imccyu
d9dcf5a484
The root manifest carries the dsh family version. bump writes it with the members, because the workspace constraint requires them to match, and that constraint now accepts a prerelease segment: without both, release:dsh 0.0.2 left the root behind and 0.0.1-rc.1 could satisfy neither check. The Landlock workflow no longer passes --access public, which overrode the restricted publishConfig this repository just adopted for those packages. Vendored change detection reads build inputs when a package publishes build output, and vendor/cordis publishes the src its export map already pointed at: its lib/ is untracked, so a real source edit read as 'nothing changed' and the next publish would fail on a version whose bytes moved. The next version also takes the last published version as its baseline, so a re-sync that restores a lower upstream version cannot recompute a version already on the registry, and bump confirms the registry carries what the newest tag names. Tag prefixes are constructed rather than recovered from a full tag, which a hyphenated version defeated. Pack runs group per ref so concurrent pull requests stop displacing each other, the publish job carries the global group, and the unused id-token permission is gone. Every release script sits behind an entry guard, which is what lets the pure judgements carry tests: tag naming, publish order and cycle reporting, version arithmetic, payload policy, and the change judgement. The Agent Note moves to implemented and states what shipped: one probe command, the registry confirmation that now exists, and byte reproducibility recorded as assumed rather than measured.
71 lines
2.9 KiB
TypeScript
71 lines
2.9 KiB
TypeScript
/**
|
|
* Verify a release family's version baseline, and — when publishing — that the
|
|
* run comes from the family's tag and its members are publishable.
|
|
*
|
|
* Publication happens only from GitHub Actions, so the tag and publishability
|
|
* checks are gates on the workflow, not advisory local warnings
|
|
* ([rationale](../../.agents/notes/implemented/process/2026-08-10-npm-release-sequences.md)).
|
|
*/
|
|
|
|
import { parseArgs } from 'node:util'
|
|
import { isEntry } from './process.ts'
|
|
import { releaseFamily, type ReleaseFamily, type ReleaseMember } from './families.ts'
|
|
|
|
/**
|
|
* Assert every member may be published: npm refuses a `private` package.
|
|
* @param members - the family's members.
|
|
*/
|
|
function verifyPublishable(members: readonly ReleaseMember[]): void {
|
|
const priv = members.filter(member => member.manifest.private === true)
|
|
if (priv.length > 0) {
|
|
throw new Error(`publishing requires removing "private": true from:\n${priv.map(member => member.directory).join('\n')}`)
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Assert the workflow runs from a tag this family publishes from, and that the
|
|
* tag names a version the family actually carries.
|
|
* @param family - the release family.
|
|
* @param members - the family's members.
|
|
* @param ref - the `GITHUB_REF` value.
|
|
*/
|
|
function verifyTag(family: ReleaseFamily, members: readonly ReleaseMember[], ref: string): void {
|
|
const prefix = 'refs/tags/'
|
|
if (!ref.startsWith(prefix)) {
|
|
throw new Error(`publishing release family ${family.id} requires running from a ${family.tagPrefix}* tag, got ${ref || '(no ref)'}`)
|
|
}
|
|
const tag = ref.slice(prefix.length)
|
|
if (!tag.startsWith(family.tagPrefix)) {
|
|
throw new Error(`tag ${tag} does not belong to release family ${family.id} (expected ${family.tagPrefix}*)`)
|
|
}
|
|
const expected = members.map(member => family.tagFor(member))
|
|
if (!expected.includes(tag)) {
|
|
throw new Error(`tag ${tag} names no version this family carries; its members would tag as:\n${[...new Set(expected)].join('\n')}`)
|
|
}
|
|
}
|
|
|
|
/** Run the verification for the family named by `--family`. */
|
|
function main(): void {
|
|
const { values } = parseArgs({
|
|
options: { family: { type: 'string' } },
|
|
allowPositionals: false,
|
|
})
|
|
if (values.family === undefined) throw new Error('usage: verify.ts --family <dsh|vendor>')
|
|
|
|
const family = releaseFamily(values.family)
|
|
const members = family.members(process.cwd())
|
|
family.verifyVersions(members)
|
|
|
|
const publishing = process.env.RELEASE_PUBLISH === 'true'
|
|
if (publishing) {
|
|
verifyPublishable(members)
|
|
verifyTag(family, members, process.env.GITHUB_REF ?? '')
|
|
}
|
|
|
|
const versions = [...new Set(members.map(member => member.version))]
|
|
const summary = versions.length === 1 ? versions[0] : `${String(versions.length)} versions`
|
|
console.log(`release verify: family ${family.id}, ${String(members.length)} member(s), ${summary}${publishing ? ', publish gates passed' : ''}`)
|
|
}
|
|
|
|
if (isEntry(import.meta.url)) main()
|