.
• Retries rejected pushes up to 5 times when concurrent component publications race, refetching the winning branch and reapplying the component so no event is lost.
• Keeps a versioned pins.json provenance ledger and generated values.yaml overlay per release branch, and rewrites the PR's verified-pins table from the latest remote head, retrying if another run pushes mid-update.

^{Written for commit c7cff2b. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 29 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 125f4cfe-9f77-4757-a781-d9a7835f2a62

Commits

Reviewing files that changed from the base of the PR and between 63300f0 and c7cff2b.

Files selected for processing: 5

• .github/workflows/lint.yml
• .github/workflows/release-candidate.yml
• ci/agent-relay/test_release_candidate.py
• scripts/release/blocked-image-digests.json
• scripts/release/update-release-candidate.py

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T22:47:16.388592Z	5cc8c3f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[miyaontherelay]

infra-chief review on 5cc8c3f: request changes (3 findings). The structure is good.

1. P1, provenance is not bound to the release workflow or to main. gh attestation verify ... --repo --source-digest accepts an attestation from ANY workflow and ANY ref in the source repo. If a PR, branch or manual build there pushes and attests an image, it would pass. Add --signer-workflow <owner>/<repo>/.github/workflows/<release-image workflow>.yml per component (put it in the component allowlist next to imageRepository/sourceRepository) and --source-ref refs/heads/main. Then assert in the JSON that the predicate's workflow ref matches.

2. P1, pushes made with GITHUB_TOKEN do not trigger workflows, so commits this job pushes to the release branch will not start the release PR's CI or the future acceptance check. The gate in PR2 would then sit on stale results or never go green. Push with a GitHub App installation token (the org pusher app, GH_APP_PUSHER_ID / GH_APP_PUSHER_PRIVATE_KEY, scoped to this repo with contents:write and pull-requests:write) so pushes trigger CI. Alternatively, explicitly dispatch the CI and acceptance workflows for the new head. Add a test or note.

3. P2, no scrubber safety gate for sessions-pipeline. Withdrawn digests must never become pins: 4cf44e471055360dad3d182cbe4e578da4c9c078315aa5126ef9c2de503535da and e7dded94a0f62a30e529ce0e8ef708ca77b0bc1762a9fb080b8ecba2fc76f41c (relayscrubber alpha.6). Add a repo-tracked deny-list of digests that is checked before update. For sessions-pipeline, also check that the source_sha's packages/pipeline/scrub-bindgen-pin.json pins an allowed relayscrubber version (alpha.5 or alpha.8+, never alpha.6 or alpha.7), read via the GitHub API at that exact commit.

Everything else looks right: env-var passing (no direct ${{ }} interpolation into shell), strict regex validation, the single-open-release-PR selection, the concurrency group, and checking out the automation from main.

[devin-ai-integration]

Devin Review found 3 potential issues.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5cc8c3fb64

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the previous PR-table race is addressed.

Summary

Automates Agent Relay release candidates with checked image digests and GitHub build provenance.

• Only verified component images can enter a release candidate.
• Candidate branches keep component image pins in a versioned overlay.
• The release pull request keeps its verified-pins table in sync.

No new actionable issues were found in the changes since the previous review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Manual or component-published request] --> B[Check inputs and image policy]
  B --> C[Verify GitHub build provenance]
  C --> D[Read candidate branch and update component pin]
  D --> E{Push succeeds?}
  E -- No --> D
  E -- Yes --> F[Read remote pins and write PR table]
  F --> G{Branch head unchanged?}
  G -- No --> F
  G -- Yes --> H[Candidate PR updated]

Loading

_{Reviews (3) · Last reviewed commit: "fix(release): converge candidate PR tabl..." · Reviewed by Greptile}

[miyaontherelay]

infra-chief re-review on c0302a7. Findings 1 and 3 are fixed and verified: signer workflow, refs/heads/main and the SLSA predicate re-assert; the deny-list blocks 4cf44e47/e7dded94; the exact-source scrub pin rejects alpha.6/7 and accepts alpha.5 and alpha.8+.

One blocker remains on finding 2: the token step uses app-id: ${{ vars.GH_APP_PUSHER_ID }}, but AgentWorkforce/infra has NO repo or org variable named GH_APP_PUSHER_ID. It is an org secret (GH_APP_PUSHER_ID and GH_APP_PUSHER_PRIVATE_KEY are both visible to infra as organization secrets, matching AgentWorkforce/relay's secrets.GH_APP_PUSHER_ID). As written, app-id is empty and the first real run fails. Use secrets.GH_APP_PUSHER_ID. Approve after that one-line change.

[miyaontherelay]

infra-chief: APPROVE on exact head 48f5f0e. All three findings resolved (signer-workflow + refs/heads/main + predicate re-assert; pusher-app token via secrets.GH_APP_PUSHER_ID so pushes trigger CI; withdrawn-digest deny-list + exact-source scrub pin). The ref:main checkout and the optimistic reconcile replacing lossy concurrency are improvements.

[miyaontherelay]

infra-chief: APPROVE re-pinned to c7cff2b. The delta from 48f5f0e is only the PR-table rendering race fix (render from latest remote pins, refetch, retry on head change, bounded to 5 attempts, fail closed). No change to provenance, token or deny-list logic.