[tulayha]

Related issue

Maintainer-requested release contributor attribution; no linked issue.

Summary

Published beta and stable GitHub releases now include GitHub-generated PR author credits and its optional New Contributors section in an expandable section below the existing product changelog. Release Please continues to own versioning and changelog selection. This is internal release automation with visible release-page attribution; no application API, storage, or index migration changes.

The candidate records the previous tag from the appropriate channel manifest at the release PR's base commit, before the version bump. Publication verifies that tag and uses the explicit range with GitHub's generate-notes endpoint. .github/release.yml excludes the release bot while retaining human contributions. Rendering retries replace the attribution block without duplicating it or losing the product changelog.

GitHub supplies PR-based attribution, not comprehensive reviewer or coauthor accounting. A first contribution can appear in both beta and stable notes. Note generation failures stop the GitHub publication step; package/container publication may already have completed. Nightly releases are unchanged. Existing candidate artifacts without previous_tag must be regenerated.

Beta desktop builds find the runtime wheel again

Broken: every release-candidate run since 28 Aug has failed (15 in a row, latest https://github.com/grayhatdevelopers/vidxp/actions/runs/34843505201), so no beta has shipped since v0.4.0-b.3 on 5 Aug. All three desktop jobs stop in the build script with Desktop requires exactly one vidxp 1.0.0-b wheel in ../../dist; found 0.

Why: desktop/src-tauri/build.rs turned the manifest version into a wheel name with replace("-b.", "b").replace("-b", "b"), so the Release Please PR's 1.0.0-b became vidxp-1.0.0b-, while Python normalizes 1.0.0-b to 1.0.0b0 (PEP 440). PR builds never hit it because main carries 0.4.0; only the release PR carries 1.0.0-b.

Changed: the mapping moved into desktop/src-tauri/src/wheel_version.rs, shared by the build script and the crate's tests, and handles every shape Release Please writes here: X.Y.Z, X.Y.Z-b (to X.Y.Zb0) and X.Y.Z-b.N (to X.Y.ZbN). Any other shape now stops the build with a message naming the version instead of "found 0". Installer names were checked and need no change: Tauri, desktop/scripts/build-desktop.mjs and release-to-pypi.yml all use the Release Please version unchanged.

PRs build desktop installers only when their inputs change

Broken: PR CI built the three installers (Windows about 20 min, macOS 15, Linux 12) for almost every PR, because any change under src/, tests/, utils/ or any workflow counted as a desktop change.

Why it's safe to narrow: release candidates already build and sign the installers after every merge to main (release-please.yml dispatches release-candidate.yml). The desktop catalog drift check that reads src/ is also covered by the Python suite (tests/test_local_probe.py, tests/test_packaging.py).

Changed: utils/ci_scope.py now builds installers on PRs only for desktop/, plugins/, pyproject.toml, uv.lock, MANIFEST.in, setup.py, LICENSE, ci.yml, desktop.yml, and the utils/ files the desktop build runs (build-requirements.txt, build_package.sh and the two scripts it calls, fix_readme_links.py and normalize_sdist.py). Unknown product paths, premiere/ included, still build installers.

PR titles are checked

Broken: squash merges make the PR title the commit on main, and Release Please builds the changelog and version from it. Five PRs since July landed without a Conventional Commit title and were left out of the changelog; one was a user-facing feature, "Show media state in list command (#112)".

Changed: a new PR title workflow with one pr-title job runs on PRs to main and release (opened, edited, synchronize, reopened). It runs utils/pr_title.py, which accepts the types in docs/CONTRIBUTING.md with an optional scope and !, and fails with what is wrong plus the guide's examples. The title reaches the script through an environment variable. No third-party action, and no other job depends on it. Dependabot (build(deps): ...) and Release Please (chore(main): release ...) titles pass. docs/CONTRIBUTING.md now says the check enforces the title.

Validation

Repeated after applying to fresh main:

• PYTHONPATH=src /Users/grayhat/Developer/vidxp/.venv/bin/python -m pytest -q tests/test_release_notes.py — 6 passed, covering preservation/replacement on retries, notes without newcomers, and empty-note rejection.
• /Users/grayhat/Developer/vidxp/.venv/bin/ruff check utils/render_release_notes.py tests/test_release_notes.py — passed.
• /private/tmp/vidxp-ci-actionlint/actionlint -shellcheck= -pyflakes= .github/workflows/release-candidate.yml .github/workflows/release-to-pypi.yml — passed using Actionlint 1.7.12; optional ShellCheck/Pyflakes integrations disabled.
• /opt/homebrew/bin/git diff --check — passed.

During local implementation, exercised the tag-selection shell against a temporary real Git repository: beta/stable manifest selection, pre-bump base selection despite a bumped head, and missing-tag rejection passed. Previewed real GitHub generate-notes responses without publishing a release.

No application builds, full Python suite, or live release publication were run. Markdownlint and Lychee were not run locally; documentation validation is left to CI.

For the three added fixes, on Linux with Python 3.12 and uv sync --frozen --extra test:

• uv run --no-sync python -m pytest -q tests/test_ci_scope.py tests/test_pr_title.py — 16 passed, 59 subtests passed. The updated tests/test_ci_scope.py failed 11 subtests against the old rule; tests/test_pr_title.py failed to import before the script existed.
• uvx --from 'ruff~=0.16.1' ruff check . — passed (the pinned version from utils/build-requirements.txt).
• bash utils/check_workflows.sh — actionlint 1.7.12 passed; the script then stopped at shellcheck: command not found, so ShellCheck (and actionlint's ShellCheck pass over run: blocks) did not run locally.
• The wheel-version mapping was checked against packaging.version.Version for 0.4.0, 1.0.0-b, 0.4.0-b.3 and 1.0.0-b.12. The Rust change was not compiled locally (no Rust toolchain); it compiles and its tests run only in CI's "Test the locked desktop crate" step. The fix is proven end to end only when the next release candidate builds after merge.

[greptile-apps]

Heads up: Greptile reviewed this. Push back if it's wrong — it has no feelings.

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Adds GitHub-generated contributor credits below the existing product changelog for beta and stable releases.

• Beta and stable release pages show GitHub contributor notes.

No actionable issues were found. This review inspected the code and tests; it did not run tests or publish a release.

Acknowledged limitations:

• tulayha documents that empty notes stop publication and that package and container publication may already have completed.
• tulayha states that older candidate artifacts without previous_tag must be regenerated.
• tulayha limits attribution to GitHub’s PR-based credits, not comprehensive reviewer or coauthor accounting.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Verified release PR base] --> B[Read channel manifest]
  B --> C[Check previous tag exists and is an ancestor]
  C --> D[Record previous tag in candidate]
  D --> E[Match candidate to release tree]
  E --> F[Recheck previous tag]
  F --> G[Publish package and containers]
  G --> H[Generate GitHub notes for explicit tag range]
  H --> I[Preserve product changelog and replace credits]
  I --> J[Upload assets and publish GitHub release]

Loading

_{Reviews (1) · Last reviewed commit: "Merge branch 'main' into codex/release-c..." · Reviewed by Greptile}