fix(release): select manifest commit across merged histories

[jsell-rh]

A Snapshot can contain two sibling component commits and a third commit that contains both. The publisher previously rejected this valid set when SHA sorting put the siblings first. Check each Snapshot commit against all component revisions and select the commit that contains them all. Fail if no such Snapshot commit exists, and propagate Git errors instead of treating them as ancestry results.

Update the embedded pipeline and document the rule. Keep the manifest revision tied to the Snapshot rather than the moving head of main.

Validation: all 22 publisher tests passed. The new real-Git regression test checks all six candidate orders; it fails with the old implementation in two orders. Tests also cover a missing common descendant and Git command errors. Repository policy checks run through the commit and push hooks.

Addresses the revision-selection and documentation findings in #297 (review).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 6f19b1de-47b6-4a88-a36b-66b22d6184f7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[amber-review-bot]

Amber review

Status: Complete

View the submitted review.

[amber-review-bot]

Verdict

APPROVE. The manifest-commit selection now correctly handles sibling component commits plus a common-descendant commit regardless of SHA sort order, and the change is backed by permutation and Git-error regression tests.

Amber Analysis

This fix replaces the fragile pairwise selected-walk with an "elect the one commit that contains every component revision" search, which is the correct invariant for a merged-history Snapshot. Because mutual ancestry in a DAG implies identity, at most one distinct candidate can contain all revisions, so the selection is deterministic and independent of sorted() order, and Git errors (returncode != 1) now propagate instead of masquerading as a missing ancestor.

Full Analysis

Verified behavior of manifest_source (scripts/release_bundle.py:124-149, mirrored in pipelines/release-bundle/pipeline.yaml):

• Linear chain A->B: A is rejected (B not ancestor of A), B elected. Newest-commit invariant holds.
• Siblings X, Y + merge M: only M contains all three; M elected in every candidate order.
• No common descendant: inner loop always breaks, selected stays None, and require(...) raises ValueError("No Snapshot component commit contains all component revisions") - a clean, actionable failure rather than an opaque git non-zero exit.
• Git failures: only returncode 1 is treated as "not an ancestor"; any other returncode re-raises, matching git merge-base --is-ancestor semantics (0 true / 1 false / other error).

Tests: test_common_descendant_is_selected_in_every_candidate_order forces all six permutations via a patched module-level sorted, proving order-independence; test_git_errors_are_not_treated_as_missing_ancestors proves error propagation; the existing divergent-history test was tightened from a bare CalledProcessError to the specific ValueError message, which is a strictly stronger assertion (no lost guarantee). All 22 publisher tests pass locally, and the embedded pipeline copy stays in sync (test_embedded_publisher_matches_source). README documents the sibling/common-descendant rule and the SHA-order independence. No secrets, no panic/em-dash concerns; this is release tooling only.

Cross-PR coordination

No material cross-PR coordination issue requires maintainer action.

Previous concerns

No prior Amber findings exist for this pull request, so there is nothing to re-verify.

Findings Summary (ordered by severity, highest first):

No findings.

Convention Checklist:

Convention	Result
Errors propagated, not silently swallowed	Pass
No panic() / clean failure on invalid state	Pass
Test diff scrutiny (tightened assertion is stronger, not a lost guarantee)	Pass
Embedded pipeline copy matches source script	Pass
No em dashes in changed text files	Pass
Conventional commit message	Pass