Repository navigation
chore: finalize 8.0.1 notes and repair CodeQL validation - #464
Conversation
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR prepares json2xml 8.0.1 by dating and expanding the release documentation, distinguishing previously recorded validation from checks still pending, and fixing the CodeQL workflow version mismatch by aligning analysis with the 4.38.3 init/autobuild action commit. Reviewers should verify the release-note claims and ensure final hosted checks, builds, package metadata/Twine validation, and dependency/security checks pass on the exact release commit before publication. Flow diagram for final release validation gateflowchart TD
Commit[Final release commit] --> Hosted[Hosted checks]
Commit --> Packages[Build packages]
Packages --> Twine[Twine metadata validation]
Commit --> Dependencies[Dependency and security checks]
Hosted --> Gate{All required checks pass?}
Twine --> Gate
Dependencies --> Gate
Gate -->|Yes| Publish[Publish 8.0.1]
Gate -->|No| Block[Keep publication blocked]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #464 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 7 7
Lines 1032 1032
=========================================
Hits 1032 1032
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="RELEASE_NOTES.md" line_range="39" />
<code_context>
+In the saved release environment, `uv lock --check` passed. `make check-all` could not install its locked dependencies because package downloads were blocked; Cargo and `lat` were unavailable. No new passing local tests, Rust tests, build, Twine, or architecture checks are claimed. Publication must remain blocked until the required final checks and package verification are completed.
</code_context>
<issue_to_address>
**Current audit status is omitted**
When the release environment's `uv audit` cannot reach OSV, the saved-environment summary records the lock check and blocked `make check-all` but omits that `uv audit` could not reach OSV, so readers cannot tell the release dependency audit still lacks a current result.
State explicitly that the current `uv audit` could not reach OSV and remains pending successful verification.
</issue_to_address>| The 8.0.1 release preparation also passed local Ruff, ty, 509 tests with 149 optional Rust tests skipped, 100% statement coverage, lockfile validation, the dependency audit, and architecture documentation checks. Both built distributions passed Twine metadata checks and declare version 8.0.1, Python >=3.11, and urllib3>=2.8.0. The release commit's hosted CI must pass before publication; record those results and the publication date before publishing. | ||
| Previously recorded PR #457 preparation validation (not verification of the final release commit) passed local Ruff, ty, 509 tests with 149 optional Rust tests skipped, 100% statement coverage, lockfile validation, the dependency audit, and architecture documentation checks. Both built distributions passed Twine metadata checks and declare version 8.0.1, Python >=3.11, and urllib3>=2.8.0. Final release validation remains pending. On 2026-10-16, remote master `a8f5d5ed0fa802f47a25583f7538243c51bcb5bd` passed hosted Python tests and lint, but CodeQL failed because its analysis action used 4.38.2 with configuration generated by 4.38.3. This preparation aligns all CodeQL actions to 4.38.3; hosted checks must pass on the exact final commit before publication. | ||
|
|
||
| In the saved release environment, `uv lock --check` passed. `make check-all` could not install its locked dependencies because package downloads were blocked; Cargo and `lat` were unavailable. No new passing local tests, Rust tests, build, Twine, or architecture checks are claimed. Publication must remain blocked until the required final checks and package verification are completed. |
There was a problem hiding this comment.
🟡 Medium · Current audit status is omitted
When the release environment's uv audit cannot reach OSV, the saved-environment summary records the lock check and blocked make check-all but omits that uv audit could not reach OSV, so readers cannot tell the release dependency audit still lacks a current result.
State explicitly that the current uv audit could not reach OSV and remains pending successful verification.
Prompt for AI agents
In `RELEASE_NOTES.md` at line 39:
**Current audit status is omitted**
When the release environment's `uv audit` cannot reach OSV, the saved-environment summary records the lock check and blocked `make check-all` but omits that `uv audit` could not reach OSV, so readers cannot tell the release dependency audit still lacks a current result.
State explicitly that the current `uv audit` could not reach OSV and remains pending successful verification.![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: feb67fcce9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # json2xml 8.0.1 | ||
|
|
||
| Unreleased — publication date will be recorded when the release is scheduled. | ||
| Release date: 2026-10-16. Publication is pending final validation. |
There was a problem hiding this comment.
This records a release date even though RELEASE_NOTES.md:37-39 says validation is still pending and publication must remain blocked. The deployment checklist in CONTRIBUTING.rst:191-201 requires replacing the unreleased markers only when publishing the verified commit; if validation fails or publication slips past October 16, both this line and the matching HISTORY.rst entry will falsely describe an unpublished release as dated. Leave both markers unreleased until the final checks pass and the GitHub release is ready to publish.
Useful? React with 👍 / 👎.
1 participant
Prepare json2xml 8.0.1 for the approved release: date the changelog for 2026-10-16, include merged changes since v8.0.0, and distinguish historical validation from pending final validation.
Master CodeQL run 38854413609 failed with
Loaded a configuration file for version '4.38.3', but running version '4.38.2'. Align analyze with the existing init/autobuild 4.38.3 commit.Validation: git diff --check and uv lock --check passed. Local Python checks could not install locked dependencies (network proxy 403); uv audit could not reach OSV; Cargo and lat are unavailable. Builds, Twine, and final hosted CI remain pending. Do not publish until required final validation passes. GitHub release and tag v8.0.1 did not exist at the preflight check.
Summary by Sourcery
Finalize json2xml 8.0.1 release documentation and fix CodeQL action version alignment before publication.
Bug Fixes:
Enhancements:
CI:
Documentation: