[coisa]

Closes #11. Depends on #7; this PR targets codex/extract-code-standards deliberately. Review only the channel/provenance increment before integrating the initial layer. Do not merge this upper layer first. After #7 merges, recapture base/head identity and rerun checks/reviews before any normal merge.

Consumer examples use GitHub @v0 after an actual published stable0.x exists. The reusable checks out its helper/runtime using the actual executing job's workflow repository/SHA, never resolving the moving channel again. Own CI calls the local reusable before any channel exists.

Adds repository-only channel maintenance adapted from Changelog's documented implementation: validate the actual published release and exact SHA, refuse major>0 and foreign targets, reject homonymous tags, compare-and-swap the previous branch OID, avoid regression and preserve idempotence. The existing Changelog lifecycle supplies publication outputs. It never creates a release/tag or advances v0 on an unpublished main commit. Required token capability failures remain explicit gates; no credentials or persistent security settings change. Composer/CPX versions remain distinct from the GitHub channel.

Preflight: base 9666d997c864e4e74b7ca0ca8cbce849091353a7 → head 181ac036940811d99909230a00aee95a2276196a. Fresh independent read-only reviewer /root/review_coderabbit_fixes approved this exact identity. Local PHP8.5.11: 61 tests/194 assertions, syntax/ECS for24 PHP files, Composer strict validation, actionlint and whitespace checks pass. Channel fixtures use disposable Git and MockHttpClient; workflow guards execute extracted Bash under synthetic contexts. No real channel mutation was used as a test.

Merge requires passing checks AND completed Codex AND CodeRabbit reviews without pending findings on the current head. Local review, old-head review, quota/skipped results and green status alone do not satisfy that gate. The later generated version PR has the same requirement. No release exists yet and no self-hosted CI was dispatched.

Refreshed through normal merges from the current initial branch; no published history rewritten. Fresh independent read-only review approved this exact updated head after reexecuting the stated tests. Remote reviews/checks must renew. The initial branch still awaits the requested composition in #16 and all resulting gates; no merge or release occurred.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 06b535ad-3c42-445d-b2fc-7d0ad392e2be

📥 Commits

Reviewing files that changed from the base of the PR and between 9666d99 and 181ac03.

⛔ Files ignored due to path filters: 1

• composer.lock is excluded by !**/*.lock

📒 Files selected for processing: 18

• .changelog/released-v0-channel.md
• .github/ReleaseChannelUpdater.php
• .github/update-release-channels.md
• .github/update-release-channels.php
• .github/workflows/code-standards-check.yml
• .github/workflows/code-standards.yml
• .github/workflows/repository-changelog.yml
• .github/workflows/repository-ci.yml
• .github/workflows/repository-release-channels.yml
• AGENTS.md
• composer.json
• docs/automation.md
• resources/skills/fast-forward-code-standards/SKILL.md
• resources/workflows/code-standards.yml
• tests/Automation/WorkflowContextTest.php
• tests/ReleaseChannel/EntryPointTest.php
• tests/ReleaseChannel/ReleaseChannelFixture.php
• tests/ReleaseChannel/ReleaseChannelUpdaterTest.php

💤 Files with no reviewable changes: 1

• .github/workflows/code-standards.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Summary

Summary by CodeRabbit

• New Features

  • Added a released-only v0 channel that can advance after a verified stable 0.x release.
  • Added safeguards to confirm release and commit details before updating the channel, and to prevent regressions or unintended changes.
  • Updated workflow examples to use v0 after publication, with reviewed commit pins still available for fixed versions.

• Documentation

  • Added guidance on channel behavior, adoption, and release verification.

• Tests

  • Added coverage for workflow validation and release-channel updates.

This change adds a verified, released-only v0 channel for stable 0.x releases. It adds a guarded updater and publication workflow, changes reusable workflow identity checks to use the executing job’s repository and SHA, and updates consumer guidance and tests.

Changes: Released v0 Channel

Layer / File(s)	Summary
Release evidence and version validation .github/ReleaseChannelUpdater.php, tests/ReleaseChannel/ReleaseChannelFixture.php, tests/ReleaseChannel/ReleaseChannelUpdaterTest.php, composer.json	The updater validates stable release and tag evidence, loads a bounded release catalog, and compares version components. Tests cover release selectors, publication metadata, and version ordering.
Channel state and conditional updates .github/ReleaseChannelUpdater.php, tests/ReleaseChannel/*, .github/update-release-channels.md	The updater checks the existing branch against published releases and rechecks evidence before mutation. It uses a non-forced compare-and-swap update and verifies the resulting branch. Tests cover advancement, stale selectors, races, mutation errors, and uncertain responses.
Publication workflow and updater entry point .github/update-release-channels.php, .github/workflows/repository-changelog.yml, .github/workflows/repository-release-channels.yml, tests/ReleaseChannel/EntryPointTest.php, tests/Automation/WorkflowContextTest.php, .github/update-release-channels.md, composer.json	The CLI validates its arguments and token before invoking the updater. The release workflow applies event and repository guards, then runs after successful publication or by manual dispatch. Supporting tests and documentation cover these paths.
Execution identity and consumer adoption .github/workflows/code-standards*.yml, .github/workflows/repository-ci.yml, resources/skills/fast-forward-code-standards/SKILL.md, resources/workflows/code-standards.yml, docs/automation.md, AGENTS.md, tests/Automation/WorkflowContextTest.php, .changelog/released-v0-channel.md	The reusable workflow takes its repository and SHA from the executing job context. CI invokes the local reusable workflow, and consumer guidance uses @v0 after release verification or a reviewed immutable commit. Context tests check the workflow guards.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~60 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant ChangelogWorkflow
  participant ReleaseChannelWorkflow
  participant UpdateScript
  participant ReleaseChannelUpdater
  participant GitHubAPI
  ChangelogWorkflow->>ReleaseChannelWorkflow: invoke with published tag and SHA
  ReleaseChannelWorkflow->>UpdateScript: pass repository, tag, and expected SHA
  UpdateScript->>ReleaseChannelUpdater: call update
  ReleaseChannelUpdater->>GitHubAPI: verify release evidence and update branch

Loading

Possibly related issues

• php-fast-forward/code-standards issue 6: The change updates the same Changelog 0.x release lifecycle by maintaining v0 from verified publications.
• php-fast-forward/dev-tools issue 238: The reusable workflow binds its checkout to the executing job’s repository and SHA.
• php-fast-forward/code-standards issue 1: The change adds 0.x release automation for the extracted code-standards package.
• php-fast-forward/dev-tools issue 379: The change adds workflow provenance and verified release-reference handling for the code-standards domain.

Merge Risk: ⚪ Minimal · up to 181ac

This change adds a guarded, released-only v0 channel and moves consumers to execution-bound workflow identity. No concrete merge-blocking issue was found. Normal checks and current-head review renewal still apply, as the author states.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the main change: maintaining a verified released v0 workflow channel.
Description check		The description is directly related to the changeset and explains the channel verification, provenance, workflow integration, testing, and merge prerequisites.
Linked Issues check		Issue #11 has coding requirements, and the reviewed changes address them. resources/workflows/code-standards.yml uses @v0. .github/workflows/code-standards-check.yml binds checkout to the execut…
Out of Scope Changes check		The changes remain within issue #11. The updater, CLI entry point, release-channel workflow, Changelog wiring, executing-workflow provenance changes, consumer guidance, policy documentation, developme…
Docstring Coverage		Docstring coverage is 94.64% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 56 functions across 6 files. (11 skipped: 1…

Full details: Linked Issues check

Explanation

Issue #11 has coding requirements, and the reviewed changes address them. resources/workflows/code-standards.yml uses @v0. .github/workflows/code-standards-check.yml binds checkout to the executing job's workflow repository and SHA. Local repository CI uses the local reusable workflow before v0 exists. .github/workflows/repository-release-channels.yml gates execution, uses Changelog publication outputs, and grants only contents write access. .github/ReleaseChannelUpdater.php verifies published stable 0.x releases, exact tag and commit identity, complete bounded catalog data, tag conflicts, monotonic updates, fast-forward state, compare-and-swap leases, pre-mutation evidence, and post-mutation readback. The added fixture and tests cover refusal, races, stale evidence, recovery, idempotence, and no real remote mutation. Documentation distinguishes GitHub v0 from Composer and CPX versions. The summary also reports passing syntax, ECS, Composer, actionlint, whitespace, and PHPUnit checks.

Full details: Out of Scope Changes check

Explanation

The changes remain within issue #11. The updater, CLI entry point, release-channel workflow, Changelog wiring, executing-workflow provenance changes, consumer guidance, policy documentation, development dependencies, and workflow tests all support the released-only v0 channel. No unrelated product behavior, release creation, tag creation, credential creation, persistent security change, or real channel mutation is reported.

Full details: Docstring Coverage

Explanation

Docstring coverage is 94.64% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 56 functions across 6 files. (11 skipped: 11 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the release tag,
Then guards the branch against a drag.
The SHA stays tied to where workflows run,
v0 moves when the checks are done.
No force, no leap, no stale reply,
The rabbit watches refs go by.}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T19:40:44.787377Z	181ac03	New commits
🔒 Security Review	✅ Completed 2026-10-21T19:43:46.383015Z	181ac03	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.