ocaml, yojson, dune: fix 404 provenance comment URLs - #494
Conversation
The upstream-URL comment records the release the package was bumped FROM, not the one it ships: ocaml .../download/5.3.0/ocaml-5.5.0.tar.gz yojson .../download/2.2.2/yojson-3.0.0.tbz dune .../download/3.20.2/dune-3.24.0.tbz The filename carries the new version while the release-tag directory kept the old one, so all three URLs 404. Verified both directions with curl: each current URL returns 404, each corrected URL returns 200. Only the comment is wrong — version, sha256 and the gs:// url are all correct, and the shipped artifacts are unaffected. The cost is to a reviewer who follows the comment to check a bump against upstream and lands on a dead link, which is exactly when they most need it to work. Comment lines only: no version, sha256 or url field is touched, so nothing rebuilds. Root cause was in pkgmgr's updater, which rewrote the filename in these comments but not the version path segment — fixed in pkgmgr-rs#550, so future bumps won't reintroduce this. Found when CodeRabbit flagged the same defect on fontconfig in #493 (corrected there). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 32 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
The upstream-URL comment records the release each package was bumped from, not the one it ships. The filename carries the new version while the release-tag directory kept the old one — so all three URLs are dead.
Verified in both directions with
curl:.../download/5.3.0/ocaml-5.5.0.tar.gz→ 404.../download/5.5.0/...→ 200.../download/2.2.2/yojson-3.0.0.tbz→ 404.../download/3.0.0/...→ 200.../download/3.20.2/dune-3.24.0.tbz→ 404.../download/3.24.0/...→ 200Impact is narrow but real
Only the comment is wrong —
version,sha256and thegs://url are all correct, and the shipped artifacts are unaffected. The cost falls on a reviewer who follows the comment to check a bump against upstream and lands on a dead link — which is precisely the moment they need it to work.Comment lines only. No
version,sha256orurlfield is touched, so nothing rebuilds.Root cause is fixed
pkgmgr's updater rewrote the filename in these comments but not the version path segment — one line, and it existed in both the single-arch and multi-arch rewriters. Fixed in pkgmgr-rs#550, so future bumps won't reintroduce it.
Found when CodeRabbit flagged the identical defect on fontconfig in #493 (corrected there). These three were surfaced by sweeping every
build.nclfor a provenance comment containing a version that disagrees withlet version.🤖 Generated with Claude Code