test(release): make workflow contract role-aware

[EffortlessSteven]

What this does

The release workflow contract test previously required the swarm-only source handoff text in every repository. That made the promoted test reject the source-owned release writer even when the source workflow preserved the intended draft-release boundary.

Change: release_candidate_smoke reads policy/automation-authority.toml and applies the shared candidate identity checks plus the role-specific contract. Swarm requires handoff-only, read-only behavior. Source requires Release Candidate Ready before the narrow draft writer, exact staged bytes, and explicit human publication authority. Existing candidate smoke behavior is unchanged.

Verification

Check	Result
role-aware release contract test	1 passed
cargo clippy -p shiplog --all-targets --locked -- -D warnings	clean
cargo fmt --all -- --check, git diff --check	clean
cargo xtask ci-small	not verified locally: workspace test step exceeded the five-minute bound; hosted required gate will provide exact-head proof

Review map

• apps/shiplog/tests/release_candidate_smoke.rs: parses repository role, enforces common staged-candidate invariants, and separates swarm handoff assertions from source draft-writer assertions.

[factory-droid]

Droid encountered an error —— View job

Failed to checkout PR #396 branch for review

---

Droid is reviewing code and running a security check…

[coderabbitai]

Warning

Review limit reached

@EffortlessSteven, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 53 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3dc7e1ab-8bd1-454c-a28b-031f28265c9d

📥 Commits

Reviewing files that changed from the base of the PR and between 5c83c95 and b54023a.

📒 Files selected for processing (1)

• apps/shiplog/tests/release_candidate_smoke.rs

Summary by CodeRabbit

• Tests
  • Expanded release candidate validation to cover different repository authority roles and their required permissions.
  • Added checks for handoff messaging, release configuration, staged metadata, and all supported platform targets.
  • Strengthened verification of immutable artifact downloads and rejection of unauthorized release sources.
  • Improved confidence that release workflows follow the correct approval and artifact integrity requirements.

Walkthrough

The release candidate smoke test now reads the repository role from policy and validates role-specific release workflow controls. It checks staged candidate metadata, all four targets, immutable artifact downloads, and publication permissions.

Changes

Release candidate workflow validation

Layer / File(s)	Summary
Repository role policy resolution apps/shiplog/tests/release_candidate_smoke.rs	The test reads and parses policy/automation-authority.toml, reports contextual errors, and obtains repository_role before workflow validation.
Role-specific release assertions apps/shiplog/tests/release_candidate_smoke.rs	The test validates staged candidate metadata, four release targets, immutable artifact downloads, prohibited release URL downloads, and swarm versus source permission rules.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• fix(release): make tag-triggered publication fail closed on the approved source and reversible gates shipper-swarm#256 — Both changes validate release authority and fail-closed publication controls.

Possibly related PRs

• EffortlessMetrics/shiplog-swarm#391 — This change extends the release-candidate smoke tests introduced by that PR.

Suggested labels: full-ci

Poem

A rabbit checks the release trail,
With policy parsed and paths set well.
Four targets wait, checksums shine,
Immutable artifacts hold the line.
Roles guard each publication gate.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the implementation and verification, but it omits most required template sections, including scope, non-goals, policy impact, claim boundary, and rollback.	Add the missing template sections and include the required scope, non-goals, policy impact, claim boundary, rollback, links, and proof details.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the release workflow contract test as the main change and states that it now supports repository roles.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/role-aware-release-contract

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/shiplog/tests/release_candidate_smoke.rs`:
- Around line 514-550: The repository-role validation in
release_workflow_binds_tag_push_identity_and_staged_contract currently branches
imperatively over swarm, source, and unsupported roles. Replace these checks
with three separate shiplog_testkit::bdd::Scenario::new(...).expect(...)
scenarios, each using the appropriate policy/workflow fixture and preserving the
existing assertions for its role, including rejection of unsupported roles.
- Around line 485-502: Strengthen the workflow assertions in the release smoke
test around the existing candidate-control checks and release-writer validation:
parse or otherwise inspect individual jobs so the release-writing job itself
requires release-candidate-ready, grants contents: write, uses
softprops/action-gh-release, and reads candidate/RELEASE_CANDIDATE.txt,
candidate/SHA256SUMS.txt, and checksum_manifest_sha256 from the staged candidate
artifact. Add negative fixtures covering split jobs and a writer without the
gate, asserting those workflows fail rather than relying on file-wide string
matches.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8dfa213c-66b3-43b8-897e-9d7dd7b5054b

📥 Commits

Reviewing files that changed from the base of the PR and between 0b9a8f7 and 5c83c95.

📒 Files selected for processing (1)

• apps/shiplog/tests/release_candidate_smoke.rs

[factory-droid]

Droid encountered an error —— View job

Failed to checkout PR #396 branch for review

---

Droid is reviewing code and running a security check…