• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
Audit trail coverage: The workflow performs critical release actions (publish and GitHub release creation) but
the diff does not show explicit, structured audit logging capturing actor, action, and
outcome beyond default GitHub Actions logs.

get-approval:
  name: Get Approval
  needs: prepare
  uses: ./.github/workflows/get-approval.yml
  with:
    title: Release approval required
    message: Approval is needed to publish ${{ needs.prepare.outputs.tag }}.
  secrets:
    SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

publish:
  name: Build and Publish ${{ matrix.language }}
  needs: get-approval
  strategy:
    fail-fast: false
    matrix:
      language: [java, py, rb, dotnet, node]
  uses: ./.github/workflows/bazel.yml
  with:
    name: Publish ${{ matrix.language }}
    gpg-sign: ${{ matrix.language == 'java' }}


 ... (clipped 43 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Limited failure context: Several critical shell/CLI operations (e.g., gh release delete, git push --delete) rely on
default step failure behavior and do not add explicit, actionable error context for edge
cases beyond silent >/dev/null checks.

- name: Delete nightly release and tag
  env:
    GH_TOKEN: ${{ secrets.SELENIUM_CI_TOKEN }}
  run: |
    if gh release view nightly >/dev/null 2>&1; then
      gh release delete nightly --yes
    fi
    if git ls-remote --tags origin refs/tags/nightly | grep -q nightly; then
      git push origin --delete refs/tags/nightly
    fi

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status:
Secrets in workflow: The workflow uses sensitive tokens via secrets/GH_TOKEN, and while they are not directly
echoed in the diff, confirming that no downstream steps or reusable workflows log
secret-derived values requires review outside this diff.

publish:
  name: Build and Publish ${{ matrix.language }}
  needs: get-approval
  strategy:
    fail-fast: false
    matrix:
      language: [java, py, rb, dotnet, node]
  uses: ./.github/workflows/bazel.yml
  with:
    name: Publish ${{ matrix.language }}
    gpg-sign: ${{ matrix.language == 'java' }}
    run: ./go ${{ matrix.language }}:release
    artifact-name: release-packages-${{ matrix.language }}
    artifact-path: build/dist/*.*
  secrets: inherit

github-release:
  name: GitHub Release
  needs: [prepare, publish]
  runs-on: ubuntu-latest
  permissions:


 ... (clipped 28 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Add omitBodyDuringUpdate: true and omitNameDuringUpdate: true to the
release-action step to prevent overwriting the release name and body on
subsequent updates.

.github/workflows/release.yml [102]

 allowUpdates: true
+omitBodyDuringUpdate: true
+omitNameDuringUpdate: true

• Apply / Chat

Guard access to github.event.pull_request.merge_commit_sha to ensure the
workflow runs correctly for non-PR triggers like workflow_dispatch.

.github/workflows/release.yml [108]

-commit: ${{ github.event.pull_request.merge_commit_sha || github.sha }}
+commit: "${{ (github.event.pull_request && github.event.pull_request.merge_commit_sha) || github.sha }}"

• Apply / Chat

Make the nightly tag deletion step idempotent by adding || true to the gh api
command to prevent workflow failure if the tag is already gone.

.github/workflows/release.yml [97]

-gh api -X DELETE /repos/${{ github.repository }}/git/refs/tags/nightly
+gh api -X DELETE /repos/${{ github.repository }}/git/refs/tags/nightly || true

• Apply / Chat

Verify that the reusable workflow bazel.yml uses the artifact-path parameter
passed in the publish job, and remove it if it is unused.

.github/workflows/release.yml [57-71]

 publish:
   name: Build and Publish ${{ matrix.language }}
   needs: get-approval
   strategy:
     fail-fast: false
     matrix:
       language: [java, py, rb, dotnet, node]
   uses: ./.github/workflows/bazel.yml
   with:
     name: Publish ${{ matrix.language }}
     gpg-sign: ${{ matrix.language == 'java' }}
     run: ./go ${{ matrix.language }}:release
     artifact-name: release-packages-${{ matrix.language }}
-    artifact-path: build/dist/*.*
   secrets: inherit

• Apply / Chat