fix(release): classify merge message subject only

[kattsushi]

Closes #233

Type

• Bug fix
• New feature
• Documentation only
• Code refactoring
• Maintenance/tooling
• Breaking change

Summary

• Classify release-message tokens from the first-line merge subject instead of the full multiline merge message.
• Preserve fail-closed behavior for real release-token subjects and structural beta transitions.
• Add the exact PR chore(release): promote protected beta orchestration #232 merge-message regression and an adverse mutation restoring the faulty full-message check.

Root cause

Release Beta run 33145998054 received this full merge message:

Merge pull request #232 from devx-op/dev

chore(release): promote protected beta orchestration

The old resolver matched chore(release): in the body and exited before producing zero-project outputs.

Changes

File	Change
.github/workflows/cd.yml	Extract HEAD_SUBJECT and apply only message-token guards to the first line.
scripts/release-policy-contract.test.mjs	Add subject/body regression fixtures and fail-closed mutation coverage.

Test plan

• node --test scripts/release-policy-contract.test.mjs — 15/15 passed.
• Mutation from HEAD_SUBJECT back to HEAD_MESSAGE fails four policy tests.
• Exact e4e2604...88b8907 resolver reproduction now outputs mode=prepare, has_projects=false, projects=.
• Actual subject token and BETA_TRANSITIONS=1 remain fail closed.
• YAML, affected lint, formatting, and diff checks pass.
• Independent verification found no blockers.

Contributor checklist

• Linked approved issue fix(release): classify merge message subject only #233.
• Added exactly one type:* label: type:bug.
• Exactly two files and 32 additions plus deletions.
• Conventional commit with no Co-Authored-By trailer.
• No workflow dispatch, ref/tag, GitHub Release, or npm publication occurred.

Summary by CodeRabbit

• Bug Fixes
  • Improved beta release policy checks to evaluate only the first line of commit messages.
  • Release markers in commit message bodies no longer incorrectly trigger release suppression or refusal.
  • Added coverage to verify correct handling of release markers in subjects versus message bodies.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 603ee0c3-0218-4064-b006-ba1145079b77

📥 Commits

Reviewing files that changed from the base of the PR and between 88b8907 and 1d1b8a3.

📒 Files selected for processing (2)

• .github/workflows/cd.yml
• scripts/release-policy-contract.test.mjs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The beta release workflow now derives the commit subject from the first line of HEAD_MESSAGE. Release markers are checked against that subject. Contract tests cover subject-only classification and reject full-message matching.

Changes

Beta release policy

Layer / File(s)	Summary
Subject-only release guard .github/workflows/cd.yml	The release-beta job derives HEAD_SUBJECT from the first line of HEAD_MESSAGE and checks release markers against it.
Subject classification contract and regression coverage scripts/release-policy-contract.test.mjs	The contract uses a shared subject guard, validates resolver structure, tests body-only token handling, and adds a mutation for full-message matching.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 1d1b8

The release workflow now classifies release markers from the merge subject while preserving structural suppression and fail-closed behavior; no actionable merge-blocking risk remains after normal checks and review.

Poem

A rabbit reads the subject line
Body markers stay behind
Beta guards now choose with care
Release tokens must be there
Tests hop softly, bright and fair

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: classifying only the merge-message subject for release policy checks.
Linked Issues check	✅ Passed	The changes satisfy issue #233 by deriving HEAD_SUBJECT from the first line of HEAD_MESSAGE, applying release-token guards to the subject, and adding regression and mutation coverage. The changes pres…
Out of Scope Changes check	✅ Passed	The changes are limited to the two files approved by issue #233. They address subject-only release classification and its contract tests without changing unrelated release behavior.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…

Full details: Linked Issues check

Explanation

The changes satisfy issue #233 by deriving HEAD_SUBJECT from the first line of HEAD_MESSAGE, applying release-token guards to the subject, and adding regression and mutation coverage. The changes preserve structural beta-transition detection and existing release behavior.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/release-merge-subject

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}