Skip to content

ocaml, yojson, dune: fix 404 provenance comment URLs - #494

Merged
bryan-minimal merged 1 commit into
mainfrom
fix-stale-provenance-comment-urls
Jul 21, 2026
Merged

ocaml, yojson, dune: fix 404 provenance comment URLs#494
bryan-minimal merged 1 commit into
mainfrom
fix-stale-provenance-comment-urls

Conversation

@bryan-minimal

Copy link
Copy Markdown
Member

The upstream-URL comment records the release each package was bumped from, not the one it ships. The filename carries the new version while the release-tag directory kept the old one — so all three URLs are dead.

Verified in both directions with curl:

package comment URL today corrected
ocaml .../download/5.3.0/ocaml-5.5.0.tar.gz404 .../download/5.5.0/...200
yojson .../download/2.2.2/yojson-3.0.0.tbz404 .../download/3.0.0/...200
dune .../download/3.20.2/dune-3.24.0.tbz404 .../download/3.24.0/...200

Impact is narrow but real

Only the comment is wrong — version, sha256 and the gs:// url are all correct, and the shipped artifacts are unaffected. The cost falls on a reviewer who follows the comment to check a bump against upstream and lands on a dead link — which is precisely the moment they need it to work.

Comment lines only. No version, sha256 or url field is touched, so nothing rebuilds.

Root cause is fixed

pkgmgr's updater rewrote the filename in these comments but not the version path segment — one line, and it existed in both the single-arch and multi-arch rewriters. Fixed in pkgmgr-rs#550, so future bumps won't reintroduce it.

Found when CodeRabbit flagged the identical defect on fontconfig in #493 (corrected there). These three were surfaced by sweeping every build.ncl for a provenance comment containing a version that disagrees with let version.

🤖 Generated with Claude Code

The upstream-URL comment records the release the package was bumped
FROM, not the one it ships:

  ocaml    .../download/5.3.0/ocaml-5.5.0.tar.gz
  yojson   .../download/2.2.2/yojson-3.0.0.tbz
  dune     .../download/3.20.2/dune-3.24.0.tbz

The filename carries the new version while the release-tag directory
kept the old one, so all three URLs 404. Verified both directions with
curl: each current URL returns 404, each corrected URL returns 200.

Only the comment is wrong — version, sha256 and the gs:// url are all
correct, and the shipped artifacts are unaffected. The cost is to a
reviewer who follows the comment to check a bump against upstream and
lands on a dead link, which is exactly when they most need it to work.

Comment lines only: no version, sha256 or url field is touched, so
nothing rebuilds.

Root cause was in pkgmgr's updater, which rewrote the filename in these
comments but not the version path segment — fixed in pkgmgr-rs#550, so
future bumps won't reintroduce this. Found when CodeRabbit flagged the
same defect on fontconfig in #493 (corrected there).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 32 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: be369bed-b0f6-4ad5-b1d4-c6a34ff66e2b

📥 Commits

Reviewing files that changed from the base of the PR and between f212266 and 16d8867.

📒 Files selected for processing (3)
  • packages/dune/build.ncl
  • packages/ocaml/build.ncl
  • packages/yojson/build.ncl
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix-stale-provenance-comment-urls

Comment @coderabbitai help to get the list of available commands.

@bryan-minimal
bryan-minimal added this pull request to the merge queue Jul 21, 2026
Merged via the queue into main with commit f12fd8c Jul 21, 2026
9 of 10 checks passed
@bryan-minimal
bryan-minimal deleted the fix-stale-provenance-comment-urls branch July 21, 2026 16:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants