From 8951d9f25e6fc3609ea4c17c0b96b56da7a2265e Mon Sep 17 00:00:00 2001 From: Devin Foley Date: Thu, 10 Sep 2026 19:06:13 -0700 Subject: [PATCH] test: probe branch-scoped Runner dependency caching Co-Authored-By: Paperclip --- .github/workflows/release.yml | 1438 +-------------------------------- 1 file changed, 31 insertions(+), 1407 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4edc35b836..9abd1a1ada 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,409 +1,24 @@ +# Diagnostic branch only: this workflow cannot publish or deploy. Cache writes +# are scoped to this probe branch; master cannot restore branch-only caches. name: Release -run-name: ${{ inputs.channel == 'preview' && format('Stack deploy {0} build', inputs.request_id) || 'Release' }} - +run-name: Runner dependency cache probe ${{ github.run_number }} on: - push: - branches: - - master - schedule: - # Nightly cut at 09:00 UTC, after the workday's merges have settled. - - cron: "0 9 * * *" workflow_dispatch: - inputs: - channel: - description: Release channel to publish - required: true - type: choice - options: - - stable - - beta - - nightly - - preview - default: stable - source_ref: - description: Stable source ref, or full immutable SHA for a preview build - required: true - type: string - default: master - request_id: - description: (preview) CLI correlation UUID - type: string - default: "" - preview_migrator: - description: (preview) Publish isolated shared and database packages if missing - type: boolean - default: false - stable_date: - description: Enter a UTC date in YYYY-MM-DD format, for example 2026-03-18. Do not enter a version string. The workflow will resolve that date to a stable version such as 2026.318.0, then 2026.318.1 for the next same-day stable. - required: false - type: string - source_version: - description: For nightly, the explicit canary version to promote (empty selects the newest canary on master). For beta, the explicit nightly version to promote (empty selects the newest nightly on master). - required: false - type: string - candidate_branch: - description: (beta) candidate/beta-* branch to build a cherry-picked beta from. Leave empty to promote a nightly. Mutually exclusive with source_version. - required: false - type: string - skip_soak_justification: - description: (stable) Written justification for publishing a stable whose source has not soaked as a beta for 3 days. Leave empty for normal releases. - required: false - type: string - dry_run: - description: Preview the release without publishing - required: true - type: boolean - default: false - -concurrency: - group: ${{ inputs.channel == 'preview' && format('preview-{0}', inputs.source_ref) || format('release-{0}-{1}', github.event_name, github.ref) }} - cancel-in-progress: false - -env: - # npm accepts a publish immediately, but the registry's CDN can lag packument - # propagation by several minutes (observed 2.5-4+ minutes on 2026-08-21, - # which failed four consecutive canary runs mid-loop). Give release.sh's - # post-publish visibility poll a 10-minute budget per package instead of its - # 60-second default; a healthy publish still exits the poll on the first - # visible check. (A 5-minute budget missed by seconds on 2026-08-21: - # adapter-opencode-local was accepted at 07:02:27 and became visible at - # 07:07:40.) The publish jobs' timeout-minutes are sized for several - # laggard packages; if most of a batch lags the full budget, npm is having - # a real incident and the job failing is correct. - NPM_PUBLISH_VERIFY_ATTEMPTS: "60" - NPM_PUBLISH_VERIFY_DELAY_SECONDS: "10" - +permissions: + contents: read jobs: - plan_preview: - name: Check preview artifacts - if: github.ref == 'refs/heads/master' && github.event_name == 'workflow_dispatch' && inputs.channel == 'preview' && !inputs.dry_run - runs-on: ubuntu-latest - permissions: - contents: read - outputs: - image: ${{ steps.plan.outputs.image }} - packages: ${{ steps.plan.outputs.packages }} - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - with: - persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 - with: - node-version: 24 - - name: Validate immutable source and inspect existing artifacts - id: plan - env: - SOURCE_SHA: ${{ inputs.source_ref }} - REQUEST_ID: ${{ inputs.request_id }} - PREVIEW_MIGRATOR: ${{ inputs.preview_migrator }} - run: node scripts/preview-artifacts.mjs plan "$SOURCE_SHA" "$REQUEST_ID" "$PREVIEW_MIGRATOR" - - package_preview: - name: Build preview migrator - needs: plan_preview - if: needs.plan_preview.outputs.packages == 'true' - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - with: - path: trusted - persist-credentials: false - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - with: - ref: ${{ inputs.source_ref }} - path: source - persist-credentials: false - - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 - with: - version: 9.15.4 - run_install: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 - with: - node-version: 24 - - name: Install build dependencies without lifecycle scripts - working-directory: source - run: pnpm install --ignore-scripts --no-frozen-lockfile - - name: Build and pack exact-source preview packages - env: - SOURCE_SHA: ${{ inputs.source_ref }} - run: node trusted/scripts/preview-artifacts.mjs pack source packages "$SOURCE_SHA" - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: preview-packages - overwrite: true - path: packages/*.tgz - if-no-files-found: error - retention-days: 7 - - publish_preview: - name: Publish preview migrator - needs: [plan_preview, package_preview] - if: github.ref == 'refs/heads/master' && needs.plan_preview.outputs.packages == 'true' && needs.package_preview.result == 'success' - runs-on: ubuntu-latest - timeout-minutes: 30 - # Reuse release.yml's established npm trusted-publisher identity. This job - # publishes only isolated preview versions; it cannot advance lane tags. - environment: npm-canary - permissions: - contents: read - id-token: write - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - with: - persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 - with: - node-version: 24 - - name: Install npm with trusted publishing support - run: npm install --global npm@11.18.0 --ignore-scripts - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 - with: - name: preview-packages - path: preview-packages - - name: Publish immutable preview packages without running package code - env: - SOURCE_SHA: ${{ inputs.source_ref }} - run: node scripts/preview-artifacts.mjs publish preview-packages "$SOURCE_SHA" - - image_preview: - name: Build preview cloud image - needs: plan_preview - if: needs.plan_preview.outputs.image == 'true' - runs-on: ubuntu-latest - timeout-minutes: 60 - permissions: - contents: read - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - with: - ref: ${{ inputs.source_ref }} - persist-credentials: false - - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 - with: - version: 9.15.4 - run_install: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 - with: - node-version: 24 - - name: Prepare locked image context - env: - SOURCE_SHA: ${{ inputs.source_ref }} - run: | - set -euo pipefail - test "$(git rev-parse HEAD)" = "$SOURCE_SHA" - pnpm install --resolution-only --ignore-scripts --ignore-pnpmfile --no-frozen-lockfile - echo "TOOLS_EPOCH=$(date -u +%G-W%V)" >> "$GITHUB_ENV" - - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 - - name: Build the immutable cloud image without registry credentials - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 - with: - context: . - target: cloud - platforms: linux/amd64 - push: false - provenance: false # Docker archives cannot carry registry attestations. - outputs: type=docker,dest=${{ runner.temp }}/preview-image.tar - tags: ghcr.io/paperclipai/paperclip:sha-${{ inputs.source_ref }}-cloud - build-args: | - CLOUD_BUNDLED_PLUGINS=daytona - CLOUD_BUNDLED_SERVER_DEPS=@sentry/node - PAPERCLIP_BUILD_COMMIT=${{ inputs.source_ref }} - PAPERCLIP_BUILD_VERSION=0.0.0-preview.g${{ inputs.source_ref }} - CLI_TOOLS_CACHE_EPOCH=${{ env.TOOLS_EPOCH }} - labels: | - org.opencontainers.image.revision=${{ inputs.source_ref }} - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: preview-image - overwrite: true - path: ${{ runner.temp }}/preview-image.tar - compression-level: 0 - if-no-files-found: error - retention-days: 1 - - publish_image_preview: - name: Publish preview cloud image - needs: [plan_preview, image_preview] - if: github.ref == 'refs/heads/master' && needs.plan_preview.outputs.image == 'true' && needs.image_preview.result == 'success' - runs-on: ubuntu-latest - timeout-minutes: 30 - # This existing environment has an external master-only branch policy. - environment: npm-canary - permissions: - contents: read - packages: write - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - with: - persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 - with: - node-version: 24 - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 - with: - name: preview-image - path: preview-image - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 - with: - registry: ghcr.io - username: ${{ github.repository_owner }} - password: ${{ secrets.GITHUB_TOKEN }} - - name: Verify image identity and publish without executing image code - env: - SOURCE_SHA: ${{ inputs.source_ref }} - run: node scripts/preview-artifacts.mjs publish-image preview-image/preview-image.tar "$SOURCE_SHA" - - result_preview: - name: Verify preview artifacts - needs: [plan_preview, image_preview, publish_image_preview, package_preview, publish_preview] - if: >- - always() && needs.plan_preview.result == 'success' && - (needs.publish_image_preview.result == 'success' || needs.plan_preview.outputs.image == 'false') && - (needs.publish_preview.result == 'success' || needs.plan_preview.outputs.packages == 'false') - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - with: - persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 - with: - node-version: 24 - - name: Confirm exact artifacts are visible - env: - SOURCE_SHA: ${{ inputs.source_ref }} - REQUEST_ID: ${{ inputs.request_id }} - PREVIEW_MIGRATOR: ${{ inputs.preview_migrator }} - run: node scripts/preview-artifacts.mjs result "$SOURCE_SHA" "$REQUEST_ID" - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: stack-deploy-result - overwrite: true - path: stack-deploy-result/result.json - if-no-files-found: error - retention-days: 30 - - verify_canary: - if: github.event_name == 'push' - uses: ./.github/workflows/release-verify.yml - with: - ref: ${{ github.sha }} - - publish_canary: - if: github.event_name == 'push' - needs: verify_canary - runs-on: ubuntu-latest - timeout-minutes: 90 - environment: npm-canary - outputs: - canary_version: ${{ steps.canary_tag.outputs.version }} - permissions: - contents: write - id-token: write - # For the explicit docker.yml dispatch below. - actions: write - - steps: - - name: Checkout repository - uses: actions/checkout@v7 - with: - fetch-depth: 0 - - - name: Setup pnpm - uses: pnpm/action-setup@v6 - with: - version: 9.15.4 - - - name: Setup Node.js - uses: actions/setup-node@v7 - with: - node-version: 24 - cache: pnpm - - - name: Validate release package manifest - run: node ./scripts/release-package-map.mjs check - - - name: Install dependencies - run: pnpm install --no-frozen-lockfile - - - name: Restore tracked install-time changes - run: git checkout -- pnpm-lock.yaml - - - name: Configure git author - run: | - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - - - name: Publish canary - env: - GITHUB_ACTIONS: "true" - run: ./scripts/release.sh canary --skip-verify - - - name: Dump npm debug logs - if: failure() - run: | - shopt -s nullglob - for f in "$HOME"/.npm/_logs/*.log; do - echo "===== $f =====" - tail -n 300 "$f" | sed -E \ - -e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig' - done - - - name: Push canary tag - id: canary_tag - run: | - tag="$(git tag --points-at HEAD | grep '^canary/v' | head -1)" - if [ -z "$tag" ]; then - echo "Error: no canary tag points at HEAD after release." >&2 - exit 1 - fi - git push origin "refs/tags/${tag}" - echo "version=${tag#canary/v}" >> "$GITHUB_OUTPUT" - - # Canary images previously relied on the master-push docker.yml run, - # whose single pending concurrency slot gets superseded by every - # newer push — on a busy day no canary image publishes at all (five - # consecutive canaries shipped npm packages with no cloud image on - # 2026-09-06, starving downstream managed deploys for ~18 hours). - # Tag pushes made with GITHUB_TOKEN do not fire docker.yml's - # triggers, so dispatch the image build at the canary tag - # explicitly, exactly like the nightly and beta lanes: the run keys - # its concurrency off the tag ref, so no master push can supersede - # it, and docker.yml's `type=sha` mapping publishes the - # sha- and sha--cloud images either way. - - name: Build Docker images for the canary tag - env: - GH_TOKEN: ${{ github.token }} - run: | - { - echo "## Canary published" - echo "" - echo "- Published canary: \`${{ steps.canary_tag.outputs.version }}\`" - echo "- Docker build dispatched at \`canary/v${{ steps.canary_tag.outputs.version }}\`" - } >> "$GITHUB_STEP_SUMMARY" - gh workflow run docker.yml --ref "refs/tags/canary/v${{ steps.canary_tag.outputs.version }}" --repo "$GITHUB_REPOSITORY" - - # The package is already public when this gate runs. A red result leaves the - # immutable canary in npm, but makes the release workflow visibly fail before - # anyone mistakes an installable package for an onboardable one. - smoke_canary_onboarding: - needs: publish_canary - if: needs.publish_canary.result == 'success' + verify_paperclip_runner: + name: Verify Paperclip Runner runs-on: ubuntu-latest timeout-minutes: 20 permissions: contents: read - env: - PAPERCLIPAI_VERSION: ${{ needs.publish_canary.outputs.canary_version }} - PAPERCLIP_PLAYWRIGHT_CHANNEL: chrome steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + ref: ${{ github.sha }} - name: Setup pnpm uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 @@ -414,1023 +29,32 @@ jobs: uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version: 24 - - - name: Install test dependencies - run: pnpm install --frozen-lockfile - - - name: Show browser version - run: google-chrome --version - - - name: Smoke exact published canary through onboarding - env: - PAPERCLIP_CANARY_SMOKE_SERVER_LOG: ${{ runner.temp }}/canary-onboarding-server.log - run: pnpm run test:canary-onboarding-smoke - - - name: Upload failed canary onboarding diagnostics - if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 - with: - name: canary-onboarding-smoke-${{ needs.publish_canary.outputs.canary_version }} - if-no-files-found: warn - retention-days: 14 - path: | - ${{ runner.temp }}/canary-onboarding-server.log - tests/canary-onboarding/playwright-report/ - tests/canary-onboarding/test-results/ - - # ----- Nightly lane ----------------------------------------------------- - # Once a night (or on a forced nightly dispatch), promote the newest master - # commit that already shipped a green canary: smoke-test that exact - # published canary first, then republish the same commit under the nightly - # identity. The candidate commit already passed release-verify during its - # canary publish, so the nightly publish skips re-verification. - - select_nightly: - if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.channel == 'nightly') - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - contents: read - outputs: - proceed: ${{ steps.select.outputs.proceed }} - sha: ${{ steps.select.outputs.sha }} - canary_version: ${{ steps.select.outputs.canary_version }} - steps: - - name: Checkout repository - uses: actions/checkout@v7 - with: - ref: master - fetch-depth: 0 - - - name: Select nightly candidate - id: select - env: - EXPLICIT_CANARY_VERSION: ${{ github.event_name == 'workflow_dispatch' && inputs.source_version || '' }} - run: | - set -euo pipefail - - git fetch origin --tags --prune --quiet - - skip() { - echo "proceed=false" >> "$GITHUB_OUTPUT" - { - echo "## Nightly skipped" - echo "" - echo "$1" - } >> "$GITHUB_STEP_SUMMARY" - echo "Nightly skipped: $1" - } - - if [ -n "${EXPLICIT_CANARY_VERSION:-}" ]; then - tag="canary/v${EXPLICIT_CANARY_VERSION}" - sha="$(git rev-list -n 1 "$tag" 2>/dev/null || true)" - if [ -z "$sha" ]; then - echo "Error: tag $tag does not exist." >&2 - exit 1 - fi - else - # Newest canary-tagged commit on master. Canary tags are pushed - # only after a successful canary publish, so tag presence is the - # green-publish signal. Walk master newest-first and stop at the - # first commit that carries a canary tag. - sha="$(grep -m1 -F \ - -f <(git for-each-ref 'refs/tags/canary/v*' --format='%(objectname)') \ - <(git rev-list origin/master -n 500) || true)" - - if [ -z "$sha" ]; then - skip "No canary/v* tag found on the last 500 commits of master." - exit 0 - fi - - tag="$(git tag --points-at "$sha" | grep '^canary/v' | sort -V | tail -1)" - fi - - canary_version="${tag#canary/v}" - - existing_nightly="$(git tag --points-at "$sha" | grep '^nightly/v' | head -1 || true)" - if [ -n "$existing_nightly" ]; then - skip "Candidate \`$sha\` (canary \`$canary_version\`) already shipped as \`$existing_nightly\`." - exit 0 - fi - - # Promotions run the release tooling of the source commit, so the - # source must already understand the nightly channel. (Literal match - # of release.sh's channel case arm; if that line is reformatted this - # fails closed and should be updated alongside it.) - if ! git show "${sha}:scripts/release.sh" | grep -qF 'canary|nightly'; then - echo "Error: source commit $sha predates nightly release tooling; promote a newer canary." >&2 - exit 1 - fi - - echo "proceed=true" >> "$GITHUB_OUTPUT" - echo "sha=$sha" >> "$GITHUB_OUTPUT" - echo "canary_version=$canary_version" >> "$GITHUB_OUTPUT" - { - echo "## Nightly candidate" - echo "" - echo "- Source SHA: \`$sha\`" - echo "- Source canary: \`$canary_version\`" - } >> "$GITHUB_STEP_SUMMARY" - - # Gate the promotion on the release smoke suite, run against the exact - # published canary artifact that would become tonight's nightly. Red smoke - # means no nightly tonight. Skipped for dry-run dispatches. - smoke_nightly: - needs: select_nightly - if: needs.select_nightly.outputs.proceed == 'true' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run) - uses: ./.github/workflows/release-smoke.yml - with: - paperclip_version: ${{ needs.select_nightly.outputs.canary_version }} - artifact_name: nightly-release-smoke - - publish_nightly: - needs: [select_nightly, smoke_nightly] - # Publish when smoke passed, or when smoke was deliberately skipped by a - # dry-run dispatch (the publish itself is a dry-run in that case). - if: >- - !cancelled() && - needs.select_nightly.outputs.proceed == 'true' && - (needs.smoke_nightly.result == 'success' || - (needs.smoke_nightly.result == 'skipped' && github.event_name == 'workflow_dispatch' && inputs.dry_run)) - runs-on: ubuntu-latest - timeout-minutes: 90 - environment: npm-canary - # The workflow-level concurrency group is per event, so a forced dispatch - # nightly could otherwise overlap the scheduled one and race it to the - # same next -nightly.N version. Serialize actual nightly publishes across - # events here; release.sh additionally refuses to double-publish a commit - # that already carries a nightly tag. - concurrency: - group: release-publish-nightly - cancel-in-progress: false - permissions: - contents: write - id-token: write - actions: write - - steps: - - name: Checkout repository - uses: actions/checkout@v7 - with: - ref: ${{ needs.select_nightly.outputs.sha }} - fetch-depth: 0 - - - name: Setup pnpm - uses: pnpm/action-setup@v6 - with: - version: 9.15.4 - - - name: Setup Node.js - uses: actions/setup-node@v7 - with: - node-version: 24 cache: pnpm - - name: Validate release package manifest - run: node ./scripts/release-package-map.mjs check + - name: Select the pinned Runner Rust toolchain + working-directory: packages/paperclip-runner + run: | + set -euo pipefail + rustup show + toolchain="$(rustup show active-toolchain | awk '{print $1}')" + echo "RUSTUP_TOOLCHAIN=$toolchain" >> "$GITHUB_ENV" + + - name: Cache Runner Rust dependencies + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + with: + workspaces: packages/paperclip-runner/runner -> target + shared-key: release-runner-v1 + # Rebuild workspace code and rerun every check. Cache only compiled + # dependencies; never restore installed executables from cargo/bin. + cache-workspace-crates: false + cache-bin: false + # Manual candidate refs may read the cache, but only a successful + # master push verifying its own commit can populate the shared cache. + save-if: ${{ github.ref == 'refs/heads/ci/probe-release-runner-cache' && github.event_name == 'workflow_dispatch' }} - name: Install dependencies run: pnpm install --no-frozen-lockfile - - name: Restore tracked install-time changes - run: git checkout -- pnpm-lock.yaml + - name: Verify Paperclip Runner + run: pnpm --filter @paperclipai/paperclip-runner check:all - - name: Configure git author - run: | - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - - - name: Publish nightly - env: - GITHUB_ACTIONS: "true" - run: | - args=(nightly --skip-verify) - if [ "${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}" = "true" ]; then - args+=(--dry-run) - fi - ./scripts/release.sh "${args[@]}" - - - name: Dump npm debug logs - if: failure() - run: | - shopt -s nullglob - for f in "$HOME"/.npm/_logs/*.log; do - echo "===== $f =====" - tail -n 300 "$f" | sed -E \ - -e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig' - done - - - name: Push nightly tag - if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry_run) }} - run: | - tag="$(git tag --points-at HEAD | grep '^nightly/v' | head -1)" - if [ -z "$tag" ]; then - echo "Error: no nightly tag points at HEAD after release." >&2 - exit 1 - fi - if ! git push origin "refs/tags/${tag}"; then - sha="$(git rev-parse HEAD)" - { - echo "## Tag push rejected" - echo "" - echo "The npm publish succeeded, but pushing \`${tag}\` was rejected." - echo "This usually means the tagged commit modifies workflow files," - echo "which GITHUB_TOKEN may not reference when creating refs from" - echo "dispatch or scheduled runs. Recover with maintainer credentials:" - echo "" - echo '```' - echo "git tag ${tag} ${sha}" - echo "git push origin refs/tags/${tag}" - echo "gh workflow run docker.yml --ref refs/tags/${tag}" - echo '```' - } >> "$GITHUB_STEP_SUMMARY" - echo "::error::Tag push rejected; see the job summary for recovery commands." >&2 - exit 1 - fi - - # Tag pushes made with GITHUB_TOKEN do not fire docker.yml's tag - # trigger (GitHub suppresses workflow runs caused by GITHUB_TOKEN - # pushes), so dispatch the image build at the new tag explicitly. - - name: Build Docker images for the nightly tag - if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry_run) }} - env: - GH_TOKEN: ${{ github.token }} - run: | - tag="$(git tag --points-at HEAD | grep '^nightly/v' | head -1)" - { - echo "## Nightly published" - echo "" - echo "- Source SHA: \`${{ needs.select_nightly.outputs.sha }}\`" - echo "- Source canary: \`${{ needs.select_nightly.outputs.canary_version }}\`" - echo "- Published nightly: \`${tag#nightly/v}\`" - echo "- Docker build dispatched at \`${tag}\`" - } >> "$GITHUB_STEP_SUMMARY" - gh workflow run docker.yml --ref "refs/tags/${tag}" --repo "$GITHUB_REPOSITORY" - - # ----- Beta lane -------------------------------------------------------- - # Beta is a manual, human-approved promotion of a nightly. Unlike the - # scheduled nightly lane, a beta dispatch is explicit operator intent, so - # selection problems fail the run loudly instead of skipping quietly. The - # publish runs behind the npm-beta environment, whose required reviewers - # are the approval gate. - - select_beta: - if: github.event_name == 'workflow_dispatch' && inputs.channel == 'beta' - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - contents: read - outputs: - sha: ${{ steps.select.outputs.sha }} - nightly_version: ${{ steps.select.outputs.nightly_version }} - mode: ${{ steps.select.outputs.mode }} - steps: - - name: Checkout repository - uses: actions/checkout@v7 - with: - ref: master - fetch-depth: 0 - - - name: Select beta candidate - id: select - env: - EXPLICIT_NIGHTLY_VERSION: ${{ inputs.source_version }} - CANDIDATE_BRANCH: ${{ inputs.candidate_branch }} - run: | - set -euo pipefail - - git fetch origin --tags --prune --quiet - - # Candidate mode: build a cherry-picked beta from a short-lived - # candidate branch instead of promoting a nightly. - if [ -n "${CANDIDATE_BRANCH:-}" ]; then - if [ -n "${EXPLICIT_NIGHTLY_VERSION:-}" ]; then - echo "Error: candidate_branch and source_version are mutually exclusive." >&2 - exit 1 - fi - case "$CANDIDATE_BRANCH" in - candidate/beta-*) ;; - *) - echo "Error: candidate branches must be named candidate/beta- (got: $CANDIDATE_BRANCH)." >&2 - exit 1 - ;; - esac - git fetch origin "$CANDIDATE_BRANCH" --quiet - sha="$(git rev-parse --verify "origin/${CANDIDATE_BRANCH}^{commit}" 2>/dev/null || true)" - if [ -z "$sha" ]; then - echo "Error: candidate branch $CANDIDATE_BRANCH does not exist on origin." >&2 - exit 1 - fi - - existing_beta="$(git tag --points-at "$sha" | grep '^beta/v' | head -1 || true)" - if [ -n "$existing_beta" ]; then - echo "Error: candidate head $sha already shipped as $existing_beta." >&2 - exit 1 - fi - - if ! git show "${sha}:scripts/release.sh" | grep -qF -- '--from-candidate'; then - echo "Error: candidate head $sha predates candidate-build release tooling; rebase the candidate onto a newer base." >&2 - exit 1 - fi - - merge_base="$(git merge-base origin/master "$sha")" - echo "mode=candidate" >> "$GITHUB_OUTPUT" - echo "sha=$sha" >> "$GITHUB_OUTPUT" - echo "nightly_version=" >> "$GITHUB_OUTPUT" - { - echo "## Beta candidate branch" - echo "" - echo "- Branch: \`$CANDIDATE_BRANCH\`" - echo "- Head: \`$sha\`" - echo "- Base (merge-base with master): \`$merge_base\`" - echo "- Cherry-picked commits:" - echo "" - echo '\`\`\`' - git log --oneline "${merge_base}..${sha}" - echo '\`\`\`' - } >> "$GITHUB_STEP_SUMMARY" - exit 0 - fi - - echo "mode=promote" >> "$GITHUB_OUTPUT" - - if [ -n "${EXPLICIT_NIGHTLY_VERSION:-}" ]; then - tag="nightly/v${EXPLICIT_NIGHTLY_VERSION}" - sha="$(git rev-list -n 1 "$tag" 2>/dev/null || true)" - if [ -z "$sha" ]; then - echo "Error: tag $tag does not exist." >&2 - exit 1 - fi - else - # Newest nightly-tagged commit on master. - sha="$(grep -m1 -F \ - -f <(git for-each-ref 'refs/tags/nightly/v*' --format='%(objectname)') \ - <(git rev-list origin/master -n 2000) || true)" - - if [ -z "$sha" ]; then - echo "Error: no nightly/v* tag found on the last 2000 commits of master. Publish a nightly first, or pass source_version." >&2 - exit 1 - fi - - tag="$(git tag --points-at "$sha" | grep '^nightly/v' | sort -V | tail -1)" - fi - - nightly_version="${tag#nightly/v}" - - existing_beta="$(git tag --points-at "$sha" | grep '^beta/v' | head -1 || true)" - if [ -n "$existing_beta" ]; then - echo "Error: candidate $sha (nightly $nightly_version) already shipped as $existing_beta." >&2 - exit 1 - fi - - # Promotions run the release tooling of the source commit, so the - # source must already understand the beta channel. (Literal match of - # release.sh's channel case arm; if that line is reformatted this - # fails closed and should be updated alongside it.) - if ! git show "${sha}:scripts/release.sh" | grep -qF 'canary|nightly|beta|stable)'; then - echo "Error: source commit $sha predates beta release tooling; promote a newer nightly whose source contains the beta channel." >&2 - exit 1 - fi - - echo "sha=$sha" >> "$GITHUB_OUTPUT" - echo "nightly_version=$nightly_version" >> "$GITHUB_OUTPUT" - { - echo "## Beta candidate" - echo "" - echo "- Source SHA: \`$sha\`" - echo "- Source nightly: \`$nightly_version\`" - } >> "$GITHUB_STEP_SUMMARY" - - # Candidate-branch heads are new commits that never went through a canary - # or nightly, so they must pass full verification before publishing. - # Promoted nightlies were already verified by their canary run and skip it. - verify_beta_candidate: - needs: select_beta - if: needs.select_beta.outputs.mode == 'candidate' - uses: ./.github/workflows/release-verify.yml - with: - ref: ${{ needs.select_beta.outputs.sha }} - - publish_beta: - needs: [select_beta, verify_beta_candidate] - if: >- - !cancelled() && - needs.select_beta.result == 'success' && - (needs.verify_beta_candidate.result == 'success' || - (needs.verify_beta_candidate.result == 'skipped' && needs.select_beta.outputs.mode == 'promote')) - runs-on: ubuntu-latest - timeout-minutes: 90 - environment: npm-beta - # Serialize beta publishes so two dispatches cannot race to the same next - # -beta.N version; release.sh additionally refuses to double-publish a - # commit that already carries a beta tag. - concurrency: - group: release-publish-beta - cancel-in-progress: false - permissions: - contents: write - id-token: write - actions: write - outputs: - beta_version: ${{ steps.result.outputs.beta_version }} - - steps: - - name: Checkout repository - uses: actions/checkout@v7 - with: - ref: ${{ needs.select_beta.outputs.sha }} - fetch-depth: 0 - - - name: Setup pnpm - uses: pnpm/action-setup@v6 - with: - version: 9.15.4 - - - name: Setup Node.js - uses: actions/setup-node@v7 - with: - node-version: 24 - cache: pnpm - - - name: Validate release package manifest - run: node ./scripts/release-package-map.mjs check - - - name: Install dependencies - run: pnpm install --no-frozen-lockfile - - - name: Restore tracked install-time changes - run: git checkout -- pnpm-lock.yaml - - - name: Configure git author - run: | - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - - - name: Publish beta - env: - GITHUB_ACTIONS: "true" - run: | - args=(beta --skip-verify) - if [ "${{ needs.select_beta.outputs.mode }}" = "candidate" ]; then - args+=(--from-candidate) - fi - if [ "${{ inputs.dry_run }}" = "true" ]; then - args+=(--dry-run) - fi - ./scripts/release.sh "${args[@]}" - - - name: Dump npm debug logs - if: failure() - run: | - shopt -s nullglob - for f in "$HOME"/.npm/_logs/*.log; do - echo "===== $f =====" - tail -n 300 "$f" | sed -E \ - -e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig' - done - - - name: Push beta tag - if: ${{ !inputs.dry_run }} - run: | - tag="$(git tag --points-at HEAD | grep '^beta/v' | head -1)" - if [ -z "$tag" ]; then - echo "Error: no beta tag points at HEAD after release." >&2 - exit 1 - fi - if ! git push origin "refs/tags/${tag}"; then - sha="$(git rev-parse HEAD)" - { - echo "## Tag push rejected" - echo "" - echo "The npm publish succeeded, but pushing \`${tag}\` was rejected." - echo "This usually means the tagged commit modifies workflow files," - echo "which GITHUB_TOKEN may not reference when creating refs from" - echo "dispatch or scheduled runs. Recover with maintainer credentials:" - echo "" - echo '```' - echo "git tag ${tag} ${sha}" - echo "git push origin refs/tags/${tag}" - echo "gh workflow run docker.yml --ref refs/tags/${tag}" - echo '```' - } >> "$GITHUB_STEP_SUMMARY" - echo "::error::Tag push rejected; see the job summary for recovery commands." >&2 - exit 1 - fi - - # Tag pushes made with GITHUB_TOKEN do not fire docker.yml's tag - # trigger (GitHub suppresses workflow runs caused by GITHUB_TOKEN - # pushes), so dispatch the image build at the new tag explicitly. - - name: Build Docker images for the beta tag - id: result - if: ${{ !inputs.dry_run }} - env: - GH_TOKEN: ${{ github.token }} - run: | - tag="$(git tag --points-at HEAD | grep '^beta/v' | head -1)" - echo "beta_version=${tag#beta/v}" >> "$GITHUB_OUTPUT" - { - echo "## Beta published" - echo "" - echo "- Source SHA: \`${{ needs.select_beta.outputs.sha }}\`" - echo "- Source nightly: \`${{ needs.select_beta.outputs.nightly_version }}\`" - echo "- Published beta: \`${tag#beta/v}\`" - echo "- Docker build dispatched at \`${tag}\`" - } >> "$GITHUB_STEP_SUMMARY" - gh workflow run docker.yml --ref "refs/tags/${tag}" --repo "$GITHUB_REPOSITORY" - - # Draft the eventual stable's release notes the moment the beta exists: - # the promoted bits are frozen now, and the 3-day soak is the natural - # review window. The draft lands on a machine-owned branch; a human opens - # and merges the PR, because a PR created with GITHUB_TOKEN would not - # trigger the pr.yml checks a merge requires. - draft_stable_notes: - needs: [select_beta, publish_beta] - if: ${{ !cancelled() && !inputs.dry_run && needs.publish_beta.result == 'success' }} - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - contents: write - # gh pr view needs PR read for the skeleton's nested summaries; - # without it the enrichment silently degrades to bare subjects. - pull-requests: read - steps: - - name: Checkout repository - uses: actions/checkout@v7 - with: - ref: master - fetch-depth: 0 - - - name: Configure git author - run: | - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - - - name: Draft stable notes from the published beta - env: - # gh needs a token so the generator can nest each PR's summary - # under its subject line (best-effort thoroughness). - GH_TOKEN: ${{ github.token }} - BETA_VERSION: ${{ needs.publish_beta.outputs.beta_version }} - SOURCE_SHA: ${{ needs.select_beta.outputs.sha }} - run: | - set -euo pipefail - git fetch origin --tags --quiet - # A rejected beta tag push (the workflows-permission case) leaves - # the tag absent from origin while npm already has the beta; - # recreate it locally so drafting does not block on the manual - # tag recovery. - if ! git rev-parse --verify "refs/tags/beta/v${BETA_VERSION}" >/dev/null 2>&1; then - git tag "beta/v${BETA_VERSION}" "${SOURCE_SHA}" - fi - ./scripts/draft-stable-notes.sh "${BETA_VERSION}" - - - name: Push the draft branch - env: - BETA_VERSION: ${{ needs.publish_beta.outputs.beta_version }} - run: | - set -euo pipefail - branch="release-notes/v${BETA_VERSION}" - git checkout -B "$branch" - git add "releases/beta/v${BETA_VERSION}.md" - git commit -m "docs(release): draft stable notes for beta ${BETA_VERSION}" - # Machine-owned branch: force push so a re-run regenerates cleanly. - git push -f origin "$branch" - { - echo "## Stable notes draft pushed" - echo "" - echo "- Branch: \`${branch}\`" - echo "- Open the PR (a human opens it so CI runs):" - echo " https://github.com/${GITHUB_REPOSITORY}/compare/master...${branch}?expand=1" - echo "- Edit it during the soak. The stable promotion reads" - echo " \`releases/beta/v${BETA_VERSION}.md\` from master." - } >> "$GITHUB_STEP_SUMMARY" - - # Post-publish verification: run the release smoke suite against the exact - # beta version that was just published. - # - # The condition must carry an explicit status-check function: without one, - # GitHub attaches an implicit success(), which evaluates the needs chain - # transitively — and publish_beta's chain contains verify_beta_candidate, - # which is skipped on every promote-mode beta. The implicit form silently - # skipped this job on the first promote-mode beta after the candidate - # lane landed. - smoke_beta: - needs: publish_beta - if: ${{ !cancelled() && needs.publish_beta.result == 'success' && !inputs.dry_run }} - uses: ./.github/workflows/release-smoke.yml - with: - paperclip_version: ${{ needs.publish_beta.outputs.beta_version }} - artifact_name: beta-release-smoke - - # ----- Stable lane ------------------------------------------------------ - - # Stable releases promote a soaked beta. The preflight enforces that the - # source commit shipped as a beta at least 3 days ago (measured from the - # npm publish time of that beta version), unless a written justification - # is provided. Dry runs report soak state without blocking. - # Resolves source_ref to an immutable commit exactly once; every downstream - # stable job consumes that SHA. Otherwise a branch or movable tag that - # advances mid-run could be soak-checked at one commit and verified or - # published at another. - preflight_stable: - if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - contents: read - outputs: - sha: ${{ steps.soak.outputs.sha }} - beta_version: ${{ steps.soak.outputs.beta_version }} - stable_version: ${{ steps.notes.outputs.stable_version }} - notes_mode: ${{ steps.notes.outputs.notes_mode }} - notes_path: ${{ steps.notes.outputs.notes_path }} - notes_ref: ${{ steps.notes.outputs.notes_ref }} - steps: - - name: Checkout repository - uses: actions/checkout@v7 - with: - ref: master - fetch-depth: 0 - - - name: Check beta soak - id: soak - env: - SOURCE_REF: ${{ inputs.source_ref }} - JUSTIFICATION: ${{ inputs.skip_soak_justification }} - DRY_RUN: ${{ inputs.dry_run }} - run: | - set -euo pipefail - - git fetch origin --tags --prune --quiet - - sha="$(git rev-parse --verify "${SOURCE_REF}^{commit}" 2>/dev/null || true)" - if [ -z "$sha" ]; then - git fetch origin "$SOURCE_REF" --quiet || true - sha="$(git rev-parse --verify "FETCH_HEAD^{commit}" 2>/dev/null || true)" - fi - if [ -z "$sha" ]; then - echo "Error: could not resolve source_ref '$SOURCE_REF' to a commit." >&2 - exit 1 - fi - - echo "sha=$sha" >> "$GITHUB_OUTPUT" - { - echo "## Stable source pinned" - echo "" - echo "- source_ref: \`${SOURCE_REF}\` -> \`$sha\`" - } >> "$GITHUB_STEP_SUMMARY" - - fail_or_justify() { - if [ -n "${JUSTIFICATION:-}" ]; then - { - echo "## Stable soak gate bypassed" - echo "" - echo "$1" - echo "" - echo "Justification: ${JUSTIFICATION}" - } >> "$GITHUB_STEP_SUMMARY" - echo "::warning::Soak gate bypassed: $1" - return 0 - fi - if [ "${DRY_RUN}" = "true" ]; then - echo "::warning::Soak gate would block a real release: $1" - { - echo "## Stable soak gate (dry run)" - echo "" - echo "A real release would be blocked: $1" - } >> "$GITHUB_STEP_SUMMARY" - return 0 - fi - echo "Error: $1" >&2 - echo "Pass skip_soak_justification with a written reason to release anyway." >&2 - exit 1 - } - - beta_tag="$(git tag --points-at "$sha" | grep '^beta/v' | sort -V | tail -1 || true)" - if [ -z "$beta_tag" ]; then - fail_or_justify "source commit $sha never shipped as a beta (no beta/v* tag)." - exit 0 - fi - - beta_version="${beta_tag#beta/v}" - echo "beta_version=${beta_version}" >> "$GITHUB_OUTPUT" - publish_time="$(npm view "paperclipai@${beta_version}" time --json 2>/dev/null \ - | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{const t=JSON.parse(d);process.stdout.write(typeof t === "string" ? t : (t[process.argv[1]] ?? ""))})' "$beta_version" || true)" - if [ -z "$publish_time" ]; then - fail_or_justify "could not determine the npm publish time of beta ${beta_version}." - exit 0 - fi - - age_seconds="$(node -e 'process.stdout.write(String(Math.floor((Date.now() - Date.parse(process.argv[1])) / 1000)))' "$publish_time")" - min_seconds=$((3 * 24 * 60 * 60)) - age_days="$(node -e 'process.stdout.write((Number(process.argv[1]) / 86400).toFixed(1))' "$age_seconds")" - - if [ "$age_seconds" -lt "$min_seconds" ]; then - fail_or_justify "beta ${beta_version} has only soaked ${age_days} days (minimum is 3)." - exit 0 - fi - - { - echo "## Stable soak gate passed" - echo "" - echo "- Source beta: \`${beta_version}\`" - echo "- Soak time: ${age_days} days" - } >> "$GITHUB_STEP_SUMMARY" - - # The stable notes need not exist inside the promoted source commit: - # a promoted beta's notes are drafted on master (releases/beta/v*.md) - # at beta-publish time and edited during the soak. Resolve which copy - # publish_stable should read, and fail early — before the npm-stable - # approval gate — when none exists. Notes inside the source tree - # (the candidate fix path) take precedence. - - name: Resolve stable release notes - id: notes - env: - SHA: ${{ steps.soak.outputs.sha }} - BETA_VERSION: ${{ steps.soak.outputs.beta_version }} - STABLE_DATE: ${{ inputs.stable_date }} - DRY_RUN: ${{ inputs.dry_run }} - run: | - set -euo pipefail - - # Pin the master revision the notes were resolved at, so the - # publish and canonicalization steps read the same content even - # when master advances during the approval delay. - echo "notes_ref=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" - - args=(stable --print-version) - if [ -n "${STABLE_DATE}" ]; then - args+=(--date "${STABLE_DATE}") - fi - version="$(./scripts/release.sh "${args[@]}")" - echo "stable_version=${version}" >> "$GITHUB_OUTPUT" - - if git cat-file -e "${SHA}:releases/v${version}.md" 2>/dev/null; then - echo "notes_mode=source_tree" >> "$GITHUB_OUTPUT" - echo "notes_path=releases/v${version}.md" >> "$GITHUB_OUTPUT" - echo "- Stable notes: \`releases/v${version}.md\` at the source commit" >> "$GITHUB_STEP_SUMMARY" - exit 0 - fi - - if [ -n "${BETA_VERSION}" ] && [ -f "releases/beta/v${BETA_VERSION}.md" ]; then - echo "notes_mode=master_beta" >> "$GITHUB_OUTPUT" - echo "notes_path=releases/beta/v${BETA_VERSION}.md" >> "$GITHUB_OUTPUT" - echo "- Stable notes: \`releases/beta/v${BETA_VERSION}.md\` on master" >> "$GITHUB_STEP_SUMMARY" - exit 0 - fi - - msg="no release notes found for stable ${version}: neither releases/v${version}.md at the source commit nor releases/beta/v${BETA_VERSION:-}.md on master. Merge the notes PR from the beta's draft branch (release-notes/v), or add the file to the source ref." - if [ "${DRY_RUN}" = "true" ]; then - echo "::warning::${msg}" - echo "- Stable notes: MISSING (a real release would be blocked)" >> "$GITHUB_STEP_SUMMARY" - echo "notes_mode=missing" >> "$GITHUB_OUTPUT" - exit 0 - fi - echo "::error::${msg}" - exit 1 - - verify_stable: - if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' - needs: preflight_stable - uses: ./.github/workflows/release-verify.yml - with: - ref: ${{ needs.preflight_stable.outputs.sha }} - - preview_stable: - if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && inputs.dry_run - needs: [preflight_stable, verify_stable] - runs-on: ubuntu-latest - timeout-minutes: 45 - permissions: - contents: read - - steps: - - name: Checkout repository - uses: actions/checkout@v7 - with: - fetch-depth: 0 - ref: ${{ needs.preflight_stable.outputs.sha }} - - - name: Setup pnpm - uses: pnpm/action-setup@v6 - with: - version: 9.15.4 - - - name: Setup Node.js - uses: actions/setup-node@v7 - with: - node-version: 24 - cache: pnpm - - - name: Validate release package manifest - run: node ./scripts/release-package-map.mjs check - - - name: Install dependencies - run: pnpm install --no-frozen-lockfile - - - name: Dry-run stable release - env: - GITHUB_ACTIONS: "true" - run: | - args=(stable --skip-verify --dry-run) - if [ -n "${{ inputs.stable_date }}" ]; then - args+=(--date "${{ inputs.stable_date }}") - fi - ./scripts/release.sh "${args[@]}" - - publish_stable: - if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && !inputs.dry_run - needs: [preflight_stable, verify_stable] - runs-on: ubuntu-latest - timeout-minutes: 90 - environment: npm-stable - permissions: - contents: write - id-token: write - actions: write - outputs: - stable_version: ${{ steps.tag.outputs.version }} - - steps: - - name: Checkout repository - uses: actions/checkout@v7 - with: - fetch-depth: 0 - ref: ${{ needs.preflight_stable.outputs.sha }} - - - name: Setup pnpm - uses: pnpm/action-setup@v6 - with: - version: 9.15.4 - - - name: Setup Node.js - uses: actions/setup-node@v7 - with: - node-version: 24 - cache: pnpm - - - name: Install dependencies - run: pnpm install --no-frozen-lockfile - - - name: Restore tracked install-time changes - run: git checkout -- pnpm-lock.yaml - - - name: Configure git author - run: | - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - - # A promoted beta's notes live on master (drafted at beta publish, - # edited during the soak), not inside the promoted source commit — a - # commit cannot carry a file named for a promotion date that was - # unknown when it was created. Materialize them outside the worktree - # so release.sh still runs against a clean source checkout. - - name: Materialize stable release notes from master - if: needs.preflight_stable.outputs.notes_mode == 'master_beta' - env: - NOTES_REF: ${{ needs.preflight_stable.outputs.notes_ref }} - NOTES_PATH: ${{ needs.preflight_stable.outputs.notes_path }} - run: | - set -euo pipefail - git fetch origin master --quiet - git show "${NOTES_REF}:${NOTES_PATH}" > "$RUNNER_TEMP/stable-notes.md" - echo "STABLE_NOTES_FILE=$RUNNER_TEMP/stable-notes.md" >> "$GITHUB_ENV" - - - name: Publish stable - env: - GITHUB_ACTIONS: "true" - run: | - args=(stable --skip-verify) - if [ -n "${{ inputs.stable_date }}" ]; then - args+=(--date "${{ inputs.stable_date }}") - fi - if [ -n "${STABLE_NOTES_FILE:-}" ]; then - args+=(--notes-file "$STABLE_NOTES_FILE") - fi - ./scripts/release.sh "${args[@]}" - - - name: Dump npm debug logs - if: failure() - run: | - shopt -s nullglob - for f in "$HOME"/.npm/_logs/*.log; do - echo "===== $f =====" - tail -n 300 "$f" | sed -E \ - -e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig' - done - - - name: Push stable tag - id: tag - run: | - tag="$(git tag --points-at HEAD | grep '^v' | head -1)" - if [ -z "$tag" ]; then - echo "Error: no stable tag points at HEAD after release." >&2 - exit 1 - fi - echo "version=${tag#v}" >> "$GITHUB_OUTPUT" - if ! git push origin "refs/tags/${tag}"; then - sha="$(git rev-parse HEAD)" - { - echo "## Tag push rejected" - echo "" - echo "The npm publish succeeded, but pushing \`${tag}\` was rejected." - echo "This usually means the tagged commit modifies workflow files," - echo "which GITHUB_TOKEN may not reference when creating refs from" - echo "dispatch or scheduled runs. Recover with maintainer credentials:" - echo "" - echo '```' - echo "git tag ${tag} ${sha}" - echo "git push origin refs/tags/${tag}" - echo "gh workflow run docker.yml --ref refs/tags/${tag}" - echo "./scripts/create-github-release.sh ${tag#v}" - echo '```' - } >> "$GITHUB_STEP_SUMMARY" - echo "::error::Tag push rejected; see the job summary for recovery commands." >&2 - exit 1 - fi - - # Tag pushes made with GITHUB_TOKEN do not fire docker.yml's tag - # trigger (GitHub suppresses workflow runs caused by GITHUB_TOKEN - # pushes), so dispatch the image build at the new tag explicitly. This - # is what moves Docker `:latest` and publishes the versioned stable - # image tags. - - name: Build Docker images for the stable tag - env: - GH_TOKEN: ${{ github.token }} - run: | - tag="$(git tag --points-at HEAD | grep '^v' | head -1)" - if gh workflow run docker.yml --ref "refs/tags/${tag}" --repo "$GITHUB_REPOSITORY"; then - echo "Dispatched docker.yml at ${tag}." - else - # Older source commits may predate docker.yml's workflow_dispatch - # trigger; the dispatch then fails while the npm release is - # already complete and correct. - echo "::warning::Could not dispatch docker.yml at ${tag}. Run docker.yml manually at that tag to publish the stable images." - fi - - - name: Create GitHub Release - env: - GH_TOKEN: ${{ github.token }} - PUBLISH_REMOTE: origin - run: | - version="$(git tag --points-at HEAD | grep '^v' | head -1 | sed 's/^v//')" - if [ -z "$version" ]; then - echo "Error: no v* tag points at HEAD after stable release." >&2 - exit 1 - fi - args=("$version") - if [ -n "${STABLE_NOTES_FILE:-}" ]; then - args+=(--notes-file "$STABLE_NOTES_FILE") - fi - ./scripts/create-github-release.sh "${args[@]}" - - # After a stable ships from master-side beta notes, move the file to its - # canonical home (releases/vYYYY.MDD.P.md) so the stable-notes invariant - # holds durably. Machine-owned branch + human-opened PR, as with the - # draft job above. - canonicalize_stable_notes: - needs: [preflight_stable, publish_stable] - if: ${{ needs.preflight_stable.outputs.notes_mode == 'master_beta' && needs.publish_stable.result == 'success' }} - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - contents: write - steps: - - name: Checkout repository - uses: actions/checkout@v7 - with: - ref: master - fetch-depth: 0 - - - name: Configure git author - run: | - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - - - name: Push the canonicalization branch - env: - STABLE_VERSION: ${{ needs.publish_stable.outputs.stable_version }} - NOTES_PATH: ${{ needs.preflight_stable.outputs.notes_path }} - NOTES_REF: ${{ needs.preflight_stable.outputs.notes_ref }} - run: | - set -euo pipefail - branch="release-notes/v${STABLE_VERSION}-canonicalize" - git checkout -B "$branch" - # Canonicalize exactly what shipped: take the notes at the pinned - # revision the release read them from, so a master edit made - # during the run surfaces as a reviewable diff in this PR instead - # of silently diverging from the published GitHub Release. - git show "${NOTES_REF}:${NOTES_PATH}" > "releases/v${STABLE_VERSION}.md" - git add "releases/v${STABLE_VERSION}.md" - if git ls-files --error-unmatch "${NOTES_PATH}" >/dev/null 2>&1; then - git rm -q "${NOTES_PATH}" - fi - git commit -m "docs(release): canonicalize stable notes for v${STABLE_VERSION}" - git push -f origin "$branch" - { - echo "## Stable notes canonicalization pushed" - echo "" - echo "- Branch: \`${branch}\`" - echo "- Open and merge the PR (a human opens it so CI runs):" - echo " https://github.com/${GITHUB_REPOSITORY}/compare/master...${branch}?expand=1" - } >> "$GITHUB_STEP_SUMMARY"