[vitali87]

Summary

• Main is red: fixed. fix(sql): one statement the grammar cannot read costs only that statement #3254 and fix(sql): routines are dead-code roots, and DDL that names one calls it #3251 merged two minutes apart, each green on its own base. fix(sql): one statement the grammar cannot read costs only that statement #3254's statement-isolated re-parse blanks every SQL statement the grammar cannot read, and the tree's text is that blanked copy. fix(sql): routines are dead-code roots, and DDL that names one calls it #3251's DDL scan read root_node.text, so the CREATE AGGREGATE / CAST / OPERATOR / EVENT TRIGGER / FDW clauses it looks for were gone. 12 tests in test_sql_ddl_routine_references.py failed on every unit shard 1/2 and in SonarCloud's copy of the suite.
  • The definition processor keeps the exact bytes each recovered SQL tree was parsed from (sql_sources), and _load_ast_from_disk replaces them when it reloads an evicted tree. The bytes always belong to the tree the call pass walks.
  • The call pass cuts the root's span from those bytes and reads no file. The copy keeps every offset, so the sites line up. An edit mid-sync can't mix new DDL with the old tree. A file that starts with a blank line or comment still works, because the root starts after it.
  • A SQL file is read once, before its parse.
• Nothing ships a red commit. Only version-bump.yml checked CI, before the tag it pushes. publish.yml (PyPI), docker-publish.yml (GHCR) and the release uploads in build-binaries.yml also run on a hand-pushed tag, a hand-created release and a dispatch, with no check. make release had none either. v0.3.10 and v0.3.11 tag today's red main, so a release created on either would have shipped it. New scripts/require_green_ci.py runs in each of them against the commit being shipped, and fails closed:
  • passes only when CI's push run on main at that commit concluded success;
  • a version bump whose own run has not finished passes on its parent's green run. That holds only when it changes nothing but what version-bump.yml commits: code-graph-rag's version lines in pyproject.toml, uv.lock and server.json, the release's NEWS.md and README.md, or nothing at all (a hand-set version);
  • every later job in publish.yml waits for it.

Demo

No user-visible change: the SQL commits restore DDL edges the tests already assert, and the release commits change release workflows only.

Type of Change

• Bug fix
• New feature
• Performance improvement
• Refactoring (no functional changes)
• Documentation
• CI/CD or tooling
• Dependencies

Related Issues

Related to #3251 and #3254 (their combination turned main red). #3447 fixes the same SQL breakage with a file re-read; only one of the two SQL fixes should land.

Test Plan

• Unit tests pass: full pytest -n auto -m "not integration" locally on the final head gives 23,576 passed. 4 tests failed only because this machine has Go 1.24.7 (CI installs >=1.27.2) and no .NET SDK; all 4 are green in CI.

• New tests added

• Integration tests pass (make test-integration, requires Docker)

• Manual testing (describe below)

• SQL fix: the 12 failures reproduced on main exactly as CI shows them, and are green with the fix. New tests, each mutation-checked (each fails when its guard is removed):

  • test_ddl_edited_after_the_parse_is_not_read_against_the_old_tree, which edits wiring.sql between the passes three ways: shorter, same length, and same length inside a blanked statement only;
  • test_an_evicted_tree_reloaded_from_an_edited_file_reads_the_reload, with a one-entry AST cache;
  • test_ddl_after_a_leading_blank_line_and_comment_references_its_routine.

• Release gate: test_require_green_ci.py, 44 tests:

  • the verdicts, using the real v0.3.11 bump patch as the fixture. Today's v0.3.11 is refused; a fresh bump of a green commit passes, with or without its news, and so does an empty bump; a dependency version line in uv.lock is not a bump; foreign runs (another workflow, branch, event or fork) are not evidence; an incomplete reply refuses.
  • wiring: any workflow that uses a publishing action must run the gate; the files the gate admits must cover the git add line in version-bump.yml; every publish.yml job needs the gate and checks out the release tag, never a job output (CodeQL reads that as cache poisoning); Docker gates before pushing; binaries need it on tags; release.sh asks before twine upload.
  • mutation checks, each caught: Docker gate removed, uv.lock name check disabled, own-run failure ignored, a publish.yml checkout ref changed, news files refused, the empty bump refused.

• ruff, ruff format, ty, check-yaml clean.

Settings this cannot cover (repository/PyPI settings, owner's call):

• A tag created before this merges still carries the old, ungated workflows. Renaming the PyPI trusted publisher's environment (and the one line here) cuts those off from PyPI.
• A PyPI API token can upload with no check at all.
• To stop an edited workflow on a branch, or a tag moved mid-run, from publishing: restrict the pypi environment to v* tags, and add a v* tag ruleset.

Checklist

• PR title follows Conventional Commits format
• A breaking change has ! in the title and its release notes in changes/breaking/<PR number>.md (see Breaking changes)
• All pre-commit checks pass (make pre-commit): ruff, ruff format, ty, check-yaml run on the changed files
• No hardcoded strings in non-config/non-constants files
• No # type: ignore, cast(), Any, or object type hints: the gate script and its test type GitHub's JSON replies as Any and check object values with isinstance
• New comments and docstrings explain why, not what (see Comment Policy)

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y4AFQuVg5X5cRio73QgHXV

Summary by CodeRabbit

• Release Reliability

  • Versioned builds, package and Docker publishing, and release scripts now require verified successful CI before proceeding. Eligible version-only updates may rely on the prior commit’s successful CI when the new run is pending or missing.

• Bug Fixes

  • Improved SQL routine reference detection when source files change after parsing or are reloaded, including files with leading comments or blank lines.

[greptile-apps]

TREX

Tested 1 flow, found no issues.

What we tested

• Pass · Find SQL routines called by DDL · View ↗

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T12:00:47.441978Z	98c2989	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 993c0d6
• Latest commit, not reviewed: 4ced53c

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: vitali87/code-graph-rag
• Branch: claude/stoic-pascal-oeon7h
• File: .coderabbit.yaml
• Commit: 993c0d6
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Advanced
• Run ID: 53598401-d384-42ba-8e5f-b3066970ccad

Commits

Reviewing files that changed from the base of the PR and between 81006bc and 993c0d6.

Files selected for processing: 1

• codebase_rag/parsers/definition_processor.py

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

Walkthrough

The pull request adds a CI verdict script and invokes it from release workflows and the release script. It also retains SQL source bytes when parsing changes the source text and uses those bytes when scanning SQL DDL routine references.

Changes: Green-CI shipping gate

Layer / File(s)	Summary
CI evidence and version-bump verdict scripts/require_green_ci.py	The script checks for a successful matching CI run on a main push. For pending or missing CI, it permits a qualifying single-parent version bump only when the parent’s CI succeeded.
CLI and API handling scripts/require_green_ci.py	The CLI validates its ref, reports the verdict, and returns an exit code. GitHub API requests retry server errors and network failures up to three times.
Release-path gating and tests .github/workflows/build-binaries.yml, .github/workflows/docker-publish.yml, .github/workflows/publish.yml, scripts/release.sh, codebase_rag/tests/test_require_green_ci.py	The release workflows and release script run the gate before shipping steps. Tests cover verdicts, version-bump qualification, CLI results, and workflow wiring.

SQL DDL source scanning

Layer / File(s)	Summary
Source retention and DDL scanning codebase_rag/parsers/definition_processor.py, codebase_rag/graph_updater.py, codebase_rag/parsers/factory.py, codebase_rag/parsers/call_processor.py, codebase_rag/tests/test_sql_ddl_routine_references.py	SQL processing retains source bytes when parsed text differs from the source slice. DDL scanning uses the retained bytes when available and falls back to the parsed root text otherwise. Tests cover edits between parsing and scanning, leading whitespace and comments, and cache eviction.

Priority: Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant require_green_ci.py
  participant GitHubAPI
  participant PublishJobs
  ReleaseWorkflow->>require_green_ci.py: pass tag or commit SHA
  require_green_ci.py->>GitHubAPI: resolve commit and query matching CI runs
  GitHubAPI-->>require_green_ci.py: return commit, run status, and changed-file data
  require_green_ci.py-->>ReleaseWorkflow: return gate verdict
  ReleaseWorkflow->>PublishJobs: run jobs after gate success

Loading

Possibly related PRs

• vitali87/code-graph-rag#3439: Changes the SQL source used for DDL routine references, which is also changed here.
• vitali87/code-graph-rag#3447: Changes the same SQL DDL source helper and covers related fallback cases.
• vitali87/code-graph-rag#3254: Adds SQL statement blanking and a lost-function warning in code paths changed here.

Suggested labels: bug

Suggested reviewers: claude

Merge Risk: Minimal · up to 993c0

No actionable issue is established; the change is mergeable after normal checks.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly describes both the SQL repair and the new CI release gate. It is concise and uses Conventional Commits format.
Description check		The description follows the required template and provides a clear summary, change classification, related issues, test results, validation details, checklist status, and deployment limitations.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 98c2989c89

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no new blocking issues were found.

Summary

The PR restores SQL routine references and adds CI checks before publishing releases.

• SQL routine links use the source bytes parsed for each tree.
• Release uploads wait for successful CI on the commit being shipped.

_{Reviews (3) · Last reviewed commit: "fix(sql): scan the whole file a recovere..." · Reviewed by Greptile}

[coderabbitai]

🔇 Additional comments: 1

codebase_rag/parsers/sql_recovery.py-165-167: 1

165-167: Major · Data Integrity & Integration · Quick win

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Compare against the original source bytes before reading current DDL.

If recovery blanked a statement, a same-length edit anywhere in that statement can pass is_parsed_from: each parsed space accepts any source byte except newline. For example, changing only _WIRING’s SFUNC = first_sfunc, to SFUNC = first_fin , can make CallProcessor._sql_source_as_written scan the edited DDL against the old tree and emit an incorrect routine edge. The same check also accepts edits to an underscore in an otherwise unchanged tree. Retain the original grammar bytes from parsing and compare them exactly with the current file before using it. The same-length test in codebase_rag/tests/test_sql_ddl_routine_references.py also changes CREATE TABLE, so it does not isolate an edit within the blanked statement. As per path instructions: “Only comment on critical, major, or high-severity issues: logic errors, security vulnerabilities, race conditions, data loss or corruption, and breaking API changes.”

Source: Path instructions

---

Review info

Run configuration

• Source mode: Auto
• Repository: vitali87/code-graph-rag
• Branch: claude/stoic-pascal-oeon7h
• File: .coderabbit.yaml
• Commit: 491b1e3
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Advanced
• Run ID: 5fe895ae-7282-4a6c-997a-28e5642f0aa1

Commits

Reviewing files that changed from the base of the PR and between 98c2989 and 491b1e3.

Files selected for processing: 7

• .github/workflows/publish.yml
• codebase_rag/parsers/call_processor.py
• codebase_rag/parsers/sql_recovery.py
• codebase_rag/tests/test_require_green_ci.py
• codebase_rag/tests/test_sql_ddl_routine_references.py
• codebase_rag/tests/test_sql_statement_isolation.py
• scripts/require_green_ci.py

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 5 remain after this review.

[vitali87]

@coderabbitai Your sql_recovery.py finding (a same-length edit inside a blanked statement, or to a real _, passing is_parsed_from) was right. It's fixed in 81006bc by keeping the parsed bytes and comparing nothing. While checking it I found one more bug of mine: the check compared the whole file with the root's text, which starts after any leading blank line or comment. It's fixed in the same commit, which now cuts by the root's span. New tests:

• same-length-inside-a-blanked-statement
• test_ddl_after_a_leading_blank_line_and_comment_references_its_routine
• test_an_evicted_tree_reloaded_from_an_edited_file_reads_the_reload

Each fails without its fix.

---

Generated by Claude Code

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
git show --stat --oneline 81006bcb
fd -t f 'sql_recovery\.py$'
ast-grep outline codebase_rag/parsers/definition_processor.py --match 'keep_sql_source|process_file' --view expanded
ast-grep outline codebase_rag/parsers/call_processor.py --match 'sql|ddl' --view expanded
rg -n -C 5 'sql_sources|keep_sql_source|root_node.start_byte|root_node.end_byte' codebase_rag/parsers/definition_processor.py codebase_rag/parsers/call_processor.py codebase_rag/graph_updater.py codebase_rag/parsers/factory.py
rg -n -C 7 'same-length-inside-a-blanked-statement|test_ddl_after_a_leading_blank_line_and_comment_references_its_routine|test_an_evicted_tree_reloaded_from_an_edited_file_reads_the_reload' codebase_rag/tests/test_sql_ddl_routine_references.py

Length of output: 14214

---

🏁 Script executed:

#!/bin/bash
ast-grep outline codebase_rag/parsers/sql_recovery.py
cat -n codebase_rag/parsers/sql_recovery.py
sed -n '325,420p' codebase_rag/tests/test_sql_ddl_routine_references.py
git show 81006bcb -- codebase_rag/parsers/sql_recovery.py

Length of output: 23029

---

@vitali87 Thanks for fixing this in 81006bcb. The inspected code addresses the original finding:

• is_parsed_from is removed.
• DDL scanning uses retained parse-time bytes, sliced to the root node’s byte span.
• Reloading an evicted SQL tree refreshes the retained bytes.

The three regression cases cover same-length edits in blanked statements, leading whitespace and comments, and edited-file reloads. I inspected the test assertions but did not run the tests.

---

📝 I couldn't check this conversation for new learnings, so no new learning was saved.

---

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!

_{You are interacting with an AI system.}

[vitali87]

@greptile review

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[vitali87]

@greptile review