Orchestrate Release Readiness Checks

[PSchmiedmayer]

♻️ Current Situation & Problem

Release publication polls a manually maintained list of check names from independent main workflow runs. The first 0.1.0 attempt exposed the weakness of that contract: the list included the CodeQL workflow display name instead of an emitted check context, so publication waited until timeout even though both CodeQL analyses passed. The polling design also duplicates GitHub's native job dependency model and requires every workflow rename to be synchronized manually.

⚙️ Release Notes

• Expose each release-required component workflow through workflow_call while preserving independent manual diagnostic execution.
• Add one Main Validation workflow that invokes repository validation, CodeQL, Python, web, secret scan, container smoke, native asset, CPU image, and GPU image workflows once per pull request and main commit.
• Add a final Release Candidate Ready job that uses native needs results and fails unless every required component succeeds.
• Make release publication verify that single result on the exact candidate commit once and fail immediately when readiness is missing, incomplete, skipped, cancelled, or failed.
• Remove the polling loop, commit-status query, and manually synchronized required-check manifest.
• Retain immutable image verification, versioned native asset rebuilding, protected approval, and exact-commit publication checks.
• Update the active main ruleset to require aggregate readiness plus the default CodeQL language analyses, CodeRabbit, and dependency review instead of internal component names.

📚 Documentation

The release guide and development design now document the reusable component workflows, dependency-based Main Validation graph, fail-fast publication gate, and maintenance procedure for adding or removing release requirements.

✅ Testing

• 433 Python tests pass with 90.09% aggregate branch coverage.
• Governance tests require every component workflow to be reusable, prohibit duplicate direct pull-request and main triggers, verify every orchestrated component is a readiness dependency, isolate caller concurrency, and reject release polling.
• Actionlint, yamllint, Ruff formatting and lint, strict mypy, Markdown whitespace, and REUSE 3.3 compliance pass locally.
• Both automated review findings were addressed by removing the duplicated manifest parser as part of the orchestration change.

Code of Conduct & Contributing Guidelines

By creating and submitting this pull request, you agree to follow our Code of Conduct and Contributing Guidelines:

• I agree to follow the Code of Conduct and Contributing Guidelines.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release-required checks configuration no longer includes the generic CodeQL context. A new release governance test parses the configuration, ignores comments and blank lines, requires the JavaScript/TypeScript and Python CodeQL analysis contexts, and verifies that the generic context is absent.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is related to the PR's release-gate orchestration changes, though it is broader than the specific CodeQL manifest update.
Description check	✅ Passed	The description directly explains the release readiness check changes and the accompanying regression test.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates the release-gate required-check manifest to stop waiting on a non-emitted aggregate CodeQL check context, and adds a regression test to keep the manifest aligned with the intended CodeQL check contexts.

Changes:

• Removed the CodeQL context entry from .github/release-required-checks.txt.
• Added a governance regression test asserting the manifest requires the two CodeQL language analysis contexts and does not include CodeQL.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
packages/compliance/tests/test_release_governance.py	Adds a regression test validating the required-check manifest’s CodeQL-related contexts.
.github/release-required-checks.txt	Removes the aggregate CodeQL required-check context from the release gate manifest.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/compliance/tests/test_release_governance.py`:
- Around line 69-75: Update the required-checks parsing in the test to match
deploy/verify_release_candidate.py::_required_checks: strip each line before
adding it to the set, and ignore comments after leading whitespace using
line.lstrip().startswith("#"). Preserve blank-line filtering so assertions
validate normalized manifest entries.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 920fe61f-0759-40c3-93e5-05e84bc810f3

📥 Commits

Reviewing files that changed from the base of the PR and between 3845860 and 67a3d09.

📒 Files selected for processing (2)

• .github/release-required-checks.txt
• packages/compliance/tests/test_release_governance.py

💤 Files with no reviewable changes (1)

• .github/release-required-checks.txt

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.