[oschwald]

Related to STF-1869. Companion to mmdbinspect #253.

The release script pushes a tag, but the workflow waits for an already published release. Restore the tag-push trigger so GoReleaser uploads assets before publishing an immutable release. Read and validate the annotated tag body, and remove changelog.disable so GoReleaser uses those notes.

Changes

• Reject empty or whitespace-only notes before pushing.
• Preserve Markdown headings and valid signatures in annotated tags with --cleanup=whitespace.
• Use full tag refs for pushes and object lookup, and pin GoReleaser to the triggering tag.
• Push only the selected release tag and document the release steps in README.dev.md.
• Update mmdbwriter to aa874fe6bc9e in a separate commit to fix the untagged-dependency check. This requires maxminddb-golang v2.7.0.

Validation

• ShellCheck 0.11.0, shfmt 3.13.1, and zizmor 1.30.1 pass.
• Temporary-repository tests cover empty notes, signed and unsigned tags, preserved headings, branch/tag name collisions, and pushing only the selected tag. Workflow extraction rejects lightweight tags and tags without notes.
• GoReleaser smoke tests with builds disabled load supplied notes, reject a missing notes file, and retain the selected version when multiple tags point to one commit.
• Snapshot packaging passes with GoReleaser 2.18.2 and Go 1.27.1. No releases were published.
• Prettier passes for the developer release instructions.
• go test -race ./... and check-untagged-go-deps v1.1.0 pass after the dependency update.

Repository settings

GitHub settings were checked: immutable releases are enforced by the organization, Actions are enabled, and the release environment permits v* tags. The same releaser team approves deployments and can create protected release tags. The workflow grants contents: write only to the release job and uses the built-in GITHUB_TOKEN. No settings changes or additional secrets are needed.

Summary by CodeRabbit

• Release Improvements

  • Releases are now prepared from version tags, with non-empty release notes required before publishing. The notes are included with the release, and the release workflow verifies the tag before proceeding.
  • Release publishing now pushes only the selected version tag.

• Documentation

  • Added step-by-step guidance for preparing, approving, and verifying a release.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: dd66b334-3ac8-43a9-bd9f-aa7056109e2c

📥 Commits

Reviewing files that changed from the base of the PR and between 1dd9434 and e6e0fd4.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (5)

• .github/workflows/release.yml
• .goreleaser.yml
• README.dev.md
• dev-bin/release.sh
• go.mod

💤 Files with no reviewable changes (1)

• .goreleaser.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The release process now starts from annotated v* tag pushes with non-empty release notes. The workflow passes the tag and notes to GoReleaser. The release script pushes only the new tag, and the development README documents the procedure. Two Go module versions are updated.

Changes

Release flow

Layer / File(s)	Summary
Prepare and push release tags dev-bin/release.sh, README.dev.md	The script rejects blank release notes, creates an annotated tag with whitespace cleanup, and pushes only that tag. The README documents the release procedure.
Validate tag pushes and run GoReleaser .github/workflows/release.yml, .goreleaser.yml	The workflow runs on v* tag pushes, checks that the target is annotated and has non-empty notes, then passes the tag and notes file to GoReleaser. The configuration no longer explicitly disables changelog handling.

Go module updates

Layer / File(s)	Summary
Update module versions go.mod	The required versions of github.com/maxmind/mmdbwriter/v2 and github.com/oschwald/maxminddb-golang/v2 are updated.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseScript
  participant GitRemote
  participant ReleaseWorkflow
  participant GoReleaser
  ReleaseScript->>GitRemote: Push annotated tag with release notes
  GitRemote->>ReleaseWorkflow: Trigger workflow for tag push
  ReleaseWorkflow->>GitRemote: Fetch tag and read tag message
  ReleaseWorkflow->>GoReleaser: Pass tag name and release notes file

Loading

Merge Risk: ⚪ Minimal · up to e6e0f

The tag-driven release flow and updated MaxMind dependencies show no established issue that should block merging.

Security Architecture Review

Security architecture risk: 🔵 Low · up to e6e0f

The release flow retains its existing release-environment gate and write permissions, while adding tag and notes validation. No introduced vulnerability is established. Effective tag protection, approval requirements, and recovery after partial publication remain operational uncertainties.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The sensitive boundary is access to this repository's contents-write token and publication of distributable binaries and packages. A compromised approved release could affect downstream consumers; the checked-in workflow does not establish broader cloud, tenant, or production-environment authority.

Trust Boundaries and Controls

• observed — The release job retains its environment association and contents-write permission. Validation has contents-read permission, checkout disables persisted credentials, and head adds empty workflow-level permissions. Actual reviewer requirements and tag restrictions are external settings not established by these source controls.
• inferred — Tag annotation and notes validation establish release-input structure, not creator identity or trusted commit provenance. The effective authorization comparison therefore depends on who can create or update release tags and who must approve the release environment. Publishing a release branch before its merge is explicitly intended, so requiring an already-merged main commit would change the documented design.

Resilience and Maintainability Implications

• inferred — An interruption can leave a local or remote tag without a completed release, and rerunning the script after local tag creation fails because it does not replace existing tags. These properties predate this PR. Explicitly pushing only the selected tag improves containment, while safe recovery from partial asset publication and concurrent runs remains unverified.

Hardening Proposals

• proposed — Verify and record the enforced release-environment reviewer requirements and v* tag creation/update restrictions. If tags may be retargeted before publication, consider checking that the fetched tag resolves to the triggering commit before consuming its notes.
• proposed — Document recovery for failures after tag creation, tag push, and partial asset upload, including when a workflow rerun is safe without replacing the release tag.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: restoring releases triggered by tag pushes and requiring release notes.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{I’m a rabbit with a tag to send,
Notes in the bundle, neat to the end.
A workflow wakes when the tag takes flight,
GoReleaser gathers the notes just right.
Two modules hop to versions new,
Then I nibble clover and review.}

_{Comment @coderabbitai help to get the list of available commands.}