Preserve release tags by creating GitHub Releases after npm publish - #1521
Draft
schickling-assistant wants to merge 4 commits into
Draft
Preserve release tags by creating GitHub Releases after npm publish#1521schickling-assistant wants to merge 4 commits into
schickling-assistant wants to merge 4 commits into
Conversation
schickling-assistant
added
area:ci
Contributor
PR preview
Report historyPR 1521 · 2026-07-29 15:44 UTC
PR 1521 · 2026-07-29 15:26 UTC
PR 1521 · 2026-07-29 15:11 UTC
PR 1521 · 2026-07-29 14:20 UTC
|
Pin automatic tag creation to the exact workflow SHA and reject empty release notes at extraction and publish time. One-off: the commit hook was bypassed during the dev3 host build freeze. Verification is deliberately relocated to the confirmed-live GitHub Actions CI for PR #1521; this is not a precedent for skipping local gates.
Apply the deterministic formatting correction reported by GitHub Actions after the one-off host-freeze hook bypass. This extra CI round-trip is the concrete cost of relocating verification; it is not precedent for skipping local gates.
Apply the exact single-file oxfmt output after GitHub Actions showed the manual formatting repair was incomplete. The hook remains bypassed only under the one-off dev3 host freeze; the matching configured formatter check passed before this push.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Core creates GitHub Releases and their implicit git tags inside the DevTools
Chrome ZIP publisher. Deleting that publisher in the repository split would
therefore silently stop core releases and tags, even though npm publication
continues.
The initial version of this PR moved
gh release createwithout adding--target. That was a correctness defect: for a missing tag,ghresolves thelatest state of the default branch rather than the checked-out release-plan
commit. A concurrent
mainadvance could therefore makev<version>point atcode different from the code npm received. Moving creation earlier also changed
the resolution window, so the initial claim that commitish behavior was
preserved was incorrect.
The old path also falls back to a generic
Release <version>body when thecommitted release notes are missing, which can preserve stale release notes.
Goal
Keep core GitHub Release and tag creation independent of DevTools artifact
machinery while guaranteeing the tag names the exact workflow commit that
published the release.
This is a standalone prerequisite for #1497 and can merge independently of the
rest of that epic.
Decisions
publish-releasejob,immediately after stable npm publication succeeds.
--target "$GITHUB_SHA". For the release-planpush and main-only manual dispatch paths, that immutable SHA is the workflow
commit whose checkout was published.
otherwise create the Release/tag and mark prerelease versions.
release/release-notes.md. Missing orwhitespace-only notes fail during extraction and again at publish time.
publish-releaseconcurrency stanza. It cannot prevent unrelatedpushes from advancing
main, and cancellation or serialization would changerelease recovery behavior. Pinning the immutable target directly closes the
integrity hole.
gh release uploadindevtools-artifact.ts. The Chrome ZIP does notmove to a core Release destination; its removal remains part of the later
DevTools cleanup.
Verification
Initial relocation checks before the P1 follow-up:
CI=1 devenv tasks run genie:check(passed)CI=1 devenv tasks run lint:full(passed)CI=1 devenv tasks run ts:check(passed)CI=1 devenv shell -- vitest run scripts/src/commands/release.test.ts(8 tests passed)
CI=1 devenv shell -- vitest run tests/package-common/src/intent-layer/intent-layer.test.ts(8 tests passed)
CI=1 devenv tasks run test:unit(passed)P1 follow-up verification:
19bed7f24737189139c0f5adb68722cb32b14c0epassed all executableGitHub checks: 26 succeeded, 8 release-event-only jobs skipped, 0 failed.
Main CI run
30464531113, Release run30464531326, and DevTools manifestrun
30464531272all completed successfully.ordering, no
continue-on-error, exact--target "$GITHUB_SHA", Releaseview/edit/create behavior, prerelease behavior, semantic nonempty notes, and
the absence of core-side upload in the relocated step.
version sections.
Playwright (DevTools/misc/TodoMVC), wa-sqlite, perf, package snapshot,
examples, docs, source policies, release-plan validation, and manifest
update.
test-integration-sync-provider (cf-ws-do)passed on thisbranch. Its comparison branch Fix extension Playwright launches by preserving caller args #1520 also passed after correcting a missing
lockfile entry; an earlier Fix extension Playwright launches by preserving caller args #1520 cell never reached tests because frozen
install rejected that lockfile.
Local builds were intentionally frozen during the dev3 disk incident. The
one-off commit-hook bypass cost two deterministic CI formatting round-trips:
the first manual repair guessed incorrectly, then the approved single-file
configured
oxfmtoutput and matching--checkproduced the green finalcommit. This is evidence of the verification-relocation trade, not precedent
for skipping local gates.
The documented
devenv tasks run test:runcommand is absent in this checkout.An earlier aggregate
CI=1 devenv shell -- mono testattempt observed unrelatedwebmesh and package-common failures, then the integration launcher hit the
repository's direct-pnpm passthrough guard. The dedicated managed unit task
passed before that aggregate attempt.
Demo
Complexity
No new job, permission, dependency, or abstraction. The change adds one
generated workflow step and parsed structural coverage for its release
integrity contract.
Concerns
of GitHub token/API behavior. Static coverage proves the generated command and
ordering, not a live GitHub tag write.
release.yml.genie.tsandCHANGELOG.md; open PRAutomate verified DevTools manifest updates #1445 overlaps
devtools-artifact.tsandCHANGELOG.md, so landing order mayrequire regeneration or conflict resolution.
Friction & bottlenecks
test:runtask.pnpm,which the repository task guard rejects.
explicit build freeze after rapid disk consumption.
Follow-ups
machinery only after this relocation is proven by a real release.
References