[chandrasekharan-zipstack]

Why

Two changes, merged here from a stacked PR:

1. CI. A PR that only touches .github/ or .claude/ (release workflows, release tooling, skills) ran the full unit, integration and e2e suites, although none of that code is in them. The release tooling tests ran in their own workflow, release-tooling-tests.yaml, which is not a required check, so a failing release test did not block a merge.
2. Release tooling. This is the OSS half of the enterprise release-tooling change. .github/release is shared with the enterprise repo and must stay byte-identical there. The enterprise change adds a way to put a plain fix onto a released (stabilized) line, keeps a line stabilized when a target is added after its first GA, simplifies the release forms, and makes the release runs fail loudly instead of skipping a fix silently.

What

CI (ci-test.yaml)

• The changes filters (relevant and e2e_relevant) also ignore .github/** and .claude/**.
• A new ci_self filter keeps the suites running when ci-test.yaml itself changes, so a broken test workflow is still caught.
• The release tooling tests move into ci-test.yaml as a release-tests job, gated by a release filter with the same paths release-tooling-tests.yaml triggered on. That filter has its own paths-filter step with predicate-quantifier: some. report now also fails when release-tests fails, so the existing required check covers the release tooling. release-tooling-tests.yaml is deleted.
• release-tests also runs on draft PRs; report gates on it once the PR is ready.
• Skipped jobs report skipped, which passes required checks.

Patch a released line

• Backport with confirm_stabilized puts a plain fix on the stabilized lines named in lines. Without confirm_stabilized, or with confirm_stabilized and no lines, the fix gets a failed row and the run goes red. The owed-picks summary points to that dispatch.
• state.yaml has a new "Patch a released line" step: per stabilized line, the fixes it lacks since its cut. A failed lookup on one line is reported, not fatal.
• relstate treats a late target with no GA as stabilized, and the OSS line keeps stabilized/X.Y when a late target is added.

Backport reliability

• Every gh call, including the convergence gate's PR lookups, tries up to five times on a transient GitHub failure (5xx, a reply cut short, a dropped connection, a timeout), with exponential backoff and jitter. A rate limit (403 or 429) waits at least a minute between tries; any other 4xx is never retried. A failed squash or PR create checks whether it landed before retrying.
• A pick head older than the pick job's 30-minute timeout that holds a pick and has no PR, open or closed, is deleted, so the next run picks the commit again. If the delete fails, the row says to delete the head and rerun. A create that still fails after its retries keeps its head, because GitHub may have opened a PR the listing does not show yet; the record job never takes a close by the release App as a decline.
• When GitHub cannot map a squash merge to its PR, Backport takes the trailing (#N) from the commit subject. It accepts that PR only if it is merged with that exact merge commit.

Fail loudly

• An unclassifiable commit fails a rescan, and a dispatched commit with no PR is a failed row, not "not a fix".
• Backport ends red, with ::error:: and a "Left undone" list, when an owed fix is not picked, declined, held for the release manager, on a pick PR, or answered by a failed row of the same run. A fix the run did not touch is marked "owed before this run, not caused by it". A fix the run did not touch that merged less than 2 hours ago is left to its own push's run. The remaining warnings say why they are safe.
• state.yaml has a new "Missed picks on stabilizing lines" step: per stabilizing line, the owed fixes it lacks and the open conflict PRs on it in both repos.
• state.yaml also runs daily (03:30 UTC). Its "Check picks and conflict PRs" step fails on an owed fix on a stabilizing line merged more than 2 hours ago and not picked, on any unclassifiable commit, and on a backport conflict PR open more than 24 hours in either repo. A held security or critical fix is listed, not failed. This repo gets no Slack alert: it has no release alert webhook.
• oss.py rc, which the enterprise Take RC build runs for the OSS line, blocks on MISSING picks unless given --force and --reason; --notes records the override in the RC notes. A gate that did not run fails even when forced.

Forms and summaries

• backport.yaml: input branches is renamed to lines and accepts 0.186 or release/0.186 (backport.py --lines). Descriptions are shorter.
• New relmgr.line and relmgr.vtag input helpers; line refuses padded values.
• Release run summaries link commits, lines, tags, PRs and runs; paste lists and gh commands stay plain. The summary tests pin GITHUB_SERVER_URL and the repo slug, so they assert the linked form whatever the runner sets.

Notes

• ci-test.yaml runs only for PRs into main. The old workflow also ran for PRs into release branches. Release workflows run only from main, so a change to them on a release branch has no effect.
• Workflow tests that need the enterprise workflows (Take RC build, Promote, Cut) skip here and run in the enterprise repo.

Testing

• release-tests runs on this PR, because it changes ci-test.yaml and .github/release. Actionlint (pre-commit) passes. The suite skip shows on the next PR that touches only .github/ or .claude/.

• All six suites in .github/release pass locally: python3 test_*.py, one file at a time, both with GITHUB_SERVER_URL and GITHUB_REPOSITORY unset and set as on a runner.

• Mutation checks, each mutant run against the full suite in the enterprise repo:

  Change	Mutants killed
  Patch dispatch	14/14
  Owed-picks text	3/3
  Prerelease targets	2/2
  Input normalisation and wiring	23/23
  Strict line input, retire refusal, stabilized-line row, State failure guard	10/10
  Patch list bounded by the cut, Backport Pick step flags and inputs	9/9
  Backport retry and cleanup	17/17
  Missed picks on stabilizing lines	11/11
  Summary links	34/34
  PR-lookup fallback and fail-loud classing	16/16
  Fail-loud end check and daily State check (backport.py; the enterprise PR also counts 20/20 on its workflows)	34/34
  Take RC blocks and "owed before this run" wording	26/26
  Orphan pick head delete	3/3
  Review fixes: record refusing an App close, end-check grace, Take RC exit-code precedence, convgate exit codes	10/10
  gh retry backoff, rate limits and gate lookups	13/13
  Take RC notes on the RC prerelease (spot check, python3 test_oss.py -k TakeRcNotes)	5/5

Rollout

• Merge together with the paired enterprise PR, Zipstack/unstract-cloud#1952, because .github/release must stay byte-identical.
• The daily State run starts on merge.
• Breaking for saved commands: backport.yaml -f branches=... no longer works. Use -f lines=0.186,0.188.

🤖 Generated with Claude Code

[greptile-apps]

via Greptile

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no new actionable issues were found.

Summary

The PR adds released-line patching, retries GitHub failures, checks for missed picks daily, and puts release tests behind the required CI report.

• CI runs the relevant test suites and reports release-tooling failures through its required check.
• Backport runs can patch named stabilized lines and report fixes they leave unresolved.
• Release checks show owed fixes and stop RCs when required picks are missing.

_{Reviews (12) · Last reviewed commit: "fix: time a GA by its Promote tag when i..." · Reviewed by Greptile}

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

[ritwik-g]

Requesting changes for one High (inline). Reviewed at 105470d with the standardized review; I re-checked the delta to 8b1c5fa (gh retry/backoff), and it still applies. .github/release is byte-identical to Zipstack/unstract-cloud#1952, so the same findings are on that PR (review there: https://github.com/Zipstack/unstract-cloud/pull/1952#pullrequestreview-5780251126). Fix once and sync.

Medium (no inline): ci-test.yaml:29-32: the header still says e2e_relevant "skips only docs", but it now also skips .github/** and .claude/**. L43 "Force both true off-PR" now governs three outputs.

CI skip checked: report still runs and accepts skipped. A PR mixing product code and .github/ still runs the product tests, and ci_self catches edits to ci-test.yaml. The release-branch required checks (check, lint-pr) are unaffected. Release suites no longer run on PRs into release/**, which the PR notes already acknowledge.

Security surface read: no shell path for dispatch inputs (env plus argv lists). The fork-PR record job requires a same-repo head and checks out main. The (#N) fallback can't yield a wrong pick.

[chandrasekharan-zipstack]

Thanks. The High and the inline Medium are answered in their threads; the fixes are synced from Zipstack/unstract-cloud#1952 and .github/release is still byte-identical. The ci-test.yaml header Medium is fixed in 87123d5: the comment now lists .github/** and .claude/** among the e2e_relevant skips, names the release scope, and says "Force each true off-PR".

[ritwik-g]

Re-reviewed at 78d297e. Same fixes as unstract-cloud#1952 (.github/release byte-identical), and the ci-test.yaml header now names every skipped path. Merge together with #1952.

[sonarqubecloud]

Quality Gate passed

Issues
29 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Unstract test results

Per-group results

Status	Group	Tier	Passed	Failed	Errors	Skipped	Duration (s)
⚪	e2e-agent-kv	e2e	0	0	0	1	0.1
✅	e2e-api-deployment	e2e	3	0	0	0	14.0
✅	e2e-coowners	e2e	1	0	0	0	1.3
✅	e2e-etl	e2e	1	0	0	0	16.2
✅	e2e-login	e2e	2	0	0	0	1.0
✅	e2e-prompt-studio	e2e	1	0	0	0	9.4
✅	e2e-smoke	e2e	2	0	0	0	0.9
✅	e2e-workflow	e2e	1	0	0	0	15.8
✅	frontend	unit	664	0	0	0	15.7
✅	frontend-v1-unit	unit	284	0	0	0	5.4
✅	integration-backend	integration	1557	0	0	26	87.2
✅	integration-connectors	integration	1	0	0	7	9.6
✅	integration-workers	integration	181	0	0	1	57.1
❌	ui	e2e	0	1	0	0	0.0
✅	unit-agent-kv-schema	unit	143	0	0	0	1.3
✅	unit-backend	unit	2159	0	0	1	48.2
✅	unit-connectors	unit	82	0	0	0	8.6
✅	unit-core	unit	281	0	0	0	2.5
✅	unit-filesystem	unit	1	0	0	0	3.6
✅	unit-platform-service	unit	22	0	0	0	2.1
✅	unit-rig	unit	139	0	0	0	4.1
✅	unit-runner	unit	12	0	0	0	2.2
✅	unit-sdk1	unit	1356	0	0	0	35.6
✅	unit-tool-sidecar	unit	8	0	0	0	1.4
✅	unit-workers	unit	1668	0	0	2	114.0
	TOTAL		8569	1	0	38	457.3

Critical paths

⚠️ Critical paths not yet covered

• workflow-execution-fan-out — Multi-file workflow execution fans out to file-processing workers and rejoins. (declared coverage: no groups declared)

✅ Covered critical paths

• auth-login — covered by e2e-login
• adapter-register-llm — covered by integration-backend
• workflow-author — covered by integration-backend
• co-owner-manage — covered by integration-backend, e2e-coowners
• workflow-create-execute — covered by e2e-workflow
• api-deployment-provision — covered by integration-backend
• api-deployment-auth — covered by integration-backend
• api-deployment-run — covered by e2e-api-deployment
• mcp-server-auth — covered by integration-backend
• mcp-platform-auth — covered by integration-backend
• platform-key-whoami — covered by integration-backend
• prompt-studio-author — covered by integration-backend
• prompt-studio-fetch-response — covered by e2e-prompt-studio
• connector-register-test — covered by integration-backend
• pipeline-etl-execute — covered by e2e-etl
• usage-aggregate-read — covered by integration-backend
• usage-token-tracking — covered by e2e-api-deployment
• callback-result-delivery — covered by e2e-api-deployment