fix(controlplane): restore PR-mode promotion suppression and auto-repair newest pre-release version#3294
Draft
migmartri wants to merge 1 commit into
Draft
fix(controlplane): restore PR-mode promotion suppression and auto-repair newest pre-release version#3294migmartri wants to merge 1 commit into
migmartri wants to merge 1 commit into
Conversation
…air newest pre-release version PR chainloop-dev#3289 removed PR mode's incomplete suppression of latest-version promotion. Restore that suppression in the CLI action (the PR chainloop-dev#3268 rule): when isPR is true, default --mark-latest to false unless the user explicitly passed --mark-latest=true. This preserves the three observable states — omitted becomes false in PR mode, explicit false stays false, explicit true remains the user override. Complete the behavior in the control plane: a later non-PR attestation against an existing pre-release version now repairs latest when that version is the newest active version by immutable created_at and is not already latest. PR runs and explicit --mark-latest=false opt-outs are not promoted. Released versions are never auto-promoted; only explicit true attempts promotion and is rejected for released versions. The nil/true/false contract is now described in the AttestationServiceInitRequest.mark_as_latest proto comment and regenerated artifacts. Added integration coverage for the repair lifecycle (v1 latest → PR-sim v2 not latest → non-PR v2 repaired to latest) and boundaries: older version not promoted over newer, explicit false suppression wins over automatic repair, and newest released version not auto-promoted. Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
migmartri
force-pushed
the
dw/17672-1784231293
branch
from
July 17, 2026 00:30
c5a1b96 to
5ebbe53
Compare
migmartri
marked this pull request as draft
July 17, 2026 00:32
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 11 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="app/cli/pkg/action/attestation_init.go">
<violation number="1" location="app/cli/pkg/action/attestation_init.go:203">
P3: The PR-mode suppression branch is not exercised through `AttestationInit.Run`; the current helper test could pass while the request still sends the wrong pointer after a future refactor. A focused action/fake-client test covering omitted, explicit false, and explicit true inputs would lock down the three-state behavior.
(Based on your team's feedback about tests for new paths.) [FEEDBACK_USED]</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| if err != nil { | ||
| action.Logger.Warn().Err(err).Msg("failed to detect PR context") | ||
| } | ||
| if isPR && !explicitMarkAsLatestTrue(opts.MarkAsLatest) { |
There was a problem hiding this comment.
P3: The PR-mode suppression branch is not exercised through AttestationInit.Run; the current helper test could pass while the request still sends the wrong pointer after a future refactor. A focused action/fake-client test covering omitted, explicit false, and explicit true inputs would lock down the three-state behavior.
(Based on your team's feedback about tests for new paths.)
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At app/cli/pkg/action/attestation_init.go, line 203:
<comment>The PR-mode suppression branch is not exercised through `AttestationInit.Run`; the current helper test could pass while the request still sends the wrong pointer after a future refactor. A focused action/fake-client test covering omitted, explicit false, and explicit true inputs would lock down the three-state behavior.
(Based on your team's feedback about tests for new paths.) </comment>
<file context>
@@ -194,13 +194,16 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
if err != nil {
action.Logger.Warn().Err(err).Msg("failed to detect PR context")
}
+ if isPR && !explicitMarkAsLatestTrue(opts.MarkAsLatest) {
+ falseVal := false
+ opts.MarkAsLatest = &falseVal
</file context>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR #3289 removed PR mode's incomplete suppression of latest-version promotion. This PR restores that suppression and completes the behavior in the control plane.
refs #3265
Changes
CLI — restore the PR-mode promotion default
app/cli/pkg/action/attestation_init.go: whenisPRis true, setopts.MarkAsLatestto&falseunless the user explicitly passed--mark-latest=true(via the restoredexplicitMarkAsLatestTruehelper).--mark-latestbecomes false in PR mode, explicit--mark-latest=falseremains false, explicit--mark-latest=trueremains the user override. Non-PR mode leaves the pointer untouched so omitted promotion intent reaches the server asnil.--prhelp literal andTestExplicitMarkAsLatestTrue(nil/false/true cases).Control plane — auto-promote only the newest existing version when intent is omitted
WorkflowRunRepo.Createto always re-read the targetProjectVersionwithForUpdateinside the transaction.truepromotes (released versions rejected);false(PR sentinel / explicit opt-out) makes no change.nilpath: if the fresh version is active, pre-release, and not already latest, query for any other active version withcreated_atstrictly greater than the target's immutableCreatedAt. If none exists, callpromoteVersionToLatestWithTx. A timestamp tie is not "strictly newer", matching the historicalORDER BY project_id, created_at DESCmigration.UseLatestVersionand new-version creation are unchanged.API contract
mark_as_latestproto comment to describe the completed nil/true/false semantics; regenerated Go, TypeScript, JSON Schema, and CLI reference artifacts viamake generate.Tests
v1latest → PR-simv2not latest → non-PRv2repaired to latest withv1demoted); older version not promoted over newer; explicit-false suppression wins over automatic repair on a newer version; newest released version not auto-promoted.Verification
go test ./app/cli/pkg/action -run 'Test(ExplicitMarkAsLatestTrue|ResolvePRMode)$'— PASSgo test ./app/controlplane/pkg/biz -run 'TestWorkflowRunUseCase/TestCreate'— PASS (all 29 subtests)go test ./app/cli/pkg/action/ ./app/controlplane/pkg/data/ ./app/controlplane/pkg/biz/— PASSmake generate— generated artifacts consistent, no hand-authored schema changesgofmt,go vet,buf lint— clean🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri