[doringeman]

The v1.2.9 release failed before dispatching the Desktop CLI workflow because it still used CLI_RELEASE_PAT. The ARM64 CPU image also failed because Mesa 26.0.8 already contains the changes from the first Venus patch.

Generate repository-scoped GitHub App tokens separately for Desktop, packaging, and deployment. Poll workflow run metadata with Actions permission instead of using gh run watch, which also requires Checks access. Bound waits below the installation token lifetime and preserve API error output.

Check Mesa patches in both directions: apply missing patches, skip confirmed already-applied patches, and fail on incompatible or partially applied patches.

Validation:

• make validate-all passed, including module tidiness, lint, race tests, ShellCheck, and version consistency.
• Actionlint passed excluding pre-existing SC2129 style warnings.
• Tested patches against Mesa 26.0.8 in Ubuntu with GNU patch: initial application, repeated application, missing first patch, and incompatible/partially applied patch rejection.
• Tested downstream polling for success, failure, cancellation, timeout, and API failure.

Before running the updated workflow, configure repository variable CLI_RELEASE_APP_ID (4302285) and secret CLI_RELEASE_APP_PRIVATE_KEY. The app installation needs access to inference-engine-llama.cpp, packaging, and release-repo, with Actions read/write. A full release build has not been run. Start a new release run after merging; rerunning the original run retains its old workflow revision.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path=".github/workflows/release.yml" line_range="543" />
<code_context>
             --repo docker/inference-engine-llama.cpp \
             --workflow release-cli-dd.yml \
-            --limit 1 --json databaseId --jq '.[0].databaseId // 0' 2>/dev/null || echo "")
+            --limit 1 --json databaseId --jq '.[0].databaseId // 0' || echo "")
           case "$BEFORE_ID" in
             ''|*[!0-9]*)
</code_context>
<issue_to_address>
**Wrong release run is selected**

When another dispatch of the same downstream workflow occurs before the first run-list poll, `RUN_ID` can identify that other dispatch, so the Desktop job reports success without waiting for this release or packaging publishes the other run’s image as this release’s output.

Correlate the downstream run with this release’s dispatch instead of selecting the newest run ID greater than `BEFORE_ID`.

Also at `.github/workflows/release.yml:567`, `.github/workflows/release.yml:591`, `.github/workflows/release.yml:696`.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[sourcery-ai]

🟡 Medium · Wrong release run is selected

When another dispatch of the same downstream workflow occurs before the first run-list poll, RUN_ID can identify that other dispatch, so the Desktop job reports success without waiting for this release or packaging publishes the other run’s image as this release’s output.

Correlate the downstream run with this release’s dispatch instead of selecting the newest run ID greater than BEFORE_ID.

Also at .github/workflows/release.yml:567, .github/workflows/release.yml:591, .github/workflows/release.yml:696.

Prompt for AI agents

In `.github/workflows/release.yml` at line 543:

**Wrong release run is selected**

When another dispatch of the same downstream workflow occurs before the first run-list poll, `RUN_ID` can identify that other dispatch, so the Desktop job reports success without waiting for this release or packaging publishes the other run’s image as this release’s output.

Correlate the downstream run with this release’s dispatch instead of selecting the newest run ID greater than `BEFORE_ID`.

Also at `.github/workflows/release.yml:567`, `.github/workflows/release.yml:591`, `.github/workflows/release.yml:696`.