Repository navigation
fix(release): enforce SDK publishing contracts - #742
Draft
aldoruizluna wants to merge 1 commit into
Draft
aldoruizluna wants to merge 1 commit into
aldoruizluna wants to merge 1 commit into
Conversation
Validate package identity, committed version and release-tag provenance before publishing inspected pnpm tarballs. Require available internal runtime dependencies, fail closed on registry errors, and retire the legacy publisher. Run release regressions in regular CI. Validation: 22 contract tests, Node syntax, scoped actionlint and diff checks. Co-Authored-By: Codex <noreply@openai.com> Session: codex://threads/01a10513-8bed-7b40-92e8-5eac783dca16
Contributor
|
📚 Documentation checks found issues. Please review the maintenance script output. |
Contributor
|
|
Contributor
Security Scan SummaryDate: Wed Oct 21 01:24:04 UTC 2026 Scan Results
|
Contributor
🎭 Playwright E2E Test Results
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
From the commit (
fix(release): enforce SDK publishing contracts):scripts/sdk-release.mjs: before publishing inspected pnpm tarballs, it validates package identity, the committed version and release-tag provenance. It requires internal runtime dependencies to be available and fails closed on registry errors.scripts/sdk-release.test.mjs: 22 contract tests, also run in regular CI (ci.yml).publish-sdks.ymlis reworked to use the script.publish.ymlis retired: it keeps only aworkflow_dispatchstub with read-only permissions that fails clearly, with no build, version bump, publish, tag or release.docs/PUBLISHING.mdanddocs/project/RELEASE.mddocument the contract.History
One commit pushed on 2026-10-04 (its commit date) by an earlier agent session; the branch never had a PR. Opened as a draft, content unchanged, during the 2026-10-21 wrap-up.
Merge status
107 commits behind
main; a test merge against currentmainis clean. The publish workflows onmainhave not changed since this branch was cut.Review needed
Release-pipeline review. This changes how SDKs reach the registry and removes the old publisher, so check that every package and release path the old
publish.ymlcovered is still reachable throughpublish-sdks.yml, and that tag/version provenance matches how releases are actually cut. Merging does not publish anything by itself.🤖 Generated with Claude Code