[PR #309] [MERGED] fix(ci): retry published package verification #1945

New issue

Closed

opened 2026-10-16 21:12:45 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:12:45 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/309
Author: @morluto
Created: 7/18/2026
Status: ✅ Merged
Merged: 7/18/2026
Merged by: @morluto

Base: main ← Head: codex/retry-published-package-verification

📝 Commits (1)

c379455 fix(ci): retry published package verification

📊 Changes

2 files changed (+39 additions, -12 deletions)

View changed files

📝 .github/workflows/release.yml (+9 -6)
📝 scripts/verify-published-package.mjs (+30 -6)

📄 Description

Summary

The 2.1.0 npm release published successfully, but the release workflow failed during its post-publish verification. This change makes that verification resilient to npm registry propagation and aligns the MCP canary with REA's capability-scoped tool advertisement contract.

Root cause

The workflow retried only npm view. Once package metadata became visible, Bash -e caused the first transient rea: not found result to abort the job instead of retrying. After propagation completed, the MCP canary also expected all 95 canonical tools even though a target-free installed package may advertise only the tools available in its current provider and permission context.

Fix

Retry the registry check, both CLI probes, and the MCP canary as one verification attempt.
Use explicit npm exec --package=... -- rea invocation syntax.
Validate that the published MCP projection is nonempty, duplicate-free, and contains only canonical tool names.
Retain the live target-free binary_session call to prove the published server is operational.

Verification

npm run lint
npm run typecheck
npm run format:check
npx vitest run tests/packageInstallWorkflow.test.ts --coverage.enabled=false
npm run build
npm run verify:published -- 2.1.0
Published rea --help and rea --llms probes from an empty temporary directory

The live published canary reports 78 currently advertised tools, all drawn from the 95-tool canonical catalog.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/309 **Author:** [@morluto](https://github.com/morluto) **Created:** 7/18/2026 **Status:** ✅ Merged **Merged:** 7/18/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/retry-published-package-verification` --- ### 📝 Commits (1) - [`c379455`](https://github.com/morluto/rea/commit/c379455da7b32069c861addfbf8d19bb432ddb84) fix(ci): retry published package verification ### 📊 Changes **2 files changed** (+39 additions, -12 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/release.yml` (+9 -6) 📝 `scripts/verify-published-package.mjs` (+30 -6) </details> ### 📄 Description ## Summary The `2.1.0` npm release published successfully, but the release workflow failed during its post-publish verification. This change makes that verification resilient to npm registry propagation and aligns the MCP canary with REA's capability-scoped tool advertisement contract. ## Root cause The workflow retried only `npm view`. Once package metadata became visible, Bash `-e` caused the first transient `rea: not found` result to abort the job instead of retrying. After propagation completed, the MCP canary also expected all 95 canonical tools even though a target-free installed package may advertise only the tools available in its current provider and permission context. ## Fix - Retry the registry check, both CLI probes, and the MCP canary as one verification attempt. - Use explicit `npm exec --package=... -- rea` invocation syntax. - Validate that the published MCP projection is nonempty, duplicate-free, and contains only canonical tool names. - Retain the live target-free `binary_session` call to prove the published server is operational. ## Verification - `npm run lint` - `npm run typecheck` - `npm run format:check` - `npx vitest run tests/packageInstallWorkflow.test.ts --coverage.enabled=false` - `npm run build` - `npm run verify:published -- 2.1.0` - Published `rea --help` and `rea --llms` probes from an empty temporary directory The live published canary reports 78 currently advertised tools, all drawn from the 95-tool canonical catalog. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:12:45 +00:00