morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1006] [MERGED] fix(release): publish from explicit source checkpoints #2574

New issue

Closed

opened 2026-10-17 21:07:46 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:07:46 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1006
Author: @morluto
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @morluto

Base: main ← Head: cursor/release-checkpoint-cleanup-f3ba

📝 Commits (8)

093a9e1 fix(release): publish from explicit source checkpoints
12c9740 fix(release): stop publication when the checkpoint has moved
09b6bdb fix(release): require a token that can trigger release CI
48c9f25 test(release): require the CI-capable release token
c409026 style(release): format the release-token test
ef8163d Merge remote-tracking branch 'origin/main' into cursor/release-checkpoint-cleanup-f3ba
56e79f8 Merge remote-tracking branch 'origin/main' into cursor/release-checkpoint-cleanup-f3ba
3a829c5 Merge remote-tracking branch 'origin/main' into cursor/release-checkpoint-cleanup-f3ba

📊 Changes

5 files changed (+330 additions, -123 deletions)

View changed files

📝 .github/workflows/release.yml (+85 -28)
📝 .github/workflows/website-check.yml (+1 -1)
📝 CONTRIBUTING.md (+12 -10)
📝 docs/releasing.md (+56 -41)
📝 tests/boundary/filesystem/releaseWorkflow.test.ts (+176 -43)

📄 Description

Summary

Continues #1003 and replaces the rolling main-push release with an explicit release/VERSION checkpoint. This stops later main merges from changing a candidate and restarting its CI, as seen on #771.

The branch is rebased onto current main, so the npm propagation window and diagnostics from #943 stay in place.

Problem and expected behavior

Dispatching prepare or publish with any other phase, or publishing after the release branch moved, could still reach Release Please. Release Please creates the GitHub tag before the later SHA comparison, and registry jobs were gated only on release_created. A choice input can also be bypassed by the workflow API, which would leave both skip flags false and restore the combined pull-request-and-release behavior.

Publication must fail before a tag exists when the dispatched commit is not the release-branch tip. Registry publication and catalog pushes must stay on their own phase.

Change and scope

prepare runs from main and only prepares the bot pull request. publish runs from the selected release/VERSION branch.
Local validation rejects unknown phases, the wrong ref, and branch names that are not a single release/ segment, before any GitHub call.
The branch tip is resolved separately and must equal the dispatch SHA before Release Please runs during publish.
npm and MCP Registry jobs run only for publish and check out Release Please's release SHA. Catalog normalization runs only for prepare.
The unused tag output is removed. Website checks also run for pull requests into release/*. The generated-metadata bot stays on main so it does not push onto a frozen candidate.
CONTRIBUTING now matches the manual VitePress build and the manual website publisher.

Contract and boundary impact

Semantic owner and earliest changed stage: release workflow authority; no product contract change.
CLI and MCP/tool-catalog contract: none.
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: npm provenance stays bound to the dispatched release commit.
Process execution, authorization, cleanup, or containment impact: none.
Generated metadata (docs/product-catalog.json), package, or installation impact: unchanged. Preparation still normalizes the product catalog on the bot pull request.

Evidence and regression coverage

Tests added or updated: tests/boundary/filesystem/releaseWorkflow.test.ts covers phase, ref, branch-name, branch-tip, and tagged-SHA failures, plus phase gates for registry jobs and catalog pushes. It also requires RELEASE_PLEASE_TOKEN and fails preparation when that secret is missing.
Base reproduction or other evidence: the previous validation script called the GitHub API from the same step that local checks used, and registry jobs did not require phase == publish.
User-visible CLI/MCP output (if applicable): none.
Remaining proof gaps: no live prepare/publish dispatch has run. Release Please's tag SHA can still differ from the branch tip after the tag is created; registry publication stops, and the guide says not to dispatch publish again. Deterministic CI shards still miss the build-generated source catalog (#1001, #1002); that prerequisite is separate from this release flow.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run test:focused -- tests/boundary/filesystem/releaseWorkflow.test.ts tests/conformance/releaseConfiguration.test.ts — 31 tests passed.
npm run check:fast — typecheck and lint passed.
npx oxfmt --check on the edited workflow, docs, and test files — passed.
git diff --check — passed.

Compatibility, safety, and release

Breaking changes or migration steps: main pushes no longer update release pull requests or publish packages. Maintainers follow docs/releasing.md. Preparation and publication require RELEASE_PLEASE_TOKEN; the workflow does not fall back to GITHUB_TOKEN.
Real Hopper/Ghidra, browser, or OS coverage: not run. Runtime and provider behavior are unchanged.
Package or release metadata impact: no package published. The npm canary window from #943 is retained.
Security, privacy, process, or containment review: publication refuses a moved branch before creating a tag, and registry jobs cannot run during preparation.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1006 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `cursor/release-checkpoint-cleanup-f3ba` --- ### 📝 Commits (8) - [`093a9e1`](https://github.com/morluto/rea/commit/093a9e1fe9575860e9a935de03b7323c13be415f) fix(release): publish from explicit source checkpoints - [`12c9740`](https://github.com/morluto/rea/commit/12c97403c0f34bf40d43e5d688796cabd67f471e) fix(release): stop publication when the checkpoint has moved - [`09b6bdb`](https://github.com/morluto/rea/commit/09b6bdbd03328897c70d240162183c297c9529d5) fix(release): require a token that can trigger release CI - [`48c9f25`](https://github.com/morluto/rea/commit/48c9f2566c356caa2b83a6f43a564d0a5ba1e021) test(release): require the CI-capable release token - [`c409026`](https://github.com/morluto/rea/commit/c409026fcd9940cc5d6ec88ddc856b0fe30e237d) style(release): format the release-token test - [`ef8163d`](https://github.com/morluto/rea/commit/ef8163d4b7334e5c2efc2a2a4c5947a1ecf589a3) Merge remote-tracking branch 'origin/main' into cursor/release-checkpoint-cleanup-f3ba - [`56e79f8`](https://github.com/morluto/rea/commit/56e79f804c8c1270b3f620ce0aa2a2640a9072b9) Merge remote-tracking branch 'origin/main' into cursor/release-checkpoint-cleanup-f3ba - [`3a829c5`](https://github.com/morluto/rea/commit/3a829c5cfb020e8cecf2f5dddeabeff5bd631781) Merge remote-tracking branch 'origin/main' into cursor/release-checkpoint-cleanup-f3ba ### 📊 Changes **5 files changed** (+330 additions, -123 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/release.yml` (+85 -28) 📝 `.github/workflows/website-check.yml` (+1 -1) 📝 `CONTRIBUTING.md` (+12 -10) 📝 `docs/releasing.md` (+56 -41) 📝 `tests/boundary/filesystem/releaseWorkflow.test.ts` (+176 -43) </details> ### 📄 Description  ## Summary Continues #1003 and replaces the rolling main-push release with an explicit `release/VERSION` checkpoint. This stops later main merges from changing a candidate and restarting its CI, as seen on #771. The branch is rebased onto current main, so the npm propagation window and diagnostics from #943 stay in place. ## Problem and expected behavior Dispatching `prepare` or `publish` with any other phase, or publishing after the release branch moved, could still reach Release Please. Release Please creates the GitHub tag before the later SHA comparison, and registry jobs were gated only on `release_created`. A choice input can also be bypassed by the workflow API, which would leave both skip flags false and restore the combined pull-request-and-release behavior. Publication must fail before a tag exists when the dispatched commit is not the release-branch tip. Registry publication and catalog pushes must stay on their own phase. ## Change and scope - `prepare` runs from main and only prepares the bot pull request. `publish` runs from the selected `release/VERSION` branch. - Local validation rejects unknown phases, the wrong ref, and branch names that are not a single `release/` segment, before any GitHub call. - The branch tip is resolved separately and must equal the dispatch SHA before Release Please runs during `publish`. - npm and MCP Registry jobs run only for `publish` and check out Release Please's release SHA. Catalog normalization runs only for `prepare`. - The unused tag output is removed. Website checks also run for pull requests into `release/*`. The generated-metadata bot stays on main so it does not push onto a frozen candidate. - CONTRIBUTING now matches the manual VitePress build and the manual website publisher. ## Contract and boundary impact - Semantic owner and earliest changed stage: release workflow authority; no product contract change. - CLI and MCP/tool-catalog contract: none. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: npm provenance stays bound to the dispatched release commit. - Process execution, authorization, cleanup, or containment impact: none. - Generated metadata (`docs/product-catalog.json`), package, or installation impact: unchanged. Preparation still normalizes the product catalog on the bot pull request. ## Evidence and regression coverage - Tests added or updated: `tests/boundary/filesystem/releaseWorkflow.test.ts` covers phase, ref, branch-name, branch-tip, and tagged-SHA failures, plus phase gates for registry jobs and catalog pushes. It also requires `RELEASE_PLEASE_TOKEN` and fails preparation when that secret is missing. - Base reproduction or other evidence: the previous validation script called the GitHub API from the same step that local checks used, and registry jobs did not require `phase == publish`. - User-visible CLI/MCP output (if applicable): none. - Remaining proof gaps: no live prepare/publish dispatch has run. Release Please's tag SHA can still differ from the branch tip after the tag is created; registry publication stops, and the guide says not to dispatch publish again. Deterministic CI shards still miss the build-generated source catalog (#1001, #1002); that prerequisite is separate from this release flow. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:focused -- tests/boundary/filesystem/releaseWorkflow.test.ts tests/conformance/releaseConfiguration.test.ts` — 31 tests passed. - `npm run check:fast` — typecheck and lint passed. - `npx oxfmt --check` on the edited workflow, docs, and test files — passed. - `git diff --check` — passed. ## Compatibility, safety, and release - Breaking changes or migration steps: main pushes no longer update release pull requests or publish packages. Maintainers follow `docs/releasing.md`. Preparation and publication require `RELEASE_PLEASE_TOKEN`; the workflow does not fall back to `GITHUB_TOKEN`. - Real Hopper/Ghidra, browser, or OS coverage: not run. Runtime and provider behavior are unchanged. - Package or release metadata impact: no package published. The npm canary window from #943 is retained. - Security, privacy, process, or containment review: publication refuses a moved branch before creating a tag, and registry jobs cannot run during preparation. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims.  <div><a href="https://cursor.com/agents/bc-a0a5b31f-0771-43b6-9e0d-38f62687f3ba?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-a0a5b31f-0771-43b6-9e0d-38f62687f3ba&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:07:46 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:07:13 +00:00

[PR #2952] [MERGED] fix(javascript-semantics): keep emitted data out of dispatch listener fields #5511

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2574

No description provided.

Rows
Columns