ci: recover CLI publication with hosted provenance - #27
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟡 Changes recommended
The recovery release creation step uses tag signature verification and “signed tag” wording that doesn’t match the repo’s current semantic-release tagging/signing behavior, which can cause the dispatch recovery to fail.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Restores a missing npm/GitHub Release for @uinaf/attach-cli v0.6.2 by adding a tightly-bounded recovery path to the existing release workflow that publishes from a GitHub-hosted runner with hosted provenance, and verifies registry + provenance parity before creating the immutable GitHub Release.
Changes:
- Adds
workflow_dispatchrecovery mode torelease.yml, switching publication toubuntu-24.04for npm-hosted provenance and gating recovery on preflight/published/complete verification. - Introduces a recovery helper script plus focused tests to validate input drift, npm integrity/gitHead, and npm provenance payload claims.
- Documents the one-shot recovery procedure and its invariants in
docs/releasing.md.
File summaries
| File | Description |
|---|---|
| docs/releasing.md | Documents the recovery workflow, invariants, and verification expectations for v0.6.2. |
| apps/cli/test/recovery.test.ts | Adds fixtures and tests for recovery preflight checks and provenance validation. |
| apps/cli/scripts/recover-0.6.2.ts | Implements recovery verification logic for tag ancestry, npm registry state, and provenance payload parity. |
| .github/workflows/release.yml | Adds bounded workflow_dispatch recovery flow and moves publish to GitHub-hosted runner for provenance. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d9097a8321
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![slopzapper[bot]](https://avatars.githubusercontent.com/in/4527847?s=60&v=4){kind=small}
There was a problem hiding this comment.
✨ CLEAN
Dispatch recovery publishes only a missing 0.6.2 and creates only a missing immutable release after confirming the tag still points at 7a0c78d and only the four recovery files differ. The release job now uses GitHub-hosted Ubuntu, which is what npm provenance requires for this recovery and later semantic-release publishes.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 45fc9fec28
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
✨ CLEAN
The dispatch path only publishes missing 0.6.2 from a hosted runner with OIDC and leaves tag cli-v0.6.2 on the signed 7a0c78d commit. Allowlist, gitHead, and provenance checks match the live lightweight tag and the 0.6.1 attestation shape; the push release path still requires verify and scan.
Problem
npm rejected provenance from the self-hosted publish runner after the signed cli-v0.6.2 tag was created, leaving the npm version and GitHub Release missing.
Solution
Use GitHub-hosted Ubuntu for publishing and add a bounded 0.6.2 recovery dispatch to the existing release workflow. Preserve the tag and package inputs; build from the actual dispatch commit and verify registry integrity, gitHead and provenance payload before creating the missing immutable Release. The existing Homebrew updater consumes the recovered version through its signed App writeback.
The dispatch fails closed on input drift or lookup errors and publishes only missing targets. Provenance identifies the recovery commit; release notes explain its relation to the unchanged tag. Remove the one-shot recovery path after live parity is confirmed.
Proof
Full local verification passed: 128 tests and all16 uncached verification lanes. Focused fixtures reject incorrect artifact/build identities and ambiguous lookup failures. actionlint, zizmor and independent Astra review passed. Live OIDC publication and downstream parity will be verified after this workflow lands.