ci: publish immutable npm dev packages#146
Merged
alongubkin merged 15 commits intoJul 20, 2026
Conversation
Greptile SummaryThis PR introduces a
Confidence Score: 4/5Safe to merge for the workflow structure and publish logic; the test hardcoded version literals will silently break the next triggered dev publish after any routine version bump. The workflow, rewrite logic, integrity-guarded publish, and dry-run default are all well-structured. The only concrete defect is in the test: it pins the expected dev version to a literal string, so any version bump to core or platform-api will cause the prepare job to fail, blocking every subsequent workflow_dispatch run until the literal is fixed. scripts/npm-dev-release.test.mjs — the hardcoded version assertions need attention before the next package bump.
|
| Filename | Overview |
|---|---|
| .github/workflows/publish-npm-dev.yml | New workflow_dispatch pipeline — prepare → parallel native-addon builds → pack-and-publish. Integrity guard, dry-run default, and version-format assertion before publish are all well-structured. |
| scripts/npm-dev-release.mjs | Version rewrite/validate/digest script; logic is correct. describeTarballs is exported but dead code. |
| scripts/npm-dev-release.test.mjs | Test harness works but hardcodes version literals 1.14.1 and 1.14.3 that will break the workflow prepare job after any routine version bump. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
WD[workflow_dispatch] --> P
subgraph prepare
P[Checkout + verify SHA] --> T[node --test npm-dev-release.test.mjs]
T --> OUT[outputs: git_sha, short_sha]
end
OUT --> B1 & B2 & B3 & B4
subgraph build-addon
B1[macos darwin-arm64]
B2[macos darwin-x64 cross]
B3[linux x86_64]
B4[linux aarch64]
end
B1 & B2 & B3 & B4 -->|artifacts| AP[npm-dev-addon-*]
subgraph pack-and-publish
AP --> ST[Stage addons]
ST --> RW[rewrite versions to dev.sha]
RW --> INJ[inject-optional-deps]
INJ --> VAL[validate manifests]
VAL --> PK[npm pack x11]
PK --> DG[digest tarballs]
DG --> SMK[smoke install]
SMK -->|dry_run=false| PUB[npm publish integrity-guarded]
PUB --> EV[upload evidence artifact]
end
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
WD[workflow_dispatch] --> P
subgraph prepare
P[Checkout + verify SHA] --> T[node --test npm-dev-release.test.mjs]
T --> OUT[outputs: git_sha, short_sha]
end
OUT --> B1 & B2 & B3 & B4
subgraph build-addon
B1[macos darwin-arm64]
B2[macos darwin-x64 cross]
B3[linux x86_64]
B4[linux aarch64]
end
B1 & B2 & B3 & B4 -->|artifacts| AP[npm-dev-addon-*]
subgraph pack-and-publish
AP --> ST[Stage addons]
ST --> RW[rewrite versions to dev.sha]
RW --> INJ[inject-optional-deps]
INJ --> VAL[validate manifests]
VAL --> PK[npm pack x11]
PK --> DG[digest tarballs]
DG --> SMK[smoke install]
SMK -->|dry_run=false| PUB[npm publish integrity-guarded]
PUB --> EV[upload evidence artifact]
end
Prompt To Fix All With AI
Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 2
scripts/npm-dev-release.test.mjs:29-30
Hardcoded version snapshot will fail after any version bump. The assertions pin `1.14.1` and `1.14.3` as literal strings, so the next time `@alienplatform/core` or `@alienplatform/platform-api` are bumped the `prepare` job will fail — breaking the entire publish workflow until someone manually updates the test. The base versions should be derived from the fixture's package.json files at runtime.
```suggestion
const coreBase = JSON.parse(readFileSync(resolve(root, "packages/core/package.json"), "utf8")).version.replace(/-.*$/, "")
const platformBase = JSON.parse(readFileSync(resolve(root, "client-sdks/platform/typescript/package.json"), "utf8")).version.replace(/-.*$/, "")
assert.equal(versions.get("@alienplatform/core"), `${coreBase}-dev.0123456789ab`)
assert.equal(versions.get("@alienplatform/platform-api"), `${platformBase}-dev.0123456789ab`)
```
### Issue 2 of 2
scripts/npm-dev-release.mjs:98-106
`describeTarballs` is dead code — it is exported but never called in the workflow or the tests. The workflow uses the `digest` subcommand for tarball evidence instead. Either call it or remove the export to keep the public API surface clean.
Reviews (1): Last reviewed commit: "fix: decouple npm source and workflow re..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+29
to
+30
| validateManifests(root, sha) | ||
|
|
There was a problem hiding this comment.
1.14.1 and 1.14.3 as literal strings, so the next time @alienplatform/core or @alienplatform/platform-api are bumped the prepare job will fail — breaking the entire publish workflow until someone manually updates the test. The base versions should be derived from the fixture's package.json files at runtime.
Suggested change
| validateManifests(root, sha) | |
| const coreBase = JSON.parse(readFileSync(resolve(root, "packages/core/package.json"), "utf8")).version.replace(/-.*$/, "") | |
| const platformBase = JSON.parse(readFileSync(resolve(root, "client-sdks/platform/typescript/package.json"), "utf8")).version.replace(/-.*$/, "") | |
| assert.equal(versions.get("@alienplatform/core"), `${coreBase}-dev.0123456789ab`) | |
| assert.equal(versions.get("@alienplatform/platform-api"), `${platformBase}-dev.0123456789ab`) |
Prompt To Fix With AI
This is a comment left during a code review.
Path: scripts/npm-dev-release.test.mjs
Line: 29-30
Comment:
Hardcoded version snapshot will fail after any version bump. The assertions pin `1.14.1` and `1.14.3` as literal strings, so the next time `@alienplatform/core` or `@alienplatform/platform-api` are bumped the `prepare` job will fail — breaking the entire publish workflow until someone manually updates the test. The base versions should be derived from the fixture's package.json files at runtime.
```suggestion
const coreBase = JSON.parse(readFileSync(resolve(root, "packages/core/package.json"), "utf8")).version.replace(/-.*$/, "")
const platformBase = JSON.parse(readFileSync(resolve(root, "client-sdks/platform/typescript/package.json"), "utf8")).version.replace(/-.*$/, "")
assert.equal(versions.get("@alienplatform/core"), `${coreBase}-dev.0123456789ab`)
assert.equal(versions.get("@alienplatform/platform-api"), `${platformBase}-dev.0123456789ab`)
```
How can I resolve this? If you propose a fix, please make it concise.
Comment on lines
+98
to
+106
| export function describeTarballs(packResults) { | ||
| return packResults.map(result => ({ | ||
| name: result.name, | ||
| version: result.version, | ||
| filename: basename(result.filename), | ||
| integrity: result.integrity, | ||
| shasum: result.shasum, | ||
| })) | ||
| } |
There was a problem hiding this comment.
describeTarballs is dead code — it is exported but never called in the workflow or the tests. The workflow uses the digest subcommand for tarball evidence instead. Either call it or remove the export to keep the public API surface clean.
Prompt To Fix With AI
This is a comment left during a code review.
Path: scripts/npm-dev-release.mjs
Line: 98-106
Comment:
`describeTarballs` is dead code — it is exported but never called in the workflow or the tests. The workflow uses the `digest` subcommand for tarball evidence instead. Either call it or remove the export to keep the public API surface clean.
How can I resolve this? If you propose a fix, please make it concise.Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
alongubkin
merged commit Jul 20, 2026
ad5e9c2
into
alon/alien-270-complete-reliable-tcp-and-stateful-workload-support-end-to
35 of 36 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
<base>-dev.<git-sha>prereleases and publish only under thedevdist-tagThe default is a dry run. The workflow never commits version changes, creates git tags, or updates npm
latest.Validation
node --test scripts/npm-dev-release.test.mjsnpm packof rewritten core and commands packages; verified exact internal dependency pin and built JS/type declarations in the tarballspnpm install --frozen-lockfileactionlint(only repository-specific Depot runner labels ignored)git diff --check