[skevetter]

Ubuntu 26.04 makes /tmp a RAM-backed filesystem with a roughly 8 GiB quota. SSH v1.1.45 and v1.1.46 failed cross-compilation with disk-quota errors and were left with no release assets. Cleaning the runner freed 17 GiB but reproduced the error because /tmp has a separate limit.

Use GOTMPDIR=$RUNNER_TEMP for disk-backed Go build temporary files. Start free-disk-space in the background during setup and wait before compiling. Preserve parallel GoReleaser builds, artifact names, existing tags, and the five-platform binary set.

Add manual tag-specific backfills and a Go verifier at hack/verify-release/main.go. Fail publication unless all five binaries, checksums.txt, and provider.yaml are present and nonempty. Download every required asset, verify binary SHA-256 sums and the complete checksum platform set, and compare the published manifest and checksum file against build outputs.

Validation: Go verifier race tests and all prek hooks passed, including Go lint. Regression tests reject missing/empty/duplicate assets, corrupt or missing binaries, stale metadata, incomplete or duplicate checksum sets, and malformed digests. Local CodeRabbit tag-validation/selection findings addressed. Both v1.1.45 and v1.1.46 backfills succeeded with all seven assets downloaded and verified by the Go verifier. Final head a68ebb6 has all CI green, including Linux integration and the Windows rerun. Greptile 5/5, completed CodeRabbit review with no actionable findings, no unresolved review threads, and verified commit signatures.

Actionlint v1.7.12 predates GitHub background/wait support. Compatibility exclusions cover its obsolete parser diagnostics; GitHub validates actual workflow syntax. Azure has the same confirmed release defect and equivalent repair in devsy-org/devsy-provider-azure#118.

Successful backfills: https://github.com/devsy-org/devsy-provider-ssh/actions/runs/39619810633 and https://github.com/devsy-org/devsy-provider-ssh/actions/runs/39619841717

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8cc7dee6-cca3-41dc-8588-93a689cac358

📥 Commits

Reviewing files that changed from the base of the PR and between a7cae3d and a68ebb6.

📒 Files selected for processing: 4

• .github/workflows/release.yaml
• hack/verify-release/main.go
• hack/verify-release/main_test.go
• prek.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The release workflow can run for a selected tag or a newly created release. It checks out and validates that tag, builds and publishes assets, and invokes a verifier that compares downloaded release binaries and metadata with local outputs. The workflow also adds runner disk management and usage reporting.

Changes: Release workflow and asset verification

Layer / File(s)	Summary
Release asset verification hack/verify-release/*	A new command validates release assets and compares published metadata and binary checksums with local build outputs. Tests cover missing, duplicate, empty, and corrupted assets, as well as invalid checksums.
Tag-based release workflow .github/workflows/release.yaml, prek.toml	The workflow accepts a manual tag or uses the release event tag, validates the checkout, manages runner disk use, publishes artifacts, and runs release verification. The actionlint configuration ignores specified workflow syntax.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant GoReleaser
  participant GitHubRelease
  participant VerifyRelease
  GitHubActions->>GoReleaser: Build and publish selected TAG
  GoReleaser->>GitHubRelease: Upload release assets
  GitHubActions->>VerifyRelease: Verify TAG and local distribution
  VerifyRelease->>GitHubRelease: List and download release assets via gh
  VerifyRelease->>VerifyRelease: Compare metadata and check binary checksums
  VerifyRelease->>GitHubActions: Return verification result

Loading

Possibly related issues

• Rename tracker: Loft -> Devsy, Pro -> Platform devsy#1551: The workflow adds disk cleanup and GOTMPDIR handling for release builds, and it verifies published assets. Manual tag selection can run the workflow for an existing release tag.

Merge Risk: ⚪ Minimal · up to a68eb

The release verification and older-tag backfill paths have no identified issue that needs correction before merge.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 2 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely summarizes the two main changes: runner disk reclamation and release publication verification.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 2 files. (2 skipped: 2 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[skevetter]

@greptileai review

[skevetter]

@greptileai review

[skevetter]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable defects were found.

Summary

This PR repairs release builds and adds checks for published assets.

• Release runs can rebuild a chosen tag without filling /tmp.
• The release job checks all seven published assets against the build.
• The actionlint hook skips diagnostics for the workflow’s cleanup steps.

No actionable issues were found. The review checked source and configuration; it did not independently rerun builds or backfills.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Release event or manual tag] --> B[Start background cleanup]
  B --> C[Check out and validate tag]
  C --> D[Set Go temporary directory and install Go]
  D --> E[Wait for cleanup]
  E --> F[Build and publish binaries and checksums]
  F --> G[Generate and upload provider.yaml]
  G --> H[Download seven required assets]
  H --> I[Compare metadata and check binary hashes]
  I --> J[Pass only when all checks succeed]

Loading

_{Reviews (3) · Last reviewed commit: "fix: verify release assets in Go and use..." · Reviewed by Greptile}