[mmou-nv]

Source and destination reads currently choose credentials by namespace. When both paths are the same, destination checks incorrectly use the source credentials.

• Select image and chart credentials by role during preflight, retries, and verification.
• Keep source and destination credentials separate even in one namespace.
• Clarify that a compatible promoter fix can retain the tested RC's publisher revision.

Validation: 78 promotion tests and all pre-commit checks passed. Tests cover distinct credentials in the same namespace and denied destination reads before any write. No live promotion was run.

Summary by CodeRabbit

• Improvements
  • Release candidate promotion now uses separate source and destination credentials, including when both use matching registry paths. Destination access is checked before publication and used to verify published images and charts.
• Documentation
  • Setup guidance now recommends pinning each shared workflow to a reviewed full commit SHA. Compatible promoter updates can be made without rebuilding the selected release candidate; its approved publisher revision remains unchanged. The destination credential must be able to read images and charts for checks.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 17d345b9-73d5-412c-9321-865f9b1a3d85

Commits

Reviewing files that changed from the base of the PR and between 803f81b and fbdd22b.

Files selected for processing: 3

• .github/actions/promote-rc/promotion.py
• .github/actions/promote-rc/tests/test_promotion.py
• docs/promote-rc.md

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

Walkthrough

Registry lookup methods now use explicit source and destination roles to select namespaces and credentials. Promotion and capture pass those roles at lookup points. Tests and setup guidance cover the role-based behavior and workflow pinning.

Changes: Registry role selection and promotion

Layer / File(s)	Summary
Role-based registry reads .github/actions/promote-rc/promotion.py, .github/actions/promote-rc/tests/test_promotion.py, docs/promote-rc.md	Image and chart reads select namespaces, credentials, and Helm repositories by role. Tests cover role validation and role-specific authentication. The credential guidance describes source and destination access.
Promotion and capture role calls .github/actions/promote-rc/promotion.py, .github/actions/promote-rc/tests/test_promotion.py, docs/promote-rc.md	Promotion and capture pass explicit roles to registry reads. Tests cover read order, destination-read failures, and source reads during capture. Setup guidance updates workflow and publisher SHA pinning.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related issues

• dsx-ai-factory/topograph issue 625: The PR updates source and destination credential selection and artifact verification during promotion, which overlaps with promotion of approved artifacts. It does not implement the full release checklist.

Suggested labels: github_actions

Suggested reviewers: frankspitulski, lachen-nv

Merge Risk: Minimal · up to fbdd2

The reviewed credential selection and promoter-pinning paths show no issue that needs to be fixed before merging.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 27 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: selecting promotion credentials by source or destination role.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 27 functions across 2 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[lachen-nv]

+1