ci(root): expand the lockstep group over the packages a release resolves

[mobeenabdullah]

Closes the P1 left open when #664 merged.

The gap

getWorkspacePackageNames enumerated by listing packages/. Changesets expands
a fixed entry against every package it resolves. While the group spells out
all 23 names those two agree, so this was latent rather than live — but a group
written with a pattern separates them:

fixed: [["**"]]

  expanded against a packages/ listing  ->  23 names, exact coverage, PASS
  expanded as the release expands it    ->  24 names, playground included

A changeset naming the 23 then passes here while the release runs with a wider
group. That matters because a fixed group moves every member to the highest
version any member carries (assemble-release-plan): packages/* sit at
0.0.2-alpha.55 and apps/playground at 0.1.2-alpha.1, so the train would
publish as 0.1.2 — silently, and not reversibly.

The finding's suggested remedy would have introduced the mirror defect

The thread proposed reading pnpm-workspace.yaml. That file is not what the
release acts on:

root package.json workspaces	apps/*, packages/*
pnpm-workspace.yaml	apps/*, packages/*, e2e

@manypkg/get-packages prefers the manifest field over the workspace file — it
reports tool: yarn here — and Changesets enumerates through that library. So
Changesets never sees e2e. Expanding ** against the YAML would have made this
guard demand @nextlyhq/e2e in every changeset, for a package no release
versions.

Enumeration now goes through that same library, so what expands here and what
expands at release time agree by construction rather than by my agreement.

Expansion and membership are separate questions

They were sharing one list, which is what made the bug possible. getWorkspacePackages
returns both from one walk:

• all — every package Changesets resolves. What a pattern expands against.
• underPackagesDir — what the group is supposed to contain. apps/* is in the
  workspace and deliberately off the train.

Deriving them from one walk rather than two enumerations keeps them from
disagreeing about which packages exist.

The "unknown name" report is also split, because the two causes have opposite
outcomes: a name nothing answers to fails the release, while a name resolving
to an app succeeds it at the wrong version. One sentence covering both told
the author the wrong thing about what would happen.

Verified both directions

• Real repo, real config: exit=0, 24 all / 23 under packages/, only
  playground outside — the guard stays quiet on a correct tree.
• Reverting the one-line expansion fails exactly the new test and leaves the
  other 82 passing.
• ** against a workspace that is only packages/ still passes, so the new case
  cannot be satisfied by rejecting patterns on sight.

83 tests pass. @manypkg/get-packages was already in the store as a
@changesets/cli transitive: resolved 2, reused 2, downloaded 0.

Also corrected here

fixedGroupShape's comment justified checking the group shape locally by the
cost of a dependency this PR now declares. Rewritten to the reason that survives:
Changesets accepts any number of disjoint groups, so "exactly one group" is this
repository's rule and delegating would drop it.

No changeset: CI-only.

[mobeenabdullah]

@codex please review this PR

[coderabbitai]

Warning

Review limit reached

@mobeenabdullah, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 39 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6eb45912-b549-415e-b76a-00d611b9ed4e

📥 Commits

Reviewing files that changed from the base of the PR and between 63df6c6 and 6ae197f.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !**/pnpm-lock.yaml

📒 Files selected for processing (4)

• package.json
• scripts/release/check-changesets.mjs
• scripts/release/check-changesets.test.mjs
• scripts/release/lib.mjs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 6ae197f593

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[pkg-pr-new]

Open in StackBlitz

@nextlyhq/adapter-drizzle

npm i https://pkg.pr.new/@nextlyhq/adapter-drizzle@6ae197f

@nextlyhq/adapter-mysql

npm i https://pkg.pr.new/@nextlyhq/adapter-mysql@6ae197f

@nextlyhq/adapter-postgres

npm i https://pkg.pr.new/@nextlyhq/adapter-postgres@6ae197f

@nextlyhq/adapter-sqlite

npm i https://pkg.pr.new/@nextlyhq/adapter-sqlite@6ae197f

@nextlyhq/admin

npm i https://pkg.pr.new/@nextlyhq/admin@6ae197f

@nextlyhq/admin-css

npm i https://pkg.pr.new/@nextlyhq/admin-css@6ae197f

@nextlyhq/blocks-engine

npm i https://pkg.pr.new/@nextlyhq/blocks-engine@6ae197f

@nextlyhq/blocks-react

npm i https://pkg.pr.new/@nextlyhq/blocks-react@6ae197f

@nextlyhq/builder

npm i https://pkg.pr.new/@nextlyhq/builder@6ae197f

create-nextly-app

npm i https://pkg.pr.new/create-nextly-app@6ae197f

nextly

npm i https://pkg.pr.new/nextly@6ae197f

@nextlyhq/plugin-form-builder

npm i https://pkg.pr.new/@nextlyhq/plugin-form-builder@6ae197f

@nextlyhq/plugin-page-builder

npm i https://pkg.pr.new/@nextlyhq/plugin-page-builder@6ae197f

@nextlyhq/plugin-sdk

npm i https://pkg.pr.new/@nextlyhq/plugin-sdk@6ae197f

@nextlyhq/plugin-seo

npm i https://pkg.pr.new/@nextlyhq/plugin-seo@6ae197f

@nextlyhq/storage-s3

npm i https://pkg.pr.new/@nextlyhq/storage-s3@6ae197f

@nextlyhq/storage-uploadthing

npm i https://pkg.pr.new/@nextlyhq/storage-uploadthing@6ae197f

@nextlyhq/storage-vercel-blob

npm i https://pkg.pr.new/@nextlyhq/storage-vercel-blob@6ae197f

@nextlyhq/ui

npm i https://pkg.pr.new/@nextlyhq/ui@6ae197f

commit: 6ae197f