[PR #9] [MERGED] Fix launch readiness automation #1804

New issue

Closed

opened 2026-10-16 21:11:12 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:11:12 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/9
Author: @morluto
Created: 7/12/2026
Status: ✅ Merged
Merged: 7/12/2026
Merged by: @morluto

Base: main ← Head: codex/fix-launch-readiness

📝 Commits (1)

6e1d9a5 Fix launch readiness automation

📊 Changes

6 files changed (+22 additions, -14 deletions)

View changed files

📝 .github/workflows/ci.yml (+1 -1)
📝 .github/workflows/release.yml (+5 -7)
➕ .release-please-manifest.json (+3 -0)
📝 SECURITY.md (+1 -1)
📝 tests/integration/configIntegration.test.ts (+5 -1)
📝 tests/integration/serverIntegration.test.ts (+7 -4)

📄 Description

Summary

Fix the launch-readiness failures currently reported by GitHub Actions and align automated npm publishing with tokenless trusted publishing.

The CI test job invoked Vitest directly, bypassing the package's pretest build and leaving runtime tests without dist/main.js. It now runs npm test with the same JUnit reporters so the production entrypoint is built first. Two integration tests are formatted to satisfy the repository-wide Prettier check.

Release Please now has an initial 0.1.0 manifest. The publish job uses Node 24 and current setup actions, disables release-build package caching, and relies on npm OIDC instead of a nonexistent long-lived NPM_TOKEN. GitHub private vulnerability reporting is enabled, and the security policy points reporters directly to it.

Verification

npm run check — 114 tests and coverage thresholds passed
Exact CI test command with JUnit output passed
npm run verify:package — CLI, setup transactions, and 42-tool MCP inventory passed
Private vulnerability reporting API reports enabled
npm trusted-publisher setup initiated for morluto/rea, release.yml, publish permission; passkey confirmation pending

Real Hopper verification was not repeated because these changes affect CI/release automation and test formatting, not the Hopper runtime.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/9 **Author:** [@morluto](https://github.com/morluto) **Created:** 7/12/2026 **Status:** ✅ Merged **Merged:** 7/12/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/fix-launch-readiness` --- ### 📝 Commits (1) - [`6e1d9a5`](https://github.com/morluto/rea/commit/6e1d9a53e05b04305ee1a4cb3257eeb8ea48e85f) Fix launch readiness automation ### 📊 Changes **6 files changed** (+22 additions, -14 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+1 -1) 📝 `.github/workflows/release.yml` (+5 -7) ➕ `.release-please-manifest.json` (+3 -0) 📝 `SECURITY.md` (+1 -1) 📝 `tests/integration/configIntegration.test.ts` (+5 -1) 📝 `tests/integration/serverIntegration.test.ts` (+7 -4) </details> ### 📄 Description ## Summary Fix the launch-readiness failures currently reported by GitHub Actions and align automated npm publishing with tokenless trusted publishing. The CI test job invoked Vitest directly, bypassing the package's `pretest` build and leaving runtime tests without `dist/main.js`. It now runs `npm test` with the same JUnit reporters so the production entrypoint is built first. Two integration tests are formatted to satisfy the repository-wide Prettier check. Release Please now has an initial `0.1.0` manifest. The publish job uses Node 24 and current setup actions, disables release-build package caching, and relies on npm OIDC instead of a nonexistent long-lived `NPM_TOKEN`. GitHub private vulnerability reporting is enabled, and the security policy points reporters directly to it. ## Verification - `npm run check` — 114 tests and coverage thresholds passed - Exact CI test command with JUnit output passed - `npm run verify:package` — CLI, setup transactions, and 42-tool MCP inventory passed - Private vulnerability reporting API reports enabled - npm trusted-publisher setup initiated for `morluto/rea`, `release.yml`, publish permission; passkey confirmation pending Real Hopper verification was not repeated because these changes affect CI/release automation and test formatting, not the Hopper runtime. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:11:12 +00:00