[ErenAri]

Draft rc.5 preparation PR. Merge only on an exact-head operator decision. It replaces #264: this branch is #264's exact head (115a3745) plus six fix commits. #264 is not rewritten or closed; the maintainer chooses which draft to keep. Nothing here approves rc.5 publication or qualification. The CHANGELOG date stays TBD until the final update before tagging.

What it carries

From #264, unchanged:

• release.yaml release_version: 0.4.0-rc.5;
• the CHANGELOG ## [0.4.0-rc.5] - TBD section;
• the read-only scripts/rc-preflight.sh inventory and its test;
• the YAML-AST pin parser internal/tools/rcpreflight;
• a CI step.

The six fix commits:

Commit	Change
135889f	The parser builds offline with a cached go.mod toolchain. #264 forced GOTOOLCHAIN=local, so every post-publication preflight aborted with an older Go on PATH; #264's own test failed 29 checks there. Usage and IO errors now exit 2 instead of printing PENDING.
334ce96	Review 1: pins under a literally-false if no longer count. The build cannot download a toolchain even with a caller GOPRIVATE/GONOPROXY (GONOPROXY/GONOSUMDB pinned to a non-matching pattern). The canary's CANDIDATE_* env is read from the YAML tree (env mode). Merge keys are rejected, and the commit is matched exactly.
a6b0918	Review 2: every constant if other than true counts as never running. Skips propagate through needs. The case-variant check covers only workflow, job and step keys. Diagnostics show the value found.
0f8f3b2	Review 3: matches GitHub's semantics. An empty or YAML-null if is no condition, and true is matched case-insensitively. Only always() and !cancelled() resume after a skipped need, and a quoted status function does not count. needs job IDs compare case-insensitively. Unknown, self or cyclic needs and job IDs differing only by case are rejected.
3eb880c	Canary/campaign and documentation analysis. The designated canary's crons must each fire inside a timed window the plan job accepts, [T0+20h, T0+31h) and [T0+68h, T0+79h): the helper gains a schedule mode with a small cron matcher. campaign-candidate.json must record this release's SHA256SUMS and candidate-evidence digests. The rc.5 CHANGELOG notes are corrected against the code.
e1cbd97	Review 4. A schedule entry with any key besides cron (GitHub's timezone, for one) is refused, because only cron is evaluated, in UTC. The cron fields are stricter: names only in their own field, digits only, steps bounded by the field range (a huge step crashed the helper), the documented a/n form, day of week 0–6, and a day field starting with * is unrestricted, as in cron. A non-object campaign-candidate.json aborts the report instead of truncating it. CHANGELOG wording fixed.

Validation at e1cbd97

• scripts/rc-preflight_test.sh: 45/45 with the workstation's default Go 1.22 on PATH, and 45/45 with GOTOOLCHAIN=go1.26.9. The checks added in 3eb880c (stale campaign digest, stale crons) fail against 0f8f3b2.
• Helper unit tests pass with -race. The new cases of each fix commit fail against its parent, except two of e1cbd97's eight, which also pass on 3eb880c (the review's R5-N2). Logs are in the task record.
• All 47 combined local checks pass in the author's environment: golangci-lint built with Go 1.26.9, race tests, coverage, release consistency, canary pins, docs, actionlint, freeze, and every CI shell test. Reviewers' local golangci-lint could not run, being built with an older Go; CI's golangci-lint is green.
• Historical corpus test (independent test specialist, at a6b0918): the parser agreed with independently derived designations on every revision of consumer-canary.yml (9) and release-candidate-canary.yml (7) on main, plus 4 branch-tip versions. That is 348 runs, 0 disagreements.
• Live read-only preflight:
  • for rc.4 with --commit 222c3f38…, it exits 1. The three designations are VERIFIED from the YAML tree, now including rc.4's real campaign digests and its two crons inside both windows, and the three rc.4 canary runs are VERIFIED. The newer assets and policy file are MISSING, as expected for rc.4.
  • for rc.5, it exits 0, with everything after the metadata PENDING.
• Reviews: independent exact-head reviews of 135889f, 334ce96, a6b0918, 3eb880c and e1cbd97. The last two found no blocker, and review 5 (e1cbd97) found no should-fix and judged release: prepare v0.4.0-rc.5 metadata and an offline, AST-based RC preflight (replaces #264) #265 ready for the merge decision. Their findings are closed above, except the limitations below.

Known limitations

• Cron spacing: a cron with a tab, a leading space or cron: | block style is accepted, although GitHub's published cron validator rejects it (review 5, R5-N1). The designation should use single-spaced, double-quoted UTC crons with no timezone key.
• Both day fields restricted: the checker assumes either one may match (Vixie cron). The canary's M H D Mon * shape is unaffected.
• Not evaluated: conditions that call functions (fromJSON('false'), always() && false) or read a context are left to the runner; only constants are judged.
• Env rebinding the static check cannot see:
  • $GITHUB_ENV writes;
  • jobs.<id>.container.env;
  • case-variant env names (Linux env is case-sensitive; this was not verified on a runner).
• Schedules: only cron is evaluated, in UTC; an entry with timezone or any other key is refused. The rc.5 designation should write UTC crons with no timezone.
• Delay margin: the cron check asks only that a cron fires inside each window. How much schedule-delay margin to leave is the operator's choice when designating. The precedent offsets of +24h15m and +72h15m absorb 6h45m of delay.
• Elsewhere in the preflight (accepted earlier):
  • the plan job is found by its display name;
  • releases are read from one page of 100;
  • the shell test skips itself once release.yaml is no longer a prerelease.
• Separate draft PR release: let the stable PR and tag build pass the stable canary-pin and doc-pin checks #266: the stable track's canary-pin self-reference (DEF-1) is fixed there, not here.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}