Repository navigation
ci: a no-release label lets a change that keeps the binaries skip the version; review follow-ups - #39
Merged
Merged
Conversation
… version; review follow-ups - check-version.sh: with NO_RELEASE=true (the pull request's no-release label) a change to the code or the build may keep CERBERUS_VERSION, for changes that leave the binaries as they are (keyldev on #26). The CI job passes the label and runs again when labels change. - src/cerberus.c: the comment above CERBERUS_VERSION no longer says that release builds pass the tag in (keyldev on #37). - READMEs: older instructions that download S99cerberus get a 404, run cerberus init-script instead (keyldev on #23); a rollback is a revert plus a new version; the no-release label. This pull request carries the no-release label itself: the comment change leaves the binaries as they are. Tested: a src/ change without a new version fails without the label and passes with NO_RELEASE=true; shellcheck clean.
compot-dev
added
the
no-release
PR Summary by QodoAllow labeled non-release changes to skip the version bump
AI Description
Diagram
High-Level Assessment
Files changed (6)
|
Code Review by Qodo
1. Source changes can skip version history
|
![qodo-free-for-open-source-projects[bot]](https://avatars.githubusercontent.com/in/1068000?s=60&v=4){kind=small}
Comment on lines
+44
to
+49
| if [ -n "$changed" ] && [ "${NO_RELEASE:-}" = true ]; then | ||
| echo "::notice::code or build changed, CERBERUS_VERSION stays $old: the no-release" \ | ||
| "label says the binaries do not change" | ||
| echo "$changed" | ||
| exit 0 | ||
| fi |
There was a problem hiding this comment.
1. Source changes can skip version history 📘 Rule violation ⚙ Maintainability
check-version.sh lets NO_RELEASE=true bypass the version and changelog checks for changed source, build files, and installers without verifying that released files are unchanged. When a labeled pull request changes install.sh or uninstall.sh without bumping CERBERUS_VERSION, the release job sees the existing version and asset names and skips publishing the updated script.
Agent Prompt
## Issue description
A `no-release` label currently lets changed source, build, or installer files pass the version check without establishing that released files are unchanged. An installer fix can therefore pass without a version bump and remain unpublished because the existing release already has assets with the expected names.
## Fix Focus Areas
- .github/check-version.sh[41-54]
- .github/workflows/ci.yml[138-168]
## Recommended Fix
Require a version bump and changelog section for changes to `install.sh`, `uninstall.sh`, or release assembly that alter published assets. Limit any `no-release` exemption to changes that do not affect released files; for source or build changes, verify that produced binaries are byte-for-byte unchanged before allowing the exception, or explicitly document and govern the exemption in the compliance policy so a label alone cannot bypass version history requirements.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This was referenced Oct 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-ups from @keyldev's review:
no-releaselabel:.github/check-version.shlets a change to the code or the build through without a newCERBERUS_VERSIONwhen the pull request has theno-releaselabel (NO_RELEASE=true, passed by theversion bumpjob; the job runs again onlabeled/unlabeled). For changes that leave the binaries as they are — a build-script tidy-up like ci/build.sh: install the build packages only when the image lacks them #26, a comment — so they neither need a bump nor publish a release. The label is created in this repository.CERBERUS_VERSIONinsrc/cerberus.cno longer says that release builds pass the tag in; a rollback is "revert + bump", now in the READMEs.S99cerberus404: the manual-install section in all three READMEs says that older instructions that downloadS99cerberusget a 404 and should runcerberus init-scriptinstead.no-releaselabel in "CI and releases".This PR carries the
no-releaselabel itself: the onlysrc/change is a comment, the binaries stay the same, so no 0.3.2. #28 needed nothing more: theCLAUDE.mdonmasteralready has your points. The first real Telegram post comes with 0.3.2 (#38); I will check the channel then.Tested in
compot/crosson a scratch clone: asrc/change without a new version fails without the label and passes withNO_RELEASE=true(notice listing the files);NO_RELEASE=falsefails. shellcheck v0.10.0 clean.