Add coverage-gated well permit to production flow - #89
Conversation
|
Warning Review limit reached
Next review available in: 45 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThe SDK adds normalized synchronous and asynchronous well-permit searches. The release workflows now verify artifacts before publishing, validate PyPI readback, attach release assets, pin actions, restrict sensitive jobs, and enforce checkout security. ChangesRelease and API updates
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant VerifyJob
participant ArtifactStore
participant PublishJob
participant PyPI
participant ReadbackJob
participant GitHubRelease
VerifyJob->>ArtifactStore: Upload verified distributions and checksums
PublishJob->>ArtifactStore: Download and validate checksums
PublishJob->>PyPI: Publish verified distributions
ReadbackJob->>PyPI: Compare public distribution hashes
ReadbackJob->>GitHubRelease: Upload verified snippet manifest and checksum file
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
.github/workflows/publish.yml (2)
40-48: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winExtract the duplicated version-reading script.
Lines 40-48 and 96-104 embed the same inline Python program that parses
versionfrompyproject.toml. Two copies can drift. The repository already keeps helper scripts underscripts/. Move this logic into one script and call it from both steps.Also applies to: 96-104
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish.yml around lines 40 - 48, Extract the duplicated inline Python version parser from the workflow steps assigning PACKAGE_VERSION into a single helper script under scripts/. Update both version-reading steps around PACKAGE_VERSION to invoke that shared script, preserving the existing pyproject.toml parsing and missing-version failure behavior.
174-200: 🩺 Stability & Availability | 🔵 TrivialConsider a longer readback budget.
The loop runs 12 attempts with a 5-second sleep. The minimum total wait is about 60 seconds. PyPI JSON API propagation can take longer than that after an upload. If propagation is slow, this job fails after a successful publish, and the
release_assetsjob never runs even though the release is valid.Increase the attempt count or use an increasing backoff so that a slow index does not block asset attachment.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish.yml around lines 174 - 200, Extend the PyPI readback window in the verification loop around the attempt counter and sleep so propagation can exceed the current roughly 60-second budget. Increase the retry count or implement an increasing backoff while preserving the existing hash validation and successful exit once all distributions are visible.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 138-146: Update the “Verify exact artifact checksums” workflow
step to compare the number of files in dist/ with the number of entries in
artifact.sha256 before publishing. Fail the step when the counts differ, while
preserving the existing sha256sum -c validation and publish configuration.
In `@README.md`:
- Around line 152-155: Validate that the result assigned to summary from
client.well_production.summary() is a dictionary before calling
summary.get("coverage"). If validation fails, raise RuntimeError with the
existing MALFORMED_RESPONSE convention; retain the coverage validation and
subsequent behavior for valid dictionary responses.
In `@tests/test_release_readiness.py`:
- Around line 127-135: Update the WORKFLOWS discovery and its consumers,
including test_every_workflow_pins_actions_and_hardens_each_checkout_step, to
include both *.yml and *.yaml workflow files. Preserve the existing pinning and
checkout-hardening assertions for every discovered workflow.
---
Nitpick comments:
In @.github/workflows/publish.yml:
- Around line 40-48: Extract the duplicated inline Python version parser from
the workflow steps assigning PACKAGE_VERSION into a single helper script under
scripts/. Update both version-reading steps around PACKAGE_VERSION to invoke
that shared script, preserving the existing pyproject.toml parsing and
missing-version failure behavior.
- Around line 174-200: Extend the PyPI readback window in the verification loop
around the attempt counter and sleep so propagation can exceed the current
roughly 60-second budget. Increase the retry count or implement an increasing
backoff while preserving the existing hash validation and successful exit once
all distributions are visible.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 03d23721-b52e-4d3a-a9a6-b766efaba8a4
📒 Files selected for processing (13)
.github/workflows/github-pages.yml.github/workflows/live-tests.yml.github/workflows/publish.yml.github/workflows/test.yml.github/workflows/weekly-health.ymlCHANGELOG.mdREADME.mdoilpriceapi/async_resources.pyoilpriceapi/resources/ei/well_permits.pyoilpriceapi/version.pypyproject.tomltests/test_release_readiness.pytests/unit/test_ei_well_permits_resource.py
1 participant
Summary
Red / green
{data:{well_permits,meta}}fixtures returned the wrong shape; unknown success shapes silently passed; Unicode API digits passed the README guard; a Python 3.8-incompatible test annotation and unpinned workflow actions were detected before publication.Release safety
Publish only after this exact head is merged through protected main and its default-branch keyed synthetics pass. The release workflow accepts only a tag reachable from protected main, passes only a checksummed artifact to the OIDC publisher, verifies exact public PyPI hashes, and attaches the checked snippet manifest after public readback.
Summary by CodeRabbit