Add coverage-gated well permit to production flow - #89
Conversation
Sorry, something went wrong.
|
Warning Review limit reached@karlwaldman, you've reached your PR review limit, so we couldn't start this review. Next review available in: 45 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR. To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: f07b80d1-b886-4321-ab54-148c7abbe5de 📥 CommitsReviewing files that changed from the base of the PR and between 77f5be9 and 8a91184. 📒 Files selected for processing (5)
WalkthroughThe SDK adds normalized synchronous and asynchronous well-permit searches. The release workflows now verify artifacts before publishing, validate PyPI readback, attach release assets, pin actions, restrict sensitive jobs, and enforce checkout security. ChangesRelease and API updates
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant VerifyJob
participant ArtifactStore
participant PublishJob
participant PyPI
participant ReadbackJob
participant GitHubRelease
VerifyJob->>ArtifactStore: Upload verified distributions and checksums
PublishJob->>ArtifactStore: Download and validate checksums
PublishJob->>PyPI: Publish verified distributions
ReadbackJob->>PyPI: Compare public distribution hashes
ReadbackJob->>GitHubRelease: Upload verified snippet manifest and checksum file
Possibly related PRs
❌ Failed checks (1 warning)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. ❤️ ShareComment @coderabbitai help to get the list of available commands. |
Sorry, something went wrong.
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2).github/workflows/publish.yml (2)🤖 Prompt for all review comments with AI agents40-48: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
Extract the duplicated version-reading script.
Lines 40-48 and 96-104 embed the same inline Python program that parses version from pyproject.toml. Two copies can drift. The repository already keeps helper scripts under scripts/. Move this logic into one script and call it from both steps.
Also applies to: 96-104
🤖 Prompt for AI AgentsVerify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish.yml around lines 40 - 48, Extract the duplicated inline Python version parser from the workflow steps assigning PACKAGE_VERSION into a single helper script under scripts/. Update both version-reading steps around PACKAGE_VERSION to invoke that shared script, preserving the existing pyproject.toml parsing and missing-version failure behavior.
174-200: 🩺 Stability & Availability | 🔵 Trivial
Consider a longer readback budget.
The loop runs 12 attempts with a 5-second sleep. The minimum total wait is about 60 seconds. PyPI JSON API propagation can take longer than that after an upload. If propagation is slow, this job fails after a successful publish, and the release_assets job never runs even though the release is valid.
Increase the attempt count or use an increasing backoff so that a slow index does not block asset attachment.
🤖 Prompt for AI AgentsVerify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish.yml around lines 174 - 200, Extend the PyPI readback window in the verification loop around the attempt counter and sleep so propagation can exceed the current roughly 60-second budget. Increase the retry count or implement an increasing backoff while preserving the existing hash validation and successful exit once all distributions are visible.
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 138-146: Update the “Verify exact artifact checksums” workflow
step to compare the number of files in dist/ with the number of entries in
artifact.sha256 before publishing. Fail the step when the counts differ, while
preserving the existing sha256sum -c validation and publish configuration.
In `@README.md`:
- Around line 152-155: Validate that the result assigned to summary from
client.well_production.summary() is a dictionary before calling
summary.get("coverage"). If validation fails, raise RuntimeError with the
existing MALFORMED_RESPONSE convention; retain the coverage validation and
subsequent behavior for valid dictionary responses.
In `@tests/test_release_readiness.py`:
- Around line 127-135: Update the WORKFLOWS discovery and its consumers,
including test_every_workflow_pins_actions_and_hardens_each_checkout_step, to
include both *.yml and *.yaml workflow files. Preserve the existing pinning and
checkout-hardening assertions for every discovered workflow.
---
Nitpick comments:
In @.github/workflows/publish.yml:
- Around line 40-48: Extract the duplicated inline Python version parser from
the workflow steps assigning PACKAGE_VERSION into a single helper script under
scripts/. Update both version-reading steps around PACKAGE_VERSION to invoke
that shared script, preserving the existing pyproject.toml parsing and
missing-version failure behavior.
- Around line 174-200: Extend the PyPI readback window in the verification loop
around the attempt counter and sleep so propagation can exceed the current
roughly 60-second budget. Increase the retry count or implement an increasing
backoff while preserving the existing hash validation and successful exit once
all distributions are visible.
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info ⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 03d23721-b52e-4d3a-a9a6-b766efaba8a4
📥 CommitsReviewing files that changed from the base of the PR and between ba974eb and 77f5be9.
📒 Files selected for processing (13)- .github/workflows/github-pages.yml
- .github/workflows/live-tests.yml
- .github/workflows/publish.yml
- .github/workflows/test.yml
- .github/workflows/weekly-health.yml
- CHANGELOG.md
- README.md
- oilpriceapi/async_resources.py
- oilpriceapi/resources/ei/well_permits.py
- oilpriceapi/version.py
- pyproject.toml
- tests/test_release_readiness.py
- tests/unit/test_ei_well_permits_resource.py
Sorry, something went wrong.
Summary
Red / green
Release safety
Publish only after this exact head is merged through protected main and its default-branch keyed synthetics pass. The release workflow accepts only a tag reachable from protected main, passes only a checksummed artifact to the OIDC publisher, verifies exact public PyPI hashes, and attaches the checked snippet manifest after public readback.
Summary by CodeRabbit