[PR #6681] [MERGED] fix(release): isolate npm publication from dependency execution #7388

New issue

Closed

opened 2026-11-01 21:47:29 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:47:29 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6681
Author: @gensokyo-dev
Created: 10/23/2026
Status: ✅ Merged
Merged: 10/23/2026
Merged by: @gensokyo-dev

Base: main ← Head: fix/npm-publisher-isolation-6480

📝 Commits (3)

6e301a4 fix(release): isolate npm publication from dependency execution
786d122 fix(release): refresh registry facts on publisher retries
bbe3de3 test(release): cover accepted uploads with failed publisher commands

📊 Changes

16 files changed (+781 additions, -365 deletions)

View changed files

📝 .github/workflows/release.yml (+47 -23)
📝 docs/releasing.md (+24 -5)
➕ scripts/ci/npm-release-state.d.mts (+19 -0)
➕ scripts/ci/npm-release-state.mjs (+58 -0)
📝 scripts/ci/npm-release.d.mts (+2 -14)
📝 scripts/ci/npm-release.mjs (+11 -61)
➕ scripts/ci/prepare-npm-publication.mjs (+45 -0)
➕ scripts/ci/qualified-package-envelope.mjs (+173 -0)
📝 scripts/ci/release-recovery.mjs (+16 -6)
📝 scripts/ci/scopes.mjs (+3 -0)
📝 scripts/ci/verified-package.mjs (+43 -178)
📝 tests/boundary/filesystem/ciChangeScope.test.ts (+12 -0)
📝 tests/boundary/filesystem/ciVerifiedPackage.test.ts (+174 -8)
📝 tests/boundary/filesystem/npmRelease.test.ts (+21 -1)
📝 tests/boundary/filesystem/releaseRecovery.test.ts (+84 -49)
📝 tests/boundary/filesystem/releaseWorkflow.test.ts (+49 -20)

📄 Description

The npm publisher now uses only Node built-ins and the trusted npm toolchain to validate and submit the original qualified archive. Dependency installation and product execution stay in read-only rehearsal/post-publication jobs; MCP publication requires post-publication verification. Unused remote-cache credentials are cleared from these jobs.

One shared owner validates artifact identity/digests; one built-in registry reader supplies fresh bytes/tag facts on every publisher attempt, including partial-publication retries. Qualification retains the existing SemVer/channel owner, records manifest v2, and read-only recovery explicitly retains v1 support. The obsolete inspect command is removed. Publication disables lifecycle scripts and fixes the registry/access/tag arguments.

Validation: static checks pass; 84 focused artifact/registry/workflow/recovery cases pass; 288 CI-scope/recovery cases plus the newly added registry-owner scope case pass (overlapping coverage). The detached publisher function runs without node_modules; negative controls detect removed digest validation and an introduced external import. A real 6.7.0 archive with a synthetic workflow envelope and live official-registry lookup passes without publishing: 0.325 s elapsed / 0.290 s CPU / 95.7 MiB sampled family RSS, one CPU. The equivalent old validation+inspect flow took 0.556 s / 0.518 s CPU / 96.8 MiB; single observations exclude install/setup/download and do not establish a general speedup.

The actual current 6e301a4 package passed verify:package (283.082 s / 216.217 s CPU / 1245.5 MiB sampled family RSS), then installed CLI/MCP rehearsal (92.615 s / 36.990 s CPU / 1020.1 MiB), including all 220 canonical tools and verified process cleanup. Workflow IDs were synthetic locally; no npm publication occurred. Subsequent edits affect only release controllers/tests/docs excluded from the archive. The unchanged simulated-canary boundary case exceeded its existing 30 s deadline locally on one/two CPUs; both failures are retained without timeout changes. Final-head CI 39951320860 has completed: source/static/docs checks and all four platform package lanes pass. Its partial portable report has 23,078 passing cases, one independently reproduced main PTX failure (#6675), and 102 skipped cases. Fail-fast cancelled five shards, leaving 460 files missing from the report; those files are not counted as verified. The 32 publisher/artifact and 13 recovery cases pass in CI; remaining relevant controller/registry/scope cases passed locally. Both automated reviewers have no actionable current findings. Merge uses the existing PR-only permission under the owner's explicit unrelated-main-failure authorization; failed statuses and protections are retained.

Node/npm and Actions are pinned; the hosted runner and reviewed qualification remain trust roots; other GitHub-write release-controller jobs and npm account settings are outside this change. Refs #6480.

Author readiness

Human owner reviewed and owns the final diff.
Human owner checked validation evidence and limitations.
Human owner declares initial review readiness.

The owner explicitly authorized ready-for-review maintenance, merge and ignoring human-only fields in this session. These unchecked fields do not attest to personal human review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6681 **Author:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Created:** 10/23/2026 **Status:** ✅ Merged **Merged:** 10/23/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `fix/npm-publisher-isolation-6480` --- ### 📝 Commits (3) - [`6e301a4`](https://github.com/morluto/rea/commit/6e301a4dbd9942a8748cb6eae32fce0744b5587c) fix(release): isolate npm publication from dependency execution - [`786d122`](https://github.com/morluto/rea/commit/786d1229cf980eac85a23f5feb410363dd63a277) fix(release): refresh registry facts on publisher retries - [`bbe3de3`](https://github.com/morluto/rea/commit/bbe3de3c4dbd927c56240aa9b4d38b702a5c2160) test(release): cover accepted uploads with failed publisher commands ### 📊 Changes **16 files changed** (+781 additions, -365 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/release.yml` (+47 -23) 📝 `docs/releasing.md` (+24 -5) ➕ `scripts/ci/npm-release-state.d.mts` (+19 -0) ➕ `scripts/ci/npm-release-state.mjs` (+58 -0) 📝 `scripts/ci/npm-release.d.mts` (+2 -14) 📝 `scripts/ci/npm-release.mjs` (+11 -61) ➕ `scripts/ci/prepare-npm-publication.mjs` (+45 -0) ➕ `scripts/ci/qualified-package-envelope.mjs` (+173 -0) 📝 `scripts/ci/release-recovery.mjs` (+16 -6) 📝 `scripts/ci/scopes.mjs` (+3 -0) 📝 `scripts/ci/verified-package.mjs` (+43 -178) 📝 `tests/boundary/filesystem/ciChangeScope.test.ts` (+12 -0) 📝 `tests/boundary/filesystem/ciVerifiedPackage.test.ts` (+174 -8) 📝 `tests/boundary/filesystem/npmRelease.test.ts` (+21 -1) 📝 `tests/boundary/filesystem/releaseRecovery.test.ts` (+84 -49) 📝 `tests/boundary/filesystem/releaseWorkflow.test.ts` (+49 -20) </details> ### 📄 Description The npm publisher now uses only Node built-ins and the trusted npm toolchain to validate and submit the original qualified archive. Dependency installation and product execution stay in read-only rehearsal/post-publication jobs; MCP publication requires post-publication verification. Unused remote-cache credentials are cleared from these jobs. One shared owner validates artifact identity/digests; one built-in registry reader supplies fresh bytes/tag facts on every publisher attempt, including partial-publication retries. Qualification retains the existing SemVer/channel owner, records manifest v2, and read-only recovery explicitly retains v1 support. The obsolete inspect command is removed. Publication disables lifecycle scripts and fixes the registry/access/tag arguments. Validation: static checks pass; 84 focused artifact/registry/workflow/recovery cases pass; 288 CI-scope/recovery cases plus the newly added registry-owner scope case pass (overlapping coverage). The detached publisher function runs without node_modules; negative controls detect removed digest validation and an introduced external import. A real 6.7.0 archive with a synthetic workflow envelope and live official-registry lookup passes without publishing: 0.325 s elapsed / 0.290 s CPU / 95.7 MiB sampled family RSS, one CPU. The equivalent old validation+inspect flow took 0.556 s / 0.518 s CPU / 96.8 MiB; single observations exclude install/setup/download and do not establish a general speedup. The actual current 6e301a4 package passed verify:package (283.082 s / 216.217 s CPU / 1245.5 MiB sampled family RSS), then installed CLI/MCP rehearsal (92.615 s / 36.990 s CPU / 1020.1 MiB), including all 220 canonical tools and verified process cleanup. Workflow IDs were synthetic locally; no npm publication occurred. Subsequent edits affect only release controllers/tests/docs excluded from the archive. The unchanged simulated-canary boundary case exceeded its existing 30 s deadline locally on one/two CPUs; both failures are retained without timeout changes. Final-head CI 39951320860 has completed: source/static/docs checks and all four platform package lanes pass. Its partial portable report has 23,078 passing cases, one independently reproduced main PTX failure (#6675), and 102 skipped cases. Fail-fast cancelled five shards, leaving 460 files missing from the report; those files are not counted as verified. The 32 publisher/artifact and 13 recovery cases pass in CI; remaining relevant controller/registry/scope cases passed locally. Both automated reviewers have no actionable current findings. Merge uses the existing PR-only permission under the owner's explicit unrelated-main-failure authorization; failed statuses and protections are retained. Node/npm and Actions are pinned; the hosted runner and reviewed qualification remain trust roots; other GitHub-write release-controller jobs and npm account settings are outside this change. Refs #6480. ### Author readiness - [ ] Human owner reviewed and owns the final diff. - [ ] Human owner checked validation evidence and limitations. - [ ] Human owner declares initial review readiness. The owner explicitly authorized ready-for-review maintenance, merge and ignoring human-only fields in this session. These unchecked fields do not attest to personal human review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:47:29 +00:00