[PR #1064] [MERGED] fix(release): validate frozen checkpoint versions and breaking notes #2616

New issue

Closed

opened 2026-10-17 21:08:16 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:08:16 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1064
Author: @N0zoM1z0
Created: 10/8/2026
Status: ✅ Merged
Merged: 10/8/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/release-checkpoint-guards

📝 Commits (4)

6fee426 chore(release/6.0.0): release rea-agents 6.0.0 (#1058)
5dfd990 chore(release): sync 6.0.0 checkpoint metadata
60825fb fix(release): validate frozen checkpoint versions and breaking notes
f5009ed fix(release): recognize conventional titles in GitHub merge commits

📊 Changes

19 files changed (+1168 additions, -13 deletions)

View changed files

📝 .github/pull_request_template.md (+4 -0)
📝 .github/workflows/release.yml (+37 -0)
📝 .release-please-manifest.json (+1 -1)
📝 CHANGELOG.md (+99 -0)
📝 README_ar.md (+1 -1)
📝 README_ja.md (+1 -1)
📝 README_ko.md (+1 -1)
📝 README_zh.md (+1 -1)
📝 docs/installation.md (+1 -1)
📝 docs/product-catalog.json (+1 -1)
📝 docs/releasing.md (+44 -0)
📝 package-lock.json (+2 -2)
📝 package.json (+1 -1)
➕ scripts/lib/release-checkpoint.mjs (+338 -0)
➕ scripts/verify-release-checkpoint.mjs (+44 -0)
📝 server.json (+2 -2)
📝 src/generatedPackageMetadata.ts (+1 -1)
➕ tests/boundary/filesystem/releaseCheckpoint.test.ts (+545 -0)
📝 tests/boundary/filesystem/releaseWorkflow.test.ts (+44 -0)

📄 Description

Summary

Fixes #1063. After publishing 6.0.0, sync its metadata/tag ancestry into current main and add independent release checkpoint validation.

Derive the intended exact version from release/VERSION; validate the package, lockfile, manifest, MCP registry metadata, generated metadata/catalog and the new changelog section.
Audit the actual published-tag ancestry and visible first-parent Conventional Commits. Block a non-major candidate with unreleased breaking markers, or new migration notes that omit those changes. Report other omitted notes for review.
Run the source check before Release Please can create a release, and check the bot candidate during preparation. Preserve manual prepare/publish and frozen-source provenance.
Document compatible patch/minor changes, compatibility/deprecation transitions, and concrete migration evidence before using ! / BREAKING CHANGE.

The source bug is reproduced by the actual 5.0.0 side-branch history: the bot's chronological cutoff omitted unreleased mainline changes. The new guard rejects the original incorrect 5.1.0 candidate, accepts the published 6.0.0 candidate, retains both breaking commits, and now reports two additional non-breaking note omissions from GitHub merge titles (#994 performance, #996 Japanese README). Those were reviewed as changelog omissions; the published application contains the changes and its frozen source is unchanged.

Verification

Focused Vitest: 67 tests passed across release checkpoint, release workflow, release configuration and existing MCP schema metadata tests.
Real temporary Git DAG tests exercise the side-branch cutoff, wrong versions, missing migration references, malformed/inconsistent metadata, ancestor boundaries, compatible patch/minor, an exact prerelease, and actual GitHub merge commits with Conventional Commit titles in their bodies. Ordinary body examples are not interpreted as merge titles.
Executed the actual pre-publication workflow command against valid/invalid Git fixtures; failure prevents the next release action.
Historical read-only verification against the real original bot candidate and published tag.
npm run check:fast
npm run docs:generate / npm run docs:check
npm run mcp-registry:check
Formatter, targeted lint and git diff --check

Real Hopper/Ghidra/browser execution was not rerun locally for this release-maintenance change. The public 6.0.0 package canary has already passed CLI startup, all 139 MCP tools, and the isolated 5.0.0 → 6.0.0 upgrade. CI owns the complete platform and real-provider matrix for this PR.

Compatibility and limitations

No application contracts or dependency versions change. This checks declared commit markers and note references; it does not infer API compatibility or prove migration prose quality. Other missing changelog entries remain visible warnings for maintainer review.

Merge requirement

Merge with a merge commit, not squash/rebase. This branch includes the released rea-agents-6.0.0 tag through a dedicated baseline merge, preserving it as an ancestor of main while retaining the newer #1059 implementation. The published tag and frozen release branch must remain unchanged. This PR does not publish another version.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1064 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/8/2026 **Status:** ✅ Merged **Merged:** 10/8/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/release-checkpoint-guards` --- ### 📝 Commits (4) - [`6fee426`](https://github.com/morluto/rea/commit/6fee42689ae6e95a0182e0d4d0f55644e73e72be) chore(release/6.0.0): release rea-agents 6.0.0 (#1058) - [`5dfd990`](https://github.com/morluto/rea/commit/5dfd9905ed9b1e122ee2c151ab8f68361e6d0546) chore(release): sync 6.0.0 checkpoint metadata - [`60825fb`](https://github.com/morluto/rea/commit/60825fb44751c9482bdf4cafdac3599da7c82d45) fix(release): validate frozen checkpoint versions and breaking notes - [`f5009ed`](https://github.com/morluto/rea/commit/f5009ed55f081939409808870458162991f836ca) fix(release): recognize conventional titles in GitHub merge commits ### 📊 Changes **19 files changed** (+1168 additions, -13 deletions) <details> <summary>View changed files</summary> 📝 `.github/pull_request_template.md` (+4 -0) 📝 `.github/workflows/release.yml` (+37 -0) 📝 `.release-please-manifest.json` (+1 -1) 📝 `CHANGELOG.md` (+99 -0) 📝 `README_ar.md` (+1 -1) 📝 `README_ja.md` (+1 -1) 📝 `README_ko.md` (+1 -1) 📝 `README_zh.md` (+1 -1) 📝 `docs/installation.md` (+1 -1) 📝 `docs/product-catalog.json` (+1 -1) 📝 `docs/releasing.md` (+44 -0) 📝 `package-lock.json` (+2 -2) 📝 `package.json` (+1 -1) ➕ `scripts/lib/release-checkpoint.mjs` (+338 -0) ➕ `scripts/verify-release-checkpoint.mjs` (+44 -0) 📝 `server.json` (+2 -2) 📝 `src/generatedPackageMetadata.ts` (+1 -1) ➕ `tests/boundary/filesystem/releaseCheckpoint.test.ts` (+545 -0) 📝 `tests/boundary/filesystem/releaseWorkflow.test.ts` (+44 -0) </details> ### 📄 Description ## Summary Fixes #1063. After publishing 6.0.0, sync its metadata/tag ancestry into current main and add independent release checkpoint validation. - Derive the intended exact version from `release/VERSION`; validate the package, lockfile, manifest, MCP registry metadata, generated metadata/catalog and the new changelog section. - Audit the actual published-tag ancestry and visible first-parent Conventional Commits. Block a non-major candidate with unreleased breaking markers, or new migration notes that omit those changes. Report other omitted notes for review. - Run the source check before Release Please can create a release, and check the bot candidate during preparation. Preserve manual prepare/publish and frozen-source provenance. - Document compatible patch/minor changes, compatibility/deprecation transitions, and concrete migration evidence before using `!` / `BREAKING CHANGE`. The source bug is reproduced by the actual 5.0.0 side-branch history: the bot's chronological cutoff omitted unreleased mainline changes. The new guard rejects the original incorrect 5.1.0 candidate, accepts the published 6.0.0 candidate, retains both breaking commits, and now reports two additional non-breaking note omissions from GitHub merge titles (#994 performance, #996 Japanese README). Those were reviewed as changelog omissions; the published application contains the changes and its frozen source is unchanged. ## Verification - Focused Vitest: **67 tests passed** across release checkpoint, release workflow, release configuration and existing MCP schema metadata tests. - Real temporary Git DAG tests exercise the side-branch cutoff, wrong versions, missing migration references, malformed/inconsistent metadata, ancestor boundaries, compatible patch/minor, an exact prerelease, and actual GitHub merge commits with Conventional Commit titles in their bodies. Ordinary body examples are not interpreted as merge titles. - Executed the actual pre-publication workflow command against valid/invalid Git fixtures; failure prevents the next release action. - Historical read-only verification against the real original bot candidate and published tag. - `npm run check:fast` - `npm run docs:generate` / `npm run docs:check` - `npm run mcp-registry:check` - Formatter, targeted lint and `git diff --check` Real Hopper/Ghidra/browser execution was not rerun locally for this release-maintenance change. The public 6.0.0 package canary has already passed CLI startup, all 139 MCP tools, and the isolated 5.0.0 → 6.0.0 upgrade. CI owns the complete platform and real-provider matrix for this PR. ## Compatibility and limitations No application contracts or dependency versions change. This checks declared commit markers and note references; it does not infer API compatibility or prove migration prose quality. Other missing changelog entries remain visible warnings for maintainer review. ## Merge requirement **Merge with a merge commit, not squash/rebase.** This branch includes the released `rea-agents-6.0.0` tag through a dedicated baseline merge, preserving it as an ancestor of main while retaining the newer #1059 implementation. The published tag and frozen release branch must remain unchanged. This PR does not publish another version. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:08:16 +00:00