Record exact versions for bundled deploy packages#280
Conversation
|
Warning Review limit reached
Next review available in: 46 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (18)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request implements workforce #279, which records and surfaces the exact versions of packages bundled into agent.bundle.mjs. The bundleStager now utilizes esbuild's metafile to derive a deterministic, path-free bundleManifest in the generated package.json. This manifest is also read by the runner and emitted during startup in the structured runner.started log. Comprehensive tests have been added to verify correct manifest generation, symlink resolution, duplicate package handling, and preservation across cloud and sandbox environments. No review comments were provided, so there is no additional feedback to address.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
…e-versions # Conflicts: # packages/deploy/src/bundle.test.ts # packages/runtime/CHANGELOG.md
1 participant
Closes #279.
Summary
Iteration 4 repair
WF279-CODEX-INDEPENDENT-001in72984a4b3e1df7e8947dfc278f24b069d219dfc6main:6f6e764f9efb2ff1199b407a87069387202736casafe-dep@1.2.3contributed dependency bytesworkspace:*, invalid name, nested workspaces, and a supported entry outside the consumer packagegit diff --checkpassedThe earlier fail-closed security repair is preserved: contributing metadata-less/malformed workspace symlink targets still reject at their canonical dependency root and cannot climb into the consumer or an unrelated ancestor. Unsafe name/version matrices, tree-shaken controls, duplicate versions, cloud/sandbox transport, and exact
runner.startedmanifest parity remain green.Exact red/green commands and evidence are recorded in
.workflow-artifacts/release-propagation-279/iteration-4/fix-report.md.This PR remains draft. No publish, deploy, release, or production mutation was performed.