akanealw
eec8c28fb3
Some checks failed
Go Benchmark / Performance Regression Check (push) Has been cancelled
Cerberus Integration / Cerberus Security Stack Integration (push) Has been cancelled
Upload Coverage to Codecov / Backend Codecov Upload (push) Has been cancelled
Upload Coverage to Codecov / Frontend Codecov Upload (push) Has been cancelled
CodeQL - Analyze / CodeQL analysis (go) (push) Has been cancelled
CodeQL - Analyze / CodeQL analysis (javascript-typescript) (push) Has been cancelled
CrowdSec Integration / CrowdSec Bouncer Integration (push) Has been cancelled
Docker Build, Publish & Test / build-and-push (push) Has been cancelled
Quality Checks / Auth Route Protection Contract (push) Has been cancelled
Quality Checks / Codecov Trigger/Comment Parity Guard (push) Has been cancelled
Quality Checks / Backend (Go) (push) Has been cancelled
Quality Checks / Frontend (React) (push) Has been cancelled
Rate Limit integration / Rate Limiting Integration (push) Has been cancelled
Security Scan (PR) / Trivy Binary Scan (push) Has been cancelled
Supply Chain Verification (PR) / Verify Supply Chain (push) Has been cancelled
WAF integration / Coraza WAF Integration (push) Has been cancelled
Docker Build, Publish & Test / Security Scan PR Image (push) Has been cancelled
Repo Health Check / Repo health (push) Has been cancelled
History Rewrite Dry-Run / Dry-run preview for history rewrite (push) Has been cancelled
Prune Renovate Branches / prune (push) Has been cancelled
Renovate / renovate (push) Has been cancelled
Nightly Build & Package / sync-development-to-nightly (push) Has been cancelled
Nightly Build & Package / Trigger Nightly Validation Workflows (push) Has been cancelled
Nightly Build & Package / build-and-push-nightly (push) Has been cancelled
Nightly Build & Package / test-nightly-image (push) Has been cancelled
Nightly Build & Package / verify-nightly-supply-chain (push) Has been cancelled
1.8 KiB
Executable File
1.8 KiB
Executable File
Beta Release Draft Pull Request
Overview
Draft PR to merge hardened CI/release workflow changes from feature/beta-release into feature/alpha-completion.
Highlights
- Secret token migration: prefer
GITHUB_TOKENwhile maintaining support forCHARON_TOKEN(fallback) where needed. - Release workflow refinements: stable prerelease detection (alpha/beta/rc), artifact matrix intact.
- Prior infra hardening (already partially merged earlier): pinned GitHub Action SHAs/tags, resilient Delve (
dlv) multi-arch build handling. - Extensive incremental documentation trail in
docs/beta_release_draft_pr.mdplus concise snapshot indocs/beta_release_draft_pr_body_snapshot.mdfor reviewers.
Ahead Commits (Representative)
Most recent snapshot commit: 308ae5dd (final body content before PR). Full ordered list in docs/beta_release_draft_pr.md.
Review Checklist
- Secret
GITHUB_TOKEN(orCHARON_TOKENfallback) exists and has required scopes. - No lingering
GITHUB_TOKENorCHARON_TOKENreferences beyond allowed GitHub-provided contexts. - Artifact list (frontend dist, backend binaries, caddy binaries) still correct for release.
Risks & Mitigations
- Secret rename: Mitigate by verifying secret presence before merge.
- Workflow call path validity:
docker-publish.ymlreferenced locally; CI on draft will validate end-to-end.
Deferred Items (Out of Scope Here)
- Frontend test coverage improvements (ProxyHostForm).
- Additional beta observability and import validation tasks.
Actions After Approval
- Confirm CI draft run passes.
- Convert PR from draft to ready-for-review.
- Merge into
feature/alpha-completion.
Request
Please focus review on secret usage, workflow call integrity, and artifact correctness. Comment with any missed token references.
Generated programmatically to aid structured review.