ci: retire recovery and make release writeback atomic - #28
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟡 Changes recommended
The new release writeback validation currently uses a trimmed string comparison that can mask manifest differences and should be made stricter before relying on it for release integrity.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR retires the one-off CLI 0.6.2 recovery path and hardens the normal CLI release flow by making the version writeback to main atomic and then publishing from the immutable signed commit returned by GitHub.
Changes:
- Removed the
workflow_dispatchrecovery flow and deleted the 0.6.2 recovery helper + tests. - Replaced the semantic-release “commit package.json” step with a custom prepare plugin that creates an atomic expected-head commit via GitHub’s GraphQL API, then fetches/validates and checks out that exact commit before tagging/publishing.
- Updated release documentation to reflect the new atomic writeback behavior and the completed 0.6.2 recovery.
File summaries
| File | Description |
|---|---|
| docs/releasing.md | Updates release writeback documentation; removes the detailed 0.6.2 recovery runbook and replaces it with a completion note. |
| apps/cli/scripts/release-commit.ts | Adds a custom semantic-release prepare plugin to perform atomic signed writeback and immutable-commit checkout/validation. |
| apps/cli/test/release-commit.test.ts | Adds fixture-based tests covering branch races, source/manifest drift, API errors, and parent validation for the new writeback flow. |
| apps/cli/test/recovery.test.ts | Removes tests for the retired 0.6.2 recovery path. |
| apps/cli/scripts/recover-0.6.2.ts | Removes the retired 0.6.2 recovery helper script. |
| .releaserc.json | Switches from @jno21/semantic-release-github-commit to the local release-commit.ts prepare plugin. |
| .github/workflows/release.yml | Removes the recovery dispatch path and simplifies job gating now that the workflow only runs on push to main. |
Review details
- Files reviewed: 7/7 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Problem
CLI0.6.2 recovery has completed. Its one-shot path is now unused, and normal signed writeback could combine a verified build with newer main source or overwrite a newer package manifest.
Solution
Remove the recovery dispatch/helper/tests. Keep normal verification, hosted fresh-install publishing and the signed Homebrew updater. Replace only version preparation with an atomic expected-head GitHub commit and validate/fetch its immutable source before tagging and publishing.
Proof
Recovery run33960928863 attempt2 succeeded. npm integrity/provenance, immutable GitHub release and signed Homebrew formula match the downloaded0.6.2 tarball; the original tag is unchanged. The cleanup passed79 CLI tests, the full gate, actionlint, zizmor and independent Astra review. Real temporary Git fixtures with mocked API responses cover branch races, source/manifest drift, API rejection and wrong parent; native Node plugin import passed. Live new signed writeback remains for the next versioned release. The runbook records accepted-commit/failed-readback recovery; publication is not one atomic transaction.