ci: automate semver releases on main using Sonnet by benvinegar · Pull Request #162 · modem-dev/baudbot

benvinegar · 2026-02-24T13:25:46Z

Summary

Adds a GitHub Actions workflow to automate release decisions on pushes to main using Claude Sonnet.

What it does

Runs on push to main and workflow_dispatch
Debounces rapid pushes via concurrency cancellation
Analyzes merged PRs since latest tag
Uses CI_ANTHROPIC_KEY + Sonnet to decide none/patch/minor
Blocks major bumps in CI
Bumps package.json version (+ lockfile if present)
Commits, tags, pushes, and creates GitHub Release with changelog
Supports [skip release] opt-out and idempotency checks

Notes

Uses GITHUB_TOKEN with minimal permissions (contents: write, pull-requests: read).

greptile-apps · 2026-02-24T13:28:38Z

Greptile Summary

Introduces automated semantic versioning release workflow triggered on pushes to main, using Claude Sonnet to analyze merged PRs and decide between none/patch/minor version bumps.

Critical Issues Found:

Infinite loop: Pushing release commit to main (line 210) re-triggers this workflow without [skip ci] in commit message
Race condition: Concurrent workflow runs can both pass tag existence check, then conflict when pushing (lines 194-211)
Idempotency broken: Tag existence check (line 194) exits successfully but doesn't prevent subsequent commit/push steps
Shell injection: Version bump logic (lines 180-181) interpolates shell variables into JavaScript, vulnerable if version strings contain special characters

Other Observations:

Proper use of contents: write permission scope
Good concurrency cancellation to debounce rapid pushes
Claude API integration uses temperature 0 for deterministic decisions
[skip release] opt-out mechanism works correctly

Confidence Score: 1/5

This PR has critical bugs that will cause runtime failures and should not be merged without fixes
Score reflects multiple severe logical errors: infinite workflow loop, race conditions in concurrent releases, broken idempotency check, and shell injection vulnerabilities in version bumping code
.github/workflows/release-on-main.yml requires immediate attention — all identified issues must be resolved before merge

Important Files Changed

Filename	Overview
.github/workflows/release-on-main.yml	Automated semver release workflow with Claude Sonnet — contains critical race conditions, infinite loop risk, and shell injection vulnerabilities

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Push to main] --> B{Contains skip release?}
    B -->|Yes| Z[Skip workflow]
    B -->|No| C[Fetch tags and PRs]
    C --> D{Any merged PRs?}
    D -->|No| E[Exit: No changes]
    D -->|Yes| F[Call Claude Sonnet API]
    F --> G{Decision?}
    G -->|none| E
    G -->|patch or minor| H[Bump package.json version]
    H --> I{Tag exists?}
    I -->|Yes| J[Exit 0 but steps continue]
    I -->|No| K[Commit Tag Push]
    K --> L[Push triggers workflow again]
    J --> M[Attempt duplicate commit]
    K --> N[Create GitHub Release]
    N --> O[Done]
    
    style L fill:#ff6b6b
    style M fill:#ff6b6b
    style J fill:#ffd93d

_{Last reviewed commit: 08bb666}

greptile-apps

_{1 file reviewed, 6 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-24T13:28:42Z

.github/workflows/release-on-main.yml

+          if git rev-parse "$TAG" >/dev/null 2>&1; then
+            echo "Tag already exists: $TAG. Skipping to keep idempotent."
+            exit 0
+          fi


Tag existence check doesn't prevent subsequent steps. If tag exists, this step exits 0 (success) but next steps still execute, causing duplicate commit attempts.

Suggested change

if git rev-parse "$TAG" >/dev/null 2>&1; then

echo "Tag already exists: $TAG. Skipping to keep idempotent."

exit 0

fi

if git rev-parse "$TAG" >/dev/null 2>&1; then

echo "Tag already exists: $TAG. Skipping to keep idempotent." >> "$GITHUB_STEP_SUMMARY"

echo "skip_remaining=true" >> "$GITHUB_OUTPUT"

exit 0

fi

echo "skip_remaining=false" >> "$GITHUB_OUTPUT"

Prompt To Fix With AI

This is a comment left during a code review. Path: .github/workflows/release-on-main.yml Line: 194-197 Comment: Tag existence check doesn't prevent subsequent steps. If tag exists, this step exits 0 (success) but next steps still execute, causing duplicate commit attempts. ```suggestion if git rev-parse "$TAG" >/dev/null 2>&1; then echo "Tag already exists: $TAG. Skipping to keep idempotent." >> "$GITHUB_STEP_SUMMARY" echo "skip_remaining=true" >> "$GITHUB_OUTPUT" exit 0 fi echo "skip_remaining=false" >> "$GITHUB_OUTPUT" ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-24T13:28:43Z

.github/workflows/release-on-main.yml

+          fi
+
+      - name: Commit and tag
+        if: steps.bump.outputs.tag != ''


Also needs to check steps.tag_check.outputs.skip_remaining != 'true' to prevent commit when tag already exists

Prompt To Fix With AI

This is a comment left during a code review. Path: .github/workflows/release-on-main.yml Line: 200 Comment: Also needs to check `steps.tag_check.outputs.skip_remaining != 'true'` to prevent commit when tag already exists How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-24T13:28:44Z

.github/workflows/release-on-main.yml

+          git add package.json package-lock.json || true
+          git commit -m "release: ${TAG}"
+          git tag "$TAG"
+          git push origin main
+          git push origin "$TAG"


Race condition: if multiple workflow runs create same version, both pass line 194 check, then both commit/push, causing git conflict. Second push will fail with non-fast-forward error.

Use atomic git push --atomic or add retry logic with conflict detection.

Prompt To Fix With AI

This is a comment left during a code review. Path: .github/workflows/release-on-main.yml Line: 207-211 Comment: Race condition: if multiple workflow runs create same version, both pass line 194 check, then both commit/push, causing git conflict. Second push will fail with non-fast-forward error. Use atomic `git push --atomic` or add retry logic with conflict detection. How can I resolve this? If you propose a fix, please make it concise.

Fixed — replaced the two separate git push calls with git push --atomic origin main "$TAG", ensuring commit+tag land together or not at all. Also added [skip release] to the release commit message (see next comment) so the concurrency window is further narrowed.

_{Responded by pi using anthropic/claude-sonnet-4-20250514.}

greptile-apps · 2026-02-24T13:28:45Z

.github/workflows/release-on-main.yml

+          git push origin main
+          git push origin "$TAG"


Pushing back to main triggers this workflow again due to line 4-5. Creates infinite loop unless commit message includes [skip release] or [skip ci].

Add [skip ci] to commit message to prevent re-triggering.

Prompt To Fix With AI

This is a comment left during a code review. Path: .github/workflows/release-on-main.yml Line: 210-211 Comment: Pushing back to `main` triggers this workflow again due to line 4-5. Creates infinite loop unless commit message includes `[skip release]` or `[skip ci]`. Add `[skip ci]` to commit message to prevent re-triggering. How can I resolve this? If you propose a fix, please make it concise.

Good catch — fixed. The release commit message now includes [skip release] (e.g. release: v1.2.3 [skip release]), which is already checked by the job-level if condition on line 18. This prevents the infinite loop without needing [skip ci], which would also suppress other workflows we may want to run on release commits.

_{Responded by pi using anthropic/claude-sonnet-4-20250514.}

greptile-apps · 2026-02-24T13:28:46Z

.github/workflows/release-on-main.yml

+        run: |
+          set -euo pipefail
+          CURRENT=$(node -p "require('./package.json').version")
+          NEXT=$(node -e "const v='${CURRENT}'.split('.').map(Number); if('${BUMP}'==='minor'){v[1]++; v[2]=0;} else {v[2]++;} process.stdout.write(v.join('.')); ")


Inline JavaScript uses shell variable interpolation which breaks if CURRENT or BUMP contain special chars (quotes, backslashes). Use -- separator and stdin instead:

Suggested change

NEXT=$(node -e "const v='${CURRENT}'.split('.').map(Number); if('${BUMP}'==='minor'){v[1]++; v[2]=0;} else {v[2]++;} process.stdout.write(v.join('.')); ")

NEXT=$(node -e "const v=process.argv[1].split('.').map(Number); if(process.argv[2]==='minor'){v[1]++; v[2]=0;} else {v[2]++;} process.stdout.write(v.join('.'))" -- "${CURRENT}" "${BUMP}")

Prompt To Fix With AI

This is a comment left during a code review. Path: .github/workflows/release-on-main.yml Line: 180 Comment: Inline JavaScript uses shell variable interpolation which breaks if `CURRENT` or `BUMP` contain special chars (quotes, backslashes). Use `--` separator and stdin instead: ```suggestion NEXT=$(node -e "const v=process.argv[1].split('.').map(Number); if(process.argv[2]==='minor'){v[1]++; v[2]=0;} else {v[2]++;} process.stdout.write(v.join('.'))" -- "${CURRENT}" "${BUMP}") ``` How can I resolve this? If you propose a fix, please make it concise.

Applied — both Node one-liners now use process.argv with -- separator instead of shell interpolation:

NEXT=$(node -e "const v=process.argv[1].split('.').map(Number); ..." -- "${CURRENT}" "${BUMP}") node -e "... j.version=process.argv[1]; ..." -- "${NEXT}"

Eliminates the shell injection vector entirely.

_{Responded by pi using anthropic/claude-sonnet-4-20250514.}

greptile-apps · 2026-02-24T13:28:47Z

.github/workflows/release-on-main.yml

+          set -euo pipefail
+          CURRENT=$(node -p "require('./package.json').version")
+          NEXT=$(node -e "const v='${CURRENT}'.split('.').map(Number); if('${BUMP}'==='minor'){v[1]++; v[2]=0;} else {v[2]++;} process.stdout.write(v.join('.')); ")
+          node -e "const fs=require('fs'); const p='package.json'; const j=JSON.parse(fs.readFileSync(p,'utf8')); j.version='${NEXT}'; fs.writeFileSync(p, JSON.stringify(j,null,2)+'\\n');"


Same shell injection risk with NEXT variable.

Suggested change

node -e "const fs=require('fs'); const p='package.json'; const j=JSON.parse(fs.readFileSync(p,'utf8')); j.version='${NEXT}'; fs.writeFileSync(p, JSON.stringify(j,null,2)+'\\n');"

node -e "const fs=require('fs'); const p='package.json'; const j=JSON.parse(fs.readFileSync(p,'utf8')); j.version=process.argv[1]; fs.writeFileSync(p, JSON.stringify(j,null,2)+'\\n');" -- "${NEXT}"

Prompt To Fix With AI

This is a comment left during a code review. Path: .github/workflows/release-on-main.yml Line: 181 Comment: Same shell injection risk with `NEXT` variable. ```suggestion node -e "const fs=require('fs'); const p='package.json'; const j=JSON.parse(fs.readFileSync(p,'utf8')); j.version=process.argv[1]; fs.writeFileSync(p, JSON.stringify(j,null,2)+'\\n');" -- "${NEXT}" ``` How can I resolve this? If you propose a fix, please make it concise.

Fixed in the same commit — the package.json write now uses process.argv[1] with -- separator as suggested.

_{Responded by pi using anthropic/claude-sonnet-4-20250514.}

.github/workflows/release-on-main.yml

ci: add Sonnet-driven semver release workflow on main

08bb666

greptile-apps bot reviewed Feb 24, 2026

View reviewed changes

sentry bot reviewed Feb 24, 2026

View reviewed changes

.github/workflows/release-on-main.yml Show resolved Hide resolved

.github/workflows/release-on-main.yml Outdated Show resolved Hide resolved

benvinegar added 2 commits February 24, 2026 08:57

ci: default release workflow to dry-run with decision summary

0789607

ci: harden release workflow idempotency and push semantics

05b9600

sentry bot reviewed Feb 24, 2026

View reviewed changes

.github/workflows/release-on-main.yml Outdated Show resolved Hide resolved

ci: fix paginated PR fetch with --slurp + flatten for >100 PRs

8109c3e

benvinegar merged commit e50fcec into main Feb 24, 2026
9 checks passed

greptile-apps bot mentioned this pull request Feb 24, 2026

ci: fix YAML syntax error in release-on-main workflow #169

Merged

	NEXT=$(node -e "const v='${CURRENT}'.split('.').map(Number); if('${BUMP}'==='minor'){v[1]++; v[2]=0;} else {v[2]++;} process.stdout.write(v.join('.')); ")
	NEXT=$(node -e "const v=process.argv[1].split('.').map(Number); if(process.argv[2]==='minor'){v[1]++; v[2]=0;} else {v[2]++;} process.stdout.write(v.join('.'))" -- "${CURRENT}" "${BUMP}")

	node -e "const fs=require('fs'); const p='package.json'; const j=JSON.parse(fs.readFileSync(p,'utf8')); j.version='${NEXT}'; fs.writeFileSync(p, JSON.stringify(j,null,2)+'\\n');"
	node -e "const fs=require('fs'); const p='package.json'; const j=JSON.parse(fs.readFileSync(p,'utf8')); j.version=process.argv[1]; fs.writeFileSync(p, JSON.stringify(j,null,2)+'\\n');" -- "${NEXT}"

Conversation

benvinegar commented Feb 24, 2026

Summary

What it does

Notes

Uh oh!

greptile-apps bot commented Feb 24, 2026

Greptile Summary

Confidence Score: 1/5

Important Files Changed

Flowchart

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

benvinegar Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

benvinegar Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

benvinegar Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

benvinegar Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant