[rossirpaulo]

What changed

• replace the primitive C# product consumer's repository-path scan from rg to recursive fixed-string grep
• keep the existing fail-closed distinction between a match, no match, and a scanner error
• update the release-contract regression to require the dependency-free implementation

Root cause

The BAML Language Release package assembly runner does not install ripgrep. The older pipeline accidentally treated rg: command not found as a clean scan because the command was hidden inside an if pipeline. The fail-closed scanner introduced in #4184 correctly surfaced exit 127, but that caused Verify C# SDK product package / Assemble one provenance-bound package to fail after the package had otherwise built and executed successfully.

grep is already required and exercised earlier in the same consumer verifier, so this removes the undeclared cross-platform dependency without adding runner provisioning.

Validation

• all 19 release-pipeline contract tests pass
• repository commit hooks pass
• Bash syntax and ShellCheck pass
• the exact failed package passes linux-x64 end to end with a PATH that contains no rg
• the exact failed package passes linux-musl-x64 in the pinned Alpine/.NET image with ripgrep deliberately absent
• both exact-package runs finish with primitive_exact_package=ok

Summary by CodeRabbit

• Bug Fixes

  • Improved release verification when checking published C# consumer packages for repository path leaks.
  • Updated validation to use a more widely available search command, improving compatibility across environments.

• Tests

  • Updated release pipeline checks to reflect the revised package scanning behavior.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
beps	Ready	Preview, Comment	Jul 24, 2026 11:17pm
promptfiddle	Building	Preview, Comment	Jul 24, 2026 11:17pm
promptfiddle2	Ready	Preview, Comment	Jul 24, 2026 11:17pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4e8dfa81-9710-41a5-ba5e-65a01ac65411

📥 Commits

Reviewing files that changed from the base of the PR and between e1b0a40 and 3c7e736.

📒 Files selected for processing (2)

• baml_language/sdks/csharp/bridge_csharp/tests/Baml.Bridge.PrimitivePackageConsumer/verify.sh
• scripts/tests/test_release_pipeline_contract.py

---

📝 Walkthrough

Walkthrough

The C# primitive consumer verification script now scans published files with recursive grep. The release pipeline contract test was updated to require this command and reject the previous rg usage.

Changes

C# repository path scanning

Layer / File(s)	Summary
Update scan command and contract test baml_language/sdks/csharp/bridge_csharp/tests/Baml.Bridge.PrimitivePackageConsumer/verify.sh, scripts/tests/test_release_pipeline_contract.py	The repository path scan uses grep -r -a -F -l, and contract assertions validate the prefix-based scan without rg -a or the repository-root pattern.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• BoundaryML/baml#4158: Updates related release-pipeline contract assertions for the same C# consumer path scan.
• BoundaryML/baml#4184: Modifies the same C# consumer verification and contract-test path scanning behavior.

Poem

A rabbit checks each published byte,
With grep it finds the path just right.
The old rg trail fades away,
Contract tests now guard the way.
Hop, hop—clean paths stay!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the main change: replacing the C# release scanner's ripgrep dependency.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/fix-csharp-release-scanner-dependency

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏭️ Performance benchmarks were skipped

Perf benchmarks (CodSpeed) are opt-in on pull requests — they no longer run on every push. They always run automatically after merge to canary/main.

To run them on this PR, do any of the following, then push a commit (or re-run CI):

• Add RUN_CODSPEED=1 to the PR description, or
• Include run-perf or /perf in the PR title or any commit message.

[github-actions]

Binary size checks passed

✅ 7 passed

	Artifact	Platform	File	Gzip	Gated on	Baseline	Delta	Status
✅	baml-cli	Linux	🔒 27.2 MB	11.6 MB	file	27.1 MB	+150.2 KB (+0.6%)	OK
✅	packed-program	Linux	🔒 17.6 MB	7.3 MB	file	17.6 MB	+7.2 KB (+0.0%)	OK
✅	baml-cli	macOS	🔒 21.2 MB	10.1 MB	file	21.0 MB	+149.1 KB (+0.7%)	OK
✅	packed-program	macOS	🔒 13.8 MB	6.4 MB	file	13.8 MB	+33.1 KB (+0.2%)	OK
✅	baml-cli	Windows	🔒 22.8 MB	10.3 MB	file	22.7 MB	+124.9 KB (+0.6%)	OK
✅	packed-program	Windows	🔒 14.7 MB	6.5 MB	file	14.7 MB	+3.6 KB (+0.0%)	OK
✅	bridge_wasm	WASM	16.5 MB	🔒 4.5 MB	gzip	4.5 MB	+18.5 KB (+0.4%)	OK

🔒 = the size this artifact is GATED on (ceiling + delta). Binaries gate on file size (installed binary); WASM gates on gzip (download size). The other size is shown for information only.

---

Generated by cargo size-gate · workflow run