[khaliqgant]

Summary\n- expose the exact published digest and reviewed source commit from the image job\n- after a successful manual publish from main, mint a repository-scoped org pusher App token\n- dispatch component-published to infra with the relay-webapp digest and source SHA\n\n## Safety\n- tag-triggered publications are not dispatched because their provenance source ref is a tag, not refs/heads/main\n- no release, tag, deploy, or provider operation\n- the token is limited to the infra repository and payload identity is validated\n\n## Verification\n- actionlint passed for .github/workflows/container.yml\n- git diff --check passed\n\nOwner review requested before merge.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T23:26:02.693615Z	217aa9a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 45 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c66ba860-452a-4f4b-85ff-538fac7a523e

Commits

Reviewing files that changed from the base of the PR and between 217aa9a and 57edee6.

Files selected for processing: 1

• src/release-candidate-workflow.test.ts

No actionable comments were generated in the recent review.

Walkthrough

The container workflow now exports the published image digest and verified source SHA. After a successful publication on main, a new job validates both values and dispatches a component-published event to AgentWorkforce/infra.

Changes: Publish and release notification

Layer / File(s)	Summary
Expose publication metadata .github/workflows/container.yml	The publish job exposes the built image digest and verified source commit SHA as outputs.
Dispatch publication event .github/workflows/container.yml	After a successful publication on main, the notification job mints an infra-scoped GitHub App token, validates the digest and source SHA formats, and dispatches both values with component relay-webapp.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Sequence Diagram(s)

sequenceDiagram
  participant publish as publish job
  participant notify as notify-release-candidate
  participant app as GitHub App
  participant infra as AgentWorkforce/infra
  publish->>notify: provide digest and verified source SHA
  notify->>app: mint infra-scoped token
  notify->>notify: validate digest and source SHA formats
  notify->>infra: dispatch component-published event

Loading

Merge Risk: Minimal · previous review 217aa

After a successful manual publish on main, the workflow now notifies infra with the image digest and source commit. No concrete merge-blocking risk was found; the change performs no release or deploy operation itself.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title "Notify infra after a verified relay-webapp image publish" matches the main change: the workflow now dispatches a component-published event to the infra repository after a verified image pub…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description is related to the changeset. It states the image job now exposes the published digest and reviewed source commit, and that a manual publish from main mints a repository-scoped App toke…

Full details: Title check

Explanation

The title "Notify infra after a verified relay-webapp image publish" matches the main change: the workflow now dispatches a component-published event to the infra repository after a verified image publish. It names the trigger, the component, and the verification step. The title is specific and concise, and it fits the raw summary and the PR objectives.

Full details: Description check

Explanation

The description is related to the changeset. It states the image job now exposes the published digest and reviewed source commit, and that a manual publish from main mints a repository-scoped App token and dispatches component-published to infra with the digest and source SHA. It also covers the tag-trigger exclusion, the absence of release/deploy operations, and verification steps (actionlint, git diff --check). This matches the summary of the container.yml workflow changes, so the description is specific enough to pass.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the digest glow,
And counts the source-SHA rows.
The main branch sends the news along,
To infra with the component song.
Then hops away through fields of green.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a2f8408f-d4c9-4f9c-992e-b209a10cf8b8

Commits

Reviewing files that changed from the base of the PR and between 994ed42 and 217aa9a.

Files selected for processing: 1

• .github/workflows/container.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[devin-ai-integration]

Devin Review found 1 potential issue.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with no outstanding findings.

Summary

The PR sends infra the published image digest and reviewed source commit after a successful publication from main.

• A successful main publish sends infra the exact relay-webapp image and source commit.

_{Reviews (4) · Last reviewed commit: "test(release): satisfy workflow regex li..." · Reviewed by Greptile}

[khaliqgant]

Workflow review at exact head 217aa9a145b896ed2f6b4a834620fec3228b1dfd: no blocking issues. (Posted by the selfhost-usage-page agent at helm-charter's request. This is the same GitHub account as the PR author, so it's a comment, not an approval.)

Checked:

• Trigger scope: notify-release-candidate runs only with needs: publish, a success result and github.ref == 'refs/heads/main'. publish itself only runs for v* tags or a workflow_dispatch on refs/heads/main, so tag publishes are excluded from the dispatch, as intended.
• Token scope: actions/create-github-app-token mints a token for owner: AgentWorkforce, repositories: infra, permission-contents: write only, the minimum POST /repos/{owner}/{repo}/dispatches needs. The job's own GITHUB_TOKEN is contents: read.
• Pinning: fee1f7d63c2ff003460e3d139729b119787bc349 is exactly what refs/tags/v2 of actions/create-github-app-token points to today.
• Injection: the digest and source sha come from the publish job's outputs (steps.build.outputs.digest from the id: build push step; source_sha from the main-ancestry check, which has to pass before anything publishes). They're passed through env, never interpolated into run, and checked with ^sha256:[a-f0-9]{64}$ and ^[a-f0-9]{40}$ under set -euo pipefail before the call.
• Payload: gh api -f 'client_payload[...]=...' builds the nested object {component, digest, source_sha} with the fixed event_type=component-published.

Non-blocking:

• needs.publish.result == 'success' is redundant with needs: (a skipped or failed publish already skips the job), but it's harmless and explicit.
• No environment: gate on the notify job. That's fine, given the token is scoped to infra dispatches and only after a main publish.
• A failed dispatch fails the run after the image is already pushed, so the image digest stays valid. Retry with a re-run of this job only.

CI at review time: check, amd64 smoke and Devin pass; CodeRabbit and Greptile pending.

[khaliqgant]

Re-review at exact head c32b87e1c36243d633b48cf313c498c5c64d52cc. (Same-account comment, not an approval.)

The delta since 217aa9a is only the new src/release-candidate-workflow.test.ts; container.yml is unchanged, so my earlier workflow review stands and the workflow itself has no blocking issues. CI is green: check, amd64 smoke and Greptile pass.

One open item before merge: Greptile's thread on the test is valid. /digest: \$\{\{ steps\.build\.outputs\.digest \}\}/ also matches subject-digest: ${{ steps.build.outputs.digest }} in both attestation steps. If the digest: line under publish.outputs were deleted, the test would still pass, while the notify job got an empty DIGEST and failed its ^sha256: check. Suggested fix: anchor the assertion to the job-level outputs block, e.g. /outputs:\n\s+digest: \$\{\{ steps\.build\.outputs\.digest \}\}\n\s+source_sha: \$\{\{ steps\.source\.outputs\.source_sha \}\}/, or assert on the line with its leading indentation (/^ digest: \$\{\{ steps\.build\.outputs\.digest \}\}$/m). Optionally also pin id: source on the main-ancestry step, since source_sha depends on it.

[khaliqgant]

Re-check at exact head 3748af9392ed6e2ef298068fa7465f3d9ad2f3a0. (Same-account comment, not an approval.)

The test logic is now right. Extracting the publish and notify-release-candidate jobs separately and requiring the adjacent outputs: block closes Greptile's finding, and container.yml is still unchanged from my earlier review.

Blocking: CI check fails on lint, no-regex-spaces in src/release-candidate-workflow.test.ts at 13:7, 15:38 and 19:7 ("Spaces are hard to count. Use {2}/{4}"). Replace the literal indentation in those regexes with quantifiers, e.g. /^ {2}publish:\n…(?=^ {2}notify-release-candidate:)/m and / {4}outputs:\n {6}digest: …\n {6}source_sha: …/, or run npx eslint --fix src/release-candidate-workflow.test.ts. I'll re-check once check is green.

[khaliqgant]

Re-review at exact head 57edee6713b461de630567d9b7080e3bf7cad1f0: no blocking issues; good to merge. (Same-account comment, not an approval.)

• The delta since 3748af9 is only the no-regex-spaces fix in src/release-candidate-workflow.test.ts: literal indentation became {2}/{4}/{6}, with identical matching.
• The test now pins the publish job's adjacent outputs: block (digest from steps.build, source_sha from steps.source) and the notify job's needs.publish.outputs consumption. The attestation subject-digest lines can no longer satisfy it, so Greptile's finding is closed.
• .github/workflows/container.yml is unchanged from my workflow review at 217aa9a: main-only dispatch, an App token scoped to infra with contents: write, the v2 pin verified, and env-passed regex-validated inputs.
• CI on this head: check, amd64 smoke and Greptile pass; mergeStateStatus CLEAN; 0 unresolved threads.