Repository navigation
Improve workflow reliability and CLI verification - #1224
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The Cosign installer requires envsubst, which is absent from both Playwright container jobs.
2 open findings
What changed in this PR
Improves workflow reliability, release PR rendering, and ToolHive CLI verification.
Changes:
- Scopes snapshot concurrency to command requests.
- Extracts and tests release PR-body rendering.
- Adds Sigstore verification to Actions CLI installations.
| File | Description |
|---|---|
scripts/install-thv.sh |
Verifies release signatures before extraction. |
scripts/upstream-release/render-pr-body.mjs |
Renders and updates release PR bodies. |
scripts/upstream-release/render-pr-body.test.mjs |
Tests rendering and replacement. |
scripts/upstream-release/fixtures/release-1181-env.json |
Provides historical renderer input. |
scripts/upstream-release/fixtures/release-1181-section.txt |
Provides expected historical output. |
.github/workflows/upstream-release-docs.yml |
Uses verified CLI installation and renderer. |
.github/workflows/update-visual-baselines.yaml |
Fixes concurrency and enables verification. |
.github/workflows/_visual-regression.yaml |
Enables verified CLI installation. |
.github/workflows/_static-checks.yaml |
Runs renderer tests in CI. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
JAORMX
approved these changes
Oct 9, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Unrelated PR comments can cancel active snapshot updates, the release workflow renders its PR body in a large inline Bash step, and Actions installs the ToolHive CLI without verifying its signature.
Scope snapshot concurrency to matching requests, extract PR-body rendering into a JavaScript helper, and verify the CLI's Sigstore bundle before extraction in all three Actions workflows that install it. Verification requires the exact ToolHive release workflow/tag identity and GitHub's OIDC issuer. Vercel keeps its existing dependencies.
The changes are split into three commits. Renderer coverage is limited to a historical PR-body comparison and section replacement.
Type of change
Related issues/PRs
Fixes #1112
Fixes #1115
Fixes #1223
Validation
$/local-action syntax diagnostic excluded.