[#358] 🤖 - Develop

[efraespada]

📌 Summary

Introduces configurable, production-first release and hotfix orchestration with durable state, managed promotion PRs, event-driven continuation, publication verification, and development reconciliation.

---

🎯 Related Issues / Tickets

• Closes [#358] 🤖 - Develop #358

---

🧩 Scope of Changes

• Added:
  • Durable deployment state machine, recovery snapshots, continuation workflows, and managed PR markers.
  • Configurable reconciliation, merge, cleanup, presentation, and issue-completion policies.
  • Production-lineage and canonical-Gitflow reconciliation strategies.
  • Configuration validation, setup support, documentation, specifications, and traceability.
  • Validation for operation identity, branches, SHAs, PR markers, and repository ownership.
• Updated:
  • Release and hotfix workflows to separate preparation, promotion, publication, and reconciliation.
  • Action routing, configuration persistence, GitHub adapters, setup templates, workflow validators, and generated bundles.
  • Merge-group support, npm publication verification, and dependency versions.
• Removed:
  • Legacy deployed_action post-deployment flow.
  • Runner-blocking deployment merge waits and the merge-timeout input.
  • Deprecated ai-pull-request-description input.
• Refactored:
  • Deployment orchestration into domain policies, application ports/use cases, and infrastructure adapters.

---

🛠️ Technical Details

• Releases use a frozen development-branch SHA and are promoted through a managed production PR.
• Tags are created only at the accepted production commit; npm publication verifies immutable tag and gitHead identity.
• PR completion triggers a separate continuation workflow instead of keeping the preparation runner active.
• Durable schema-v3 snapshots support retries, duplicate events, blocked states, immutable tag reuse, and partial-failure recovery.
• Configuration is bounded, validated before mutation, persisted with the operation, and documented.
• Strict targets can use deterministic sync branches to preserve target-only commits and avoid shared-SHA check ambiguity.
• Continuation validates the operation marker, repository, issue, branch pair, stored SHA, and production reachability.
• Generated workflows use trusted base-branch checkouts, scoped permissions, npm trusted publishing, and exclude secrets and OIDC claims from durable state.

---

🔍 How to Test

1. Install dependencies with corepack pnpm@​10.12.4 install.
2. Run corepack pnpm@​10.12.4 run typecheck, lint, and test:coverage.
3. Run the workflow, documentation, build, package, and generated-artifact validation commands listed in docs/development/testing.mdx.
4. Exercise release and hotfix preparation, managed promotion PR completion, publication continuation, reconciliation, retry, blocked, duplicate-event, and manual-mode paths using the added tests and workflow contract validators.

---

🧪 Test Coverage

• Unit tests
• Integration tests
• End-to-end (E2E) tests
• Manual testing only

Coverage includes deployment policies, state transitions, configuration validation, orchestration use cases, GitHub deployment repositories, managed PR markers, security guards, workflow contracts, and architecture boundaries.

---

📸 Screenshots / Recordings (UI changes only)

Not applicable; user-facing changes are limited to GitHub issues, pull requests, workflow summaries, and comments.

---

⚠️ Breaking Changes

• The legacy deployed_action and label-driven post-deployment merge flow have been removed. Consumers must use the durable deployment callback actions.
• The merge-timeout and ai-pull-request-description inputs have been removed.
• Durable configuration now requires schema version 3 and rejects missing, malformed, or older persisted payloads.
• Consumer repositories must regenerate or update the release, hotfix, deployment-continuation, and merge-group workflow templates.

---

🚀 Deployment Notes

• Requires database migration
• Requires environment variable changes
• Requires feature flag toggle
• No special deployment steps

Details:

• Regenerate or update consumer repositories with the release, hotfix, deployment-continuation, and merge-group workflow templates.
• Configure Repository Variables when overriding orchestration defaults.
• For npm trusted publishing, configure the npm environment and GitHub Actions trusted publishers.
• Ensure required checks support merge_group before selecting merge-queue mode.

---

🔒 Security Considerations

• No security impact
• Input validation changes
• Authentication / authorization changes
• Sensitive data handling changes

Continuation validates managed operation identity, repository ownership, issue and branch pairing, stored SHAs, and production reachability before mutation. Workflows use trusted base-branch checkouts and scoped permissions; credentials and OIDC claims are excluded from durable state.

---

📈 Performance Impact

• No performance impact
• Improves performance
• Potential performance regression (explain)

PR checks and human review no longer occupy a runner while pending. Continuation workflows run only after relevant managed PR events, with bounded queue and job timeouts.

---

📝 Notes for Reviewers

Pay particular attention to:

• State-machine transitions and retry behavior.
• Production SHA and immutable tag verification.
• Reconciliation target and sync-branch selection.
• Workflow permissions, marker parsing, and merge-group compatibility.
• Consistency between Action inputs, setup templates, persisted configuration, documentation, and generated bundles.
• Migration impact from the removed legacy deployment actions and schema-v2 configuration.

---

✅ Checklist

• I have self-reviewed my code
• Code follows project standards and conventions
• Tests have been added or updated
• Documentation has been updated
• No new warnings or lint errors
• Breaking contract changes and required consumer updates are documented

---

📚 Additional Context

See Release and hotfix orchestration, configurable-release-orchestration.md, and configurable-release-orchestration-traceability.md.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~358

Documentation is deployed and generated using docs.page

[vypbot]

🤖 Bugbot review

Bugbot found 1 active potential problem(s) in this revision. 1 finding(s) are attached to changed code in this review.

Findings

• medium: Merge-queue mode is accepted without workflow support validation — src/actions/github_action_execution.ts:81

To request an automatic repair for all active findings, reply with /copilot fix all.

^{Written by vypdev/copilot for commit df9724909f7ec33f4666eacac4d19e5c2098c6c2. This will update automatically on new commits.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 80.70175% with 165 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.59%. Comparing base (45c9e54) to head (e6089b9).

Files with missing lines	Patch %	Lines
...cases/actions/deployment_orchestration_use_case.ts	72.28%	35 Missing and 62 partials ⚠️
...ication/policies/deployment_presentation_policy.ts	90.90%	0 Missing and 11 partials ⚠️
src/cli/setup_prompt_adapter.ts	15.38%	11 Missing ⚠️
src/application/policies/deployment_plan_policy.ts	87.17%	2 Missing and 8 partials ⚠️
...n/usecases/setup/merge_queue_readiness_use_case.ts	83.33%	1 Missing and 8 partials ⚠️
src/actions/deployment_configuration_builder.ts	78.57%	5 Missing and 1 partial ⚠️
src/actions/github_action_completion.ts	63.63%	3 Missing and 1 partial ⚠️
...application/usecases/steps/commit/bugbot/marker.ts	66.66%	2 Missing and 2 partials ⚠️
...ion/usecases/steps/issue/prepare_release_branch.ts	40.00%	2 Missing and 1 partial ⚠️
...c/application/policies/setup_configuration_plan.ts	87.50%	1 Missing and 1 partial ⚠️
... and 7 more

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #358      +/-   ##
==========================================
- Coverage   87.89%   87.59%   -0.31%     
==========================================
  Files         568      575       +7     
  Lines       12282    13250     +968     
  Branches     2960     3332     +372     
==========================================
+ Hits        10795    11606     +811     
- Misses        701      752      +51     
- Partials      786      892     +106     

Files with missing lines	Coverage Δ
src/actions/configuration_builders.ts	100.00% <100.00%> (ø)
src/actions/github_action.ts	92.42% <ø> (ø)
src/actions/github_action_ai_inputs.ts	88.88% <ø> (+3.88%)	⬆️
src/actions/github_action_execution.ts	91.83% <100.00%> (+0.34%)	⬆️
src/actions/local_action_configuration_sections.ts	85.48% <100.00%> (+2.43%)	⬆️
src/actions/local_action_execution.ts	92.30% <ø> (ø)
src/application/contracts/input_keys.ts	100.00% <ø> (ø)
src/application/policies/agent_activity_policy.ts	80.00% <100.00%> (ø)
...plication/policies/agent_task_activation_policy.ts	93.61% <ø> (ø)
...application/policies/comment_translation_policy.ts	93.75% <ø> (-0.37%)	⬇️
... and 82 more

... and 26 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vypbot]

🪄 Automatic Actions

1. Waiting state cleared.

Debug log

[DEBUG] Setup done. Issue number: 358, isSingleAction: false, isIssue: true, isPullRequest: false, isPush: false
[INFO] Added Copilot agent activity label on target #358.
[INFO] Running IssueCommentUseCase for issue #358.
[INFO] IssueCommentUseCase started.
[INFO] 🌐 Executing CheckIssueCommentLanguageUseCase.
[DEBUG] CheckIssueCommentLanguageUseCase: language check status=done.
[INFO] Skipping natural-language intent detection because the bot was not mentioned.
[INFO] Main run finished. Results: 1, total steps: 0.
[INFO] Removed Copilot agent activity label on target #358.
[INFO] Publishing result: 2 result(s), 1 step(s), 0 error(s).
[INFO] 📄 Executing PublishResultUseCase.

🚀 Happy coding!

^{Made with ❤️ by vypdev/copilot}

[vypbot]

🪄 Automatic Actions

1. Waiting state cleared.

Debug log

[DEBUG] Setup done. Issue number: 358, isSingleAction: false, isIssue: true, isPullRequest: false, isPush: false
[INFO] Added Copilot agent activity label on target #358.
[INFO] Running IssueCommentUseCase for issue #358.
[INFO] IssueCommentUseCase started.
[INFO] 🌐 Executing CheckIssueCommentLanguageUseCase.
[DEBUG] CheckIssueCommentLanguageUseCase: language check status=done.
[INFO] Skipping natural-language intent detection because the bot was not mentioned.
[INFO] Main run finished. Results: 1, total steps: 0.
[INFO] Removed Copilot agent activity label on target #358.
[INFO] Publishing result: 2 result(s), 1 step(s), 0 error(s).
[INFO] 📄 Executing PublishResultUseCase.

🚀 Happy coding!

^{Made with ❤️ by vypdev/copilot}