fix: prevent system segments from being overwritten via change request drafts

[srijantrpth]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Closes #8269

• Added a guard clause in ChangeRequestCommitService._publish_segments (api/core/workflows_services.py) to prevent change request drafts from overwriting system segments (is_system_segment=True).

How did you test this code?

Added a new unit test (test_change_request_commit__system_segment_draft__raises_value_error) in tests/unit/features/workflows/core/test_unit_workflows_models.py to verify that attempting to commit a change request targeting a system segment correctly raises a ValueError.

[vercel]

@srijantrpth is attempting to deploy a commit to the Flagsmith Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 087822f0-a9da-45d7-b0f4-c799d9adcc46

📥 Commits

Reviewing files that changed from the base of the PR and between 14e860c and c3c40a9.

📒 Files selected for processing (2)

• api/core/workflows_services.py
• api/tests/unit/features/workflows/core/test_unit_workflows_models.py

---

📝 Walkthrough

Walkthrough

The change request commit now runs within an atomic transaction. The segment publishing workflow rejects drafts that target system segments before revision creation or live-segment updates. A unit test verifies the ValueError and confirms that feature-state and change-request updates roll back.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to c3c40

The change correctly blocks system-segment drafts, but rejection can still trigger external updates before the database transaction commits, potentially causing inconsistent downstream state. The PR should address this transaction-boundary issue and the remaining formatting check before merge.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7d4c283a-be0a-47ee-8f1c-4983a6315816

📥 Commits

Reviewing files that changed from the base of the PR and between 14e860c and 0b5ab68.

📒 Files selected for processing (2)

• api/core/workflows_services.py
• api/tests/unit/features/workflows/core/test_unit_workflows_models.py

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.62%. Comparing base (14e860c) to head (3d0b1ba).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8298      +/-   ##
==========================================
- Coverage   98.76%   98.62%   -0.15%     
==========================================
  Files        1594     1594              
  Lines       63657    63667      +10     
==========================================
- Hits        62873    62793      -80     
- Misses        784      874      +90     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3549c7b1-2004-485c-80d0-cf7dfa1ca444

📥 Commits

Reviewing files that changed from the base of the PR and between 0b5ab68 and 00269fc.

📒 Files selected for processing (2)

• api/core/workflows_services.py
• api/tests/unit/features/workflows/core/test_unit_workflows_models.py

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.