ci: publish npm and Homebrew from the GitHub Release event - #272
Conversation
Adopts the fleet-standard automated release (acpx's guards, provenance via npm trusted publishing, CodexBar's tap dispatch) but triggers on release:published rather than tag push, so the locally signed and verified native artifacts keep their place ahead of publication. npm ships the exact verified Release tarball instead of repacking the checkout. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The bare 2.5s bound left only ~600ms over the 700/700/500ms SIGTERM/SIGKILL escalation, which flaked at 3.8s on a Windows runner where process-tree enumeration is slower. Derive it from the escalation constants with platform headroom; removing the SIGKILL escalation still fails the test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ff21c2e514
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| run: | | ||
| set -euo pipefail | ||
| git fetch --no-tags origin "$DEFAULT_BRANCH" --depth=1 | ||
| release_sha="$(git rev-parse "$RELEASE_TAG^{commit}")" |
There was a problem hiding this comment.
If the tag is deleted/recreated after the native verifier succeeds but before this Release job runs, this step only resolves $RELEASE_TAG^{commit} and later compares that commit to the proof; a lightweight or otherwise unsigned tag pointing at the same commit still passes the branch/proof checks because the proof artifact is not bound to the tag object. That lets npm be published for a release whose current public tag no longer satisfies the signed-tag trust boundary enforced by package-release.sh/verify-release.sh; configure .github/release-allowed-signers here and run git tag -v "$RELEASE_TAG" after checkout before accepting the tag.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
the
rating: 🦐 gold shrimp
The suite spawns the real CLI repeatedly; it runs ~25s locally and ~100s on a Windows runner, so a flat 30s per-test budget timed out there. Scale the long budgets by platform instead of tuning them one flake at a time — they exist to catch hangs, not to measure machine speed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
clawsweeper
Bot
added
the
status: ⏳ waiting on author
|
ClawSweeper status: review started. I am starting a fresh review of this pull request: ci: publish npm and Homebrew from the GitHub Release event This is item 1/1 in the current shard. Shard 0/1. This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking. Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted. |
1 participant
mcporter was the only repo in the fleet still publishing npm by hand. This adopts the standard used by
acpxandCodexBar, without giving up the native trust contract this repo established at v0.12.4.What it adopts
From
acpx/.github/workflows/release.yml: GitHub-hostedubuntu-latestwithid-token: write, package-metadata validation, tag guards (vX.Y.Z, tag equalspackage.jsonversion, tagged commit is an ancestor oforigin/main), an "already published" check, andnpm publish --access public --provenancevia trusted publishing — noNPM_TOKEN. FromCodexBar: the Homebrew tap dispatch.The one deliberate deviation
acpxpublishes npm on tag push. mcporter cannot:docs/RELEASE.mdfixes the order as source gates → signed tag → locally signed and notarized native artifacts → protected draft verification → GitHub publication → npm → Homebrew, and states that no later stage may publish when an earlier proof is missing. A tag-push trigger would invert that.So this triggers on
release: published(plus aworkflow_dispatchfallback taking an existing tag). The maintainer still builds and verifies signed artifacts locally and publishes the Release; that publication event is what drives npm and Homebrew. A tag push alone cannot reach the registry.Two related properties worth calling out:
Prerequisite before the first run
npm trusted publishing must be configured on npmjs.com for
mcporter, pointing atopenclaw/mcporterand.github/workflows/release.yml. Until then--provenancecannot mint an OIDC identity. The workflow fails with an explicit message rather than silently falling back, anddocs/RELEASE.mdrecords the requirement.docs/RELEASE.mdandscripts/test-release.shunion this with the signing and notarization work from3128531/96a0989; no assertions were dropped from either side.Verified:
actionlintclean,pnpm checkclean,./scripts/test-release.shpasses for v0.13.0, 1,277 tests passing, autoreview clean. No changelog entry — this is release tooling, not user-facing behavior.🤖 Generated with Claude Code