Skip to content

fix(release): build notes from mainline PR merges - #6652

Merged
senamakel merged 3 commits into
tinyhumansai:mainfrom
senamakel:release-notes-merge-commits
Sep 25, 2026
Merged

senamakel merged 3 commits into
tinyhumansai:mainfrom
senamakel:release-notes-merge-commits

Conversation

@senamakel

@senamakel senamakel commented Sep 25, 2026 •

Copy link
Copy Markdown
Member

Summary

  • Generate release notes from first-parent PR merge commits only, excluding branch and direct commits.
  • Recognize GitHub's Merge pull request #N subjects and credit PR authors using GitHub's authorAssociation for first-time contributors.
  • Extend the release smoke check and regression tests for nested merges, direct commits, non-PR merges, and large git logs.

Problem

The release-notes preview job read 20,826 commits from v0.63.12..main after the merge-commit workflow change. It sent an oversized prompt to OpenAI and failed with Your input exceeds the context window of this model.

Solution

collectCommits now traverses only first-parent merge commits and retains those with a PR number. The same range yields 670 PR merges in a local collection check. Contributor credits use each PR's author because GitHub merge commits carry the merger's identity.

Submission Checklist

  • Tests added or updated (happy path and exclusion cases).
  • N/A: Diff coverage ≥ 80% applies to frontend and Rust changed lines; this PR changes a Node release script and documentation. Focused tests passed locally.
  • Coverage matrix updated — N/A: release-script behavior only; no feature row added or removed.
  • All affected feature IDs listed under Related — N/A: no feature IDs changed.
  • No new external network dependencies introduced — the existing GitHub metadata request now includes author association.
  • Manual smoke checklist updated for release-cut surfaces.
  • Linked issue closed — N/A: no issue was supplied.

Impact

Release-note generation only. The generator no longer includes unmerged branch history or direct commits in the note payload. PR metadata is still fetched through gh.

Related

  • Closes: N/A (no linked issue)
  • Follow-up PR(s)/TODOs: None

AI Authored PR Metadata

Linear Issue

  • Key: N/A
  • URL: N/A

Commit & Branch

  • Branch: release-notes-merge-commits
  • Commit SHA: 1bb9117b8e

Validation Run

  • N/A: pnpm --filter openhuman-app format:check — no app files changed.
  • N/A: pnpm typecheck — no TypeScript changed.
  • Focused tests: pnpm test:release-notes (14 passed); node --check; one-PR --no-ai generator smoke; real range collection (670 PR merges).
  • N/A: Rust fmt/check — no Rust files changed.
  • N/A: Tauri fmt/check — no Tauri files changed.

Validation Blocked

  • command: N/A
  • error: N/A
  • impact: N/A

Behavior Changes

  • Intended behavior change: include only mainline PR merges and credit their PR authors.
  • User-visible effect: the preview and production release notes exclude branch commits and avoid the oversized prompt from the failing run.

Parity Contract

  • Legacy behavior preserved: tag/ref resolution, PR links, AI/no-AI output paths, and streaming git-log processing.
  • Guard/fallback/dispatch parity checks: GitHub metadata failures still use the existing fallback PR entry.

Duplicate / Superseded PR Handling

  • Duplicate PR(s): None found for this branch.
  • Canonical PR: This PR.
  • Resolution (closed/superseded/updated): N/A

Summary by CodeRabbit

  • Release Notes
    • Generated release notes now include only pull requests merged into the mainline, excluding branch and direct commits.
    • Contributor credits and first-time contributor status are based on pull request author information.
    • Pull requests are recognized from both standard merge messages and messages ending with a pull request number.

@senamakel
senamakel requested a review from a team September 25, 2026 09:30
@tinysweeper

tinysweeper Bot commented Sep 25, 2026 •

Copy link
Copy Markdown

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 4 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Changes requested
Priority: high
Reviewed head: 1bb9117b8e8f
Updated: 1790329294 (Unix time)

Review snapshot

Change surface Files Review signal Count
Production 1 Active findings 4
Tests 1 Noted findings 0
Documentation 1 Resolved findings 0
Configuration 0 Pending checks/questions 4

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

  • high · critique · Include squash-merged pull requests in release notes — `--merges` restricts the range to commits with multiple parents. A PR merged with GitHub's squash or rebase strategy produces a normal first-parent commit, often with a `(feat(installer): add one-command installer flow and release smoke checks #123)` su (scripts/release/generate\-release\-notes\.mjs:278)
  • medium · critique · Count the commits represented by each pull request — `commits` is incremented once per pull request, even though the field is exposed as a commit count and the previous implementation incremented it once per collected commit. A pull (scripts/release/generate\-release\-notes\.mjs:305)
  • medium · security · Include squash-merged pull requests in release notes — Using `--merges` excludes squash merges and rebase merges, whose resulting commits are ordinary single-parent commits even when their subjects contain a pull-request number. Those (scripts/release/generate\-release\-notes\.mjs:278)
  • medium · e2e · End-to-end job `Rust Feature-Gate Smoke (gates off)` will not run on this change — `Rust Feature-Gate Smoke (gates off)` in `.github/workflows/ci-lite.yml` will not run for this pull request: the forge reports it as skipped, so a job condition was false for this (\.github/workflows/ci\-lite\.yml)

Pending checks: Rust E2E (mock backend), Build Playwright E2E Artifact, E2E (Playwright / web lane), Desktop E2E (full suite, 3 OS)

Before merge

  • Address Include squash-merged pull requests in release notes (scripts/release/generate\-release\-notes\.mjs).
  • Wait for Rust E2E (mock backend), Build Playwright E2E Artifact, E2E (Playwright / web lane), Desktop E2E (full suite, 3 OS).

How this fits together

flowchart LR
  n0["assertRefExists<br/>changed<br/>3 findings"]:::blocking
  n1["collectPrCommits<br/>changed<br/>3 findings"]:::blocking
  n2["collectPullRequests<br/>changed<br/>3 findings"]:::blocking
  n3["fetchPullRequest<br/>changed<br/>3 findings"]:::blocking
  n4["main<br/>changed<br/>3 findings"]:::blocking
  n5["repo"]:::impacted
  n6["commits"]:::impacted
  n7["options"]:::impacted
  n8["from"]:::impacted
  n9["buildReleasePayload"]:::impacted
  n10["collectCommits"]:::impacted
  n1 -->|uses| n6
  n2 -->|uses| n5
  n2 -->|uses| n6
  n3 -->|uses| n5
  n4 -->|calls| n0
  n4 -->|uses| n5
  n4 -->|uses| n7
  n4 -->|uses| n8
  n5 -->|uses| n7
  n6 -->|uses| n8
  n6 -->|calls| n10
  n8 -->|uses| n5
  n8 -->|uses| n7
  n9 -->|uses| n5
  n9 -->|uses| n6
  n9 -->|uses| n8
  n10 -->|uses| n6
  n10 -->|uses| n8
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff
Loading
Agent review details

critique

  • Conclusion: Failure
  • Scope reviewed: all assigned evidence
  • Lane summary: Reviewed 3 files; 2 findings. _The code index is behind this pull request (indexed at `e76e6d6c9a1e`), so retrieved context may be out of date._ _5 memory call(s) failed (model: cortex: v1/recall: timed out after 10s), so this review saw part of what the engine holds._
  • Evidence: scripts/release/generate\-release\-notes\.mjs — Include squash-merged pull requests in release notes
  • Evidence: scripts/release/generate\-release\-notes\.mjs — Count the commits represented by each pull request

security

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: The change narrows release-note collection to first-parent merge commits and updates contributor attribution to PR authors. It looks safe to merge if the repository requires merge commits for PR integration, but it omits squash-merged and rebased PRs from release notes otherwise. 1 file was not security-reviewed: docs/RELEASE-MANUAL-SMOKE.md (prose or tabular data). (1 observation(s) grouped into shared inline comments) _The code index is behind this pull request (indexed at `e76e6d6c9a1e`), so retrieved context may be out of date._ _5 memory call(s) failed (model: cortex: v1/recall: timed out after 10s), so this review saw part of what the engine holds._
  • Evidence: scripts/release/generate\-release\-notes\.mjs — Include squash-merged pull requests in release notes

tests

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: Refactors release notes generation to collect only first-parent merge commits with PR numbers and derive contributor status from GitHub authorAssociation. Tests cover the new merge filtering, contributor stats logic, and regex for merge messages, but the new GraphQL query in `fetchPullRequest` and its error fallback path are not exercised, leaving a gap in regression coverage for the core fetch logic. Safe to merge with that caveat.` (1 finding discarded for not matching a changed line) _The code index is behind this pull request (indexed at `e76e6d6c9a1e`), so retrieved context may be out of date._ _5 memory call(s) failed (model: cortex: v1/recall: timed out after 10s), so this review saw part of what the engine holds._

commits

  • Conclusion: Neutral
  • Scope reviewed: all assigned evidence
  • Lane summary: Nothing sensitive found in what this pull request commits.

description

  • Conclusion: Success
  • Scope reviewed: all assigned evidence
  • Lane summary: The PR correctly changes release-note generation to include only first-parent PR merge commits, reducing the commit count and avoiding oversized OpenAI prompts. The tests cover the new behavior and edge cases. The code is consistent with the stated goals and introduces no obvious defects or security issues. _The code index is behind this pull request (indexed at `e76e6d6c9a1e`), so retrieved context may be out of date._ _5 memory call(s) failed (model: cortex: v1/recall: timed out after 10s), so this review saw part of what the engine holds._

e2e

  • Conclusion: Neutral
  • Scope reviewed: all assigned evidence
  • Lane summary: The behavioural changes to `generate-release-notes.mjs` (first-parent merge filtering, PR-author-based contributor detection, GraphQL API switch) are in a release-automation script that the application end-to-end harness does not exercise. The script is not part of the app, desktop, or Playwright test suites; it runs only in manually-dispatched or release-push CI workflows. The change is unobservable by the existing end-to-end tests and is covered by unit tests. No end-to-end coverage gap is introduced. Safe to merge.} Waiting on end-to-end jobs: `Rust E2E (mock backend)`, `Build Playwright E2E Artifact`, `E2E (Playwright / web lane)`, `Desktop E2E (full suite, 3 OS)`.
  • Unresolved questions/checks: Rust E2E (mock backend), Build Playwright E2E Artifact, E2E (Playwright / web lane), Desktop E2E (full suite, 3 OS)
  • Evidence: \.github/workflows/ci\-lite\.yml — End-to-end job `Rust Feature-Gate Smoke (gates off)` will not run on this change
Evidence and run details
  • Models: ladder/vectors, gpt-5.6-luna, deepseek/deepseek-v4-flash
  • Spend: $0.014581
  • Tokens: 282851 input · 28490 output · 41944 cached · 532 embedding
Head State Pass summary
1bb9117b8e8f changes requested 4 active finding(s), 0 resolved finding(s) (at 1790329294)

tinysweeper 0.1.0

@coderabbitai

coderabbitai Bot commented Sep 25, 2026

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f37fe409-d804-4cc5-b0b4-eafbd3c346ec

📥 Commits

Reviewing files that changed from the base of the PR and between 5f65671 and 1bb9117.

📒 Files selected for processing (3)
  • docs/RELEASE-MANUAL-SMOKE.md
  • scripts/__tests__/generate-release-notes.test.mjs
  • scripts/release/generate-release-notes.mjs
 __________________________________________________________________________________________________________________________________________
< Test early. Test often. Test automatically. Tests that run with every build are much more effective than test plans that sit on a shelf. >
 ------------------------------------------------------------------------------------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

Comment @coderabbitai help to get the list of available commands.

@senamakel
senamakel merged commit 52028bb into tinyhumansai:main Sep 25, 2026
31 of 37 checks passed

@tinysweeper tinysweeper Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requesting changes: 1 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0146 · 282,851 in / 28,490 out · 41,944 cached (15%) · ladder/vectors, gpt-5.6-luna, deepseek/deepseek-v4-flash · 532 embedded
critique:    $0.0058 · 155,191 in / 8,629 out  · 21,056 cached (14%) · gpt-5.6-luna, deepseek/deepseek-v4-flash
security:    $0.0020 · 72,862 in  / 2,397 out  · 3,736 cached (5%)   · gpt-5.6-luna
tests:       $0.0013 · 17,362 in  / 5,624 out  · 17,152 cached (99%) · deepseek/deepseek-v4-flash
description: $0.0021 · 9,352 in   / 6,754 out  · 0 cached (0%)       · deepseek/deepseek-v4-flash
e2e:         $0.0024 · 21,239 in  / 2,501 out  · 0 cached (0%)       · deepseek/deepseek-v4-flash

const format = '%H%x1f%s%x1f%an%x1f%ae%x1f%aI%x1e';
const commits = [];
await streamGitRecords(['log', `${from}..${to}`, '--reverse', `--format=${format}`], (entry) => {
await streamGitRecords(['log', `${from}..${to}`, '--first-parent', '--merges', '--reverse', `--format=${format}`], (entry) => {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

priority high critique confident

Include squash-merged pull requests in release notes

--merges restricts the range to commits with multiple parents. A PR merged with GitHub's squash or rebase strategy produces a normal first-parent commit, often with a (#123) subject, so it is omitted entirely from commits, never fetched by collectPullRequests, and never appears in the generated release notes or contributor credits. The new test also encodes this omission by treating a direct commit carrying a PR number as excluded. Remove the --merges restriction and explicitly filter only commits that represent PR merges if nested branch commits must remain excluded, or otherwise support the repository's squash/rebase merge modes.


Additional security observation

priority medium likely

Include squash-merged pull requests in release notes

[RULE] incomplete-release-history

Using --merges excludes squash merges and rebase merges, whose resulting commits are ordinary single-parent commits even when their subjects contain a pull-request number. Those PRs will no longer appear in collectCommits, so production release notes and contributor credits silently omit them. Preserve the PR-number parsing for all first-parent commits, or otherwise include the repository's non-merge PR integration styles.

[RULE] incomplete-commit-selection ·

isNew: false,
});
}
const contributor = contributors.get(key);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

priority medium critique confident

Count the commits represented by each pull request

commits is incremented once per pull request, even though the field is exposed as a commit count and the previous implementation incremented it once per collected commit. A pull request containing three commits will now contribute commits: 1 instead of commits: 3, making contributor credits inaccurate. Preserve the number of commits represented by each PR (or rename the field and all of its consumers if the intended metric is PR count).

[RULE] incorrect-count ·

@tinysweeper tinysweeper Bot added the priority: p1 Next. Wrong behaviour a user will hit, or a security weakness behind a condition. label Sep 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

priority: p1 Next. Wrong behaviour a user will hit, or a security weakness behind a condition.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant