[Mac-5]

Summary

Add PR merge regression detection with scoped permissions and deduped owner notifications

What was solved

#591 — Add failure notification routing for main and develop branch parity

Add failure notification routing to the GitHub Actions workflows so that actionable failures on main and develop branches reach the correct owner without duplicate alerts, while preserving existing behavior outside that parity scope.

Addressed:

• Changed: .github/workflows/deploy.yml, .github/workflows/release.yml, .github/CODEOWNERS
• Scope changes to .github/workflows for main and develop branch parity only; do not alter unrelated CI/deploy/release behavior.
• Route actionable workflow failures to the correct owner (e.g., via CODEOWNERS-aligned notification or failure job) for both main and develop branches.
• Avoid alert duplication — ensure a single notification per failure event rather than per-job or per-matrix-entry duplicates.

#592 — Add configuration preflight checks for pull-request merge regression detection

Add a configuration preflight validation step to the pull-request merge regression detection CI workflow so unsafe or incomplete settings are rejected before any mutation begins, while preserving existing CI behavior and keeping logs deterministic and secret-free.

Addressed:

• Changed: README.md
• Edit .github/workflows/ci.yml to add preflight configuration checks scoped to pull-request merge regression detection
• Reject unsafe or incomplete settings before any mutation starts
• Preserve existing public behavior outside pull-request merge regression detection

#593 — Add least-privilege controls for pull-request merge regression detection

Harden the pull-request merge regression detection workflow in .github/workflows/ci.yml by applying least-privilege permissions and credential scoping while preserving existing CI behavior. The change should restrict the workflow/job-level GITHUB_TOKEN permissions to the minimum needed (e.g., contents: read, with pull-requests: read only where PR metadata is required), avoid persisting credentials on checkout where not needed, and ensure any merge-regression detection step runs with only the access it requires. Logs and outputs must remain deterministic and free of secrets. Scope is limited to the CI workflow's PR merge regression detection; no changes to unrelated jobs, other workflows, or application code.

Addressed:

• Changed: README.md
• Scope changes strictly to .github/workflows/ci.yml and the pull-request merge regression detection path
• Apply least-privilege GITHUB_TOKEN permissions (default to contents: read; add pull-requests: read only if PR metadata is consumed)
• Avoid persisting credentials on checkout (persist-credentials: false) where not required

#594 — Add failure notification routing for pull-request merge regression detection

Add a pull-request merge regression detection job to the CI workflow that routes actionable failures to the correct owner (via CODEOWNERS-aware notification) without duplicating alerts, while preserving existing CI behavior. The change is scoped to .github/workflows/ci.yml, adding a regression-detection step/job that runs on pull_request merges, classifies failures, and emits deterministic, secret-free notifications only once per failure.

Addressed:

• Changed: .github/CODEOWNERS
• Scope strictly to pull-request merge regression detection in .github/workflows/ci.yml
• Preserve existing public CI behavior outside the new regression detection path
• Cover the primary success path (no regression, no notification) and at least two failure/boundary paths (regression detected -> routed to owner; duplicate failure -> suppressed)

Changes

• .github/workflows/deploy.yml (modify)
• README.md (modify)
• .github/workflows/release.yml (modify)
• .github/CODEOWNERS (modify)

Approach

1. Add failure notification routing for main and develop branch parity #591 — Add failure notification routing for main and develop branch parity (Changed: .github/workflows/deploy.yml, .github/workflows/release.yml, .github/CODEOWNERS)
2. Add configuration preflight checks for pull-request merge regression detection #592 — Add configuration preflight checks for pull-request merge regression detection (Changed: README.md)
3. Add least-privilege controls for pull-request merge regression detection #593 — Add least-privilege controls for pull-request merge regression detection (Changed: README.md)
4. Add failure notification routing for pull-request merge regression detection #594 — Add failure notification routing for pull-request merge regression detection (Changed: .github/CODEOWNERS)

Issues

Closes #591
Closes #592
Closes #593
Closes #594

[drips-wave]

@Mac-5 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits