release(mobile): push candidate tags as the operator, not the App by brow · Pull Request #9084 · block/buzz

brow · 2026-11-05T00:24:30Z

Mobile release candidates (mobile-vX.Y.Z-rc.N) are currently created by the mobile-release-candidate.yml workflow, using the buzz-release-bot App key that also serves the desktop, relay and chart lanes. This PR takes mobile off that key. After it lands, the only way to create a mobile candidate tag is for a person on the mobile release team to push it.

What changes

scripts/mobile-release.sh candidate keeps all its existing checks: version, source branch, clean tree, canonical origin, ancestry and next rc number. It no longer dispatches a workflow. It now:
- verifies the mobile tag ruleset 26588677 (active, the expected rules, scoped to refs/tags/mobile-* or refs/tags/mobile-v*, and bypassable by the current user), and that the App-only general tag ruleset 14378754 excludes refs/tags/mobile-*;
- requires origin's effective push URLs to be exactly its fetch URL, and fetches a pinned --commit missing from a shallow clone;
- creates the annotated tag locally and pushes exactly that ref (--no-follow-tags, explicit refspec);
- confirms through the GitHub API that block/buzz holds that exact tag object, then verifies the remote tag as before.
A rejected push removes the local tag only when origin lacks it, so a retry starts clean. When the push reports failure but origin has the tag, the script keeps the local tag and still runs the canonical GitHub check, reporting success only if it passes. When GitHub can't confirm the tag, the local tag is kept and the message says how to reconcile it.
scripts/release-rulesets.sh: require_mobile_release_tag_ruleset replaces the App-oriented check. MOBILE_RELEASE_TAG_RULESET_ID is 26588677.
Removed .github/workflows/mobile-release-candidate.yml, scripts/publish-mobile-release-candidate.sh and its test, and their CI references. Updated RELEASING.md and the auto-tag workflow header comment.
The desktop, relay and chart auto-tagging is unchanged.

Rollout

Tag ruleset 26588677 ("Restrict Mobile Tags") is active with the two mobile release managers as bypass actors. The App (Integration 4349119) is temporarily a bypass actor of 26588677 and 19321162 so the current main workflow keeps working; it is removed from both right before this merges. General tag ruleset 14378754 now excludes refs/tags/mobile-*; without that, rulesets stack and it would reject release managers' mobile tag pushes. The branch ruleset 19321162 now has the same bypass actors, so require_mobile_release_branch_ruleset no longer requires "no bypass"; it still checks the review and status check policy. Release managers must be bypass actors of both rulesets.

Before merge

Remove Integration 4349119 (buzz-release-bot) from the bypass actors of rulesets 26588677 and 19321162.

Validation

shellcheck -x scripts/release-rulesets.sh scripts/mobile-release.sh scripts/mobile-release-source.sh scripts/test-mobile-release-contract.sh: clean.
scripts/test-mobile-release-contract.sh: passes. It runs against a local bare remote with a stubbed gh and covers:
- a successful annotated push at the pinned SHA;
- ruleset failures (not bypassable, inactive, wrong rules, wrong scope, excludes, non-numeric ID), with refs/tags/mobile-v* also accepted as the include, each failing before any tag is created;
- a push rejected by a pre-receive hook, which leaves no local tag and allows a clean retry;
- push.followTags=true with a stray local annotated mobile tag (exactly one ref published), a push that lands but exits non-zero (tag kept), and a GitHub API outage after the push (tag kept, rerun publishes the next rc);
- origin push URLs pointing at a fork (pushurl, a second pushurl, pushInsteadOf, insteadOf), a shallow clone pinning a historical commit, and 14378754 lacking the mobile exclusion;
- rc numbering, source branch rules and --commit pinning.
scripts/test-release-ref-contract.sh and scripts/test-desktop-release-candidate.sh: pass.
Live read-only check against real GitHub as a bypass actor: sourced scripts/release-rulesets.sh and scripts/mobile-release-source.sh, then ran require_mobile_release_tag_ruleset (including the 14378754 exclusion check) and require_mobile_release_branch_ruleset mobile-v0.27. Both returned success. No tag was created.
No mobile app test: this is a script and workflow change only.

🤖 Generated with Claude Code

Mobile candidate tags were created by a workflow holding the shared buzz-release-bot App key. Move mobile off that key so the only way to create a mobile-v* tag is a person on the mobile release team. scripts/mobile-release.sh candidate now verifies a dedicated mobile tag ruleset, creates the annotated tag locally, and pushes exactly that tag. A rejected push removes the local tag. The ruleset ID is a placeholder that fails loudly until an administrator records the real one. Remove the mobile-release-candidate workflow, its publisher script and test, and update the contract test, CI filters, and RELEASING.md. The desktop, relay, and chart lanes keep using the App unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tom Brow <tomb@squareup.com>

…e branch ruleset Record the Restrict Mobile Tags ruleset ID, accept either refs/tags/mobile-* or refs/tags/mobile-v* as its include, and describe the operator requirement as being a bypass actor (the mobile release managers) instead of a placeholder team. The Mobile Release Branches ruleset now lists the same bypass actors, so drop its no-bypass requirements and keep checking the review and status check policy. Update the contract test stubs and RELEASING.md to match. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tom Brow <tomb@squareup.com>

chatgpt-codex-connector · 2026-11-05T19:40:58Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T00:39:12.853798Z	`5ab794d`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6cfe9cc305

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

github-actions · 2026-11-05T19:43:16Z

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

Exact PR diff: 133c883b8ca1221d82d17c94249809844d2b80b3...5ab794d4306f557006422e83605396d7dbd78ba7

Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability findings were identified in the authorized PR range.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

Review used read-only inspection; scripts, builds, and tests were not executed.
Live GitHub rulesets and the private mobile build pipeline could not be verified.

_{Generated by Codex Security Review |

Requested by: @brow |

Workflow run}

… fetches git push origin honors remote.origin.pushurl and url.*.pushInsteadOf, so a checkout fetching canonical block/buzz could publish the candidate tag into a fork. Require the effective push URL to equal the effective fetch URL. Signed-off-by: Tom Brow <tomb@squareup.com>

…low clone A --commit SHA verified as a source-branch ancestor can lie outside a shallow operator clone's history, so creating the local tag failed. Fetch that exact commit first. Signed-off-by: Tom Brow <tomb@squareup.com>

brow · 2026-11-05T22:29:30Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3c2193e472

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…a GitHub An insteadOf rewrite can send a canonical-looking origin's fetch and push to a fork, so the git-side checks all pass against the fork. After pushing, require GitHub's block/buzz ref to hold the exact local annotated tag object, and remove the local tag otherwise. Signed-off-by: Tom Brow <tomb@squareup.com>

brow · 2026-11-05T22:38:24Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ddb7db3b82

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

git remote get-url --push lists only the first pushurl, while git push sends to every one, so a canonical first entry hid a fork after it. Compare all effective push URLs with the fetch URL. Signed-off-by: Tom Brow <tomb@squareup.com>

brow · 2026-11-05T22:47:13Z

@codex review

A concurrent fetch of main in the same checkout could replace FETCH_HEAD between the source fetch and its reads, so a stable candidate could be tagged on a main-only commit that then passed the ancestry check against itself. Read the tip with ls-remote and fetch that exact commit. Signed-off-by: Tom Brow <tomb@squareup.com>

brow · 2026-11-06T00:19:23Z

@codex review

wesbillman

🤖 Carl, an automated reviewer, commenting via Wes's GitHub account.

No blockers at cacdef0. All earlier findings are resolved. I did not submit an approval.

Push sends extra tags: fixed. --no-follow-tags plus an explicit refspec, and the local tag is deleted only when ls-remote confirms origin doesn't have the candidate. Mongo reran the reproduction against the exact script. A stray annotated tag stays unpublished. A competing rc at a different commit is left untouched and the attempted local tag is kept. A lost push acknowledgement and a failed remote lookup both keep the local tag, and a confirmed-absent remote allows cleanup.
Ruleset 14378754: fixed. It now excludes refs/tags/mobile-* (verified with a read-only gh api call), and the new preflight and its contract case cover that.
Docs: fixed. RELEASING.md now says release managers can tag stable-branch commits that were never reviewed.
cacdef0 (snapshotting the source tip without relying on the shared FETCH_HEAD) looks correct. The new race test pins it.
I'm fine leaving the insteadOf nit, given the test-harness reason and the GitHub-side OID check.

Merge criteria

Remove Integration 4349119 (buzz-release-bot) from 26588677 and 19321162 before merging, as the PR body commits to. Until then, release-rulesets.sh:4, RELEASING.md:108/:342 and the auto-tag header are inaccurate.
CI green on cacdef0. It was still pending when I checked.

blockers resolved

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cacdef001e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…using it When a push reported failure but origin had the tag, the script told the operator to use it without the canonical block/buzz check, though an insteadOf rewrite could make origin a fork. Continue to the canonical checks instead. Signed-off-by: Tom Brow <tomb@squareup.com>

brow · 2026-11-06T00:28:14Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: afd7e99ea4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@localhost> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tom Brow <tomb@squareup.com>

brow · 2026-11-06T00:35:40Z

@codex review

chatgpt-codex-connector · 2026-11-06T00:39:10Z

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 5ab794d430

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

* origin/main: (54 commits) release(mobile): push candidate tags as the operator, not the App (#9084) test(mobile): check posterless video previews renew the relay assertion (#9144) feat(relay): log WebSocket EVENT writes on the access target (#9154) perf(db): plan multi-value #d reads with their values (#9131) fix(mobile): confirm before starting a Huddle from the header (#9155) feat(cli): send NIP-FI evidence via credential chain and Buzz desktop (#8999) fix(mobile): find verified people who have no profile (#9086) feat(protocol): define compact membership discovery (BUZZ-615) (#9117) perf(db): hydrate search hits with exact event timestamps (#9126) perf(db): prune post-commit push enqueue by signed event timestamp (#9128) perf(db): use exact event timestamps for transactional deletion (#9130) perf(redis): index mesh ready records and share one Redis connection (#9113) fix(mobile): delay iOS message actions until a deliberate hold (#9049) feat(cli): user status expiry and status read (#8777) feat(cli): send a thread message to the channel (#8778) feat(relay): add kind 30180 custom emoji entry (#8783) feat(cli): read-only unread state (NIP-RS) (#8789) feat(cli): report a message to relay moderators (#8829) buzz-db: read explicit #h sets one channel at a time (#9110) feat(cli): list huddles and their participants (#8830) ... Signed-off-by: Taylor Ho <taylorkmho@gmail.com>

brow added the parked Not being shepherded toward review or merge; sweeps skip it label Nov 5, 2026

brow marked this pull request as ready for review November 5, 2026 19:40

brow requested a review from a team as a code owner November 5, 2026 19:40

brow temporarily deployed to codex-review November 5, 2026 19:41 — with GitHub Actions Inactive

chatgpt-codex-connector Bot reviewed Nov 5, 2026

View reviewed changes

Comment thread scripts/mobile-release.sh Resolved

github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 5, 2026

johnmatthewtennant reviewed Nov 5, 2026

View reviewed changes

Comment thread scripts/mobile-release.sh Resolved

johnmatthewtennant reviewed Nov 5, 2026

View reviewed changes

Comment thread scripts/mobile-release.sh Resolved

brow enabled auto-merge (squash) November 5, 2026 20:37

square-tomb added 2 commits November 5, 2026 14:28

github-actions Bot removed the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 5, 2026

brow temporarily deployed to codex-review November 5, 2026 22:29 — with GitHub Actions Inactive

github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 5, 2026

chatgpt-codex-connector Bot reviewed Nov 5, 2026

View reviewed changes

Comment thread scripts/release-rulesets.sh Resolved

github-actions Bot removed the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 5, 2026

brow temporarily deployed to codex-review November 5, 2026 22:38 — with GitHub Actions Inactive

github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 5, 2026

chatgpt-codex-connector Bot reviewed Nov 5, 2026

View reviewed changes

Comment thread scripts/release-rulesets.sh Resolved

github-actions Bot removed the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 5, 2026

brow temporarily deployed to codex-review November 5, 2026 22:47 — with GitHub Actions Inactive

github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 6, 2026

johnmatthewtennant reviewed Nov 6, 2026

View reviewed changes

Comment thread scripts/mobile-release.sh Resolved

wesbillman reviewed Nov 6, 2026

View reviewed changes

github-actions Bot removed the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 6, 2026

brow temporarily deployed to codex-review November 6, 2026 00:21 — with GitHub Actions Inactive

brow requested a review from wesbillman November 6, 2026 00:22

chatgpt-codex-connector Bot reviewed Nov 6, 2026

View reviewed changes

Comment thread scripts/mobile-release.sh Resolved

github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 6, 2026

wesbillman approved these changes Nov 6, 2026

View reviewed changes

brow requested a review from wesbillman November 6, 2026 00:28

github-actions Bot removed the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 6, 2026

brow temporarily deployed to codex-review November 6, 2026 00:29 — with GitHub Actions Inactive

github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 6, 2026

chatgpt-codex-connector Bot reviewed Nov 6, 2026

View reviewed changes

Comment thread scripts/release-rulesets.sh Resolved

release(mobile): require the mobile tag ruleset to target tags

5ab794d

Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@localhost> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tom Brow <tomb@squareup.com>

github-actions Bot removed the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 6, 2026

brow temporarily deployed to codex-review November 6, 2026 00:35 — with GitHub Actions Inactive

github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 6, 2026

wesbillman approved these changes Nov 6, 2026

View reviewed changes

brow merged commit 5d094cd into main Nov 6, 2026
101 checks passed

brow deleted the mobile-tag-no-app-key branch November 6, 2026 00:56

brow mentioned this pull request Nov 6, 2026

release(mobile): backport tag-as-operator to mobile-v0.27 #9209

Closed

Conversation

brow commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changes

Rollout

Before merge

Validation

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

github-actions Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔐 Codex Security Review

Review Summary

Findings

Notes

Uh oh!

Uh oh!

Uh oh!

brow commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

brow commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

brow commented Nov 5, 2026

Uh oh!

Uh oh!

brow commented Nov 6, 2026

Uh oh!

wesbillman left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

brow commented Nov 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

brow commented Nov 6, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 6, 2026

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

brow commented Nov 5, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Nov 5, 2026 •

edited

Loading

github-actions Bot commented Nov 5, 2026 •

edited

Loading