Repository navigation
fix(release): wait for required packages before publishing consumers - #539
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 20 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2709fc02b9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 4e1122a. Configure here.
There was a problem hiding this comment.
All reported issues were addressed
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
There was a problem hiding this comment.
All reported issues were addressed across 2 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
…age); drop duplicate gate (#540) * fix(release): one dependency wait on the publish path; drop the duplicate gate #538's assert-internal-deps gate and #539's reconcile-package wait both guarded publish order. Keep reconcile-package (retries transient registry errors, exact-floor check, transitive closure via registry manifests) and fold in the one thing only the gate covered: optionalDependencies (sdk -> cli-*/mount-*). Keep #538's dependency-first matrix order. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * test(release): bound each publish job slice at the next job Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
1 participant
Summary
@relayfile/*dependencies and non-optional SDK peers before publishing their consumers, including partial-release retriesProduction evidence
X Reply Radar run
41499d7d-11f0-4f45-bf5e-adb6f1fe8e37failed at2026-10-06T01:09:27Zwithnpm_install_failed:ETARGET No matching version found for @relayfile/core@0.10.73.The registry published
@relayfile/sdk@0.10.73at01:07:24.214Z, with a required exact dependency on@relayfile/core@0.10.73. Core did not become public until01:11:51.148Z. The parallel publish workflow exposed a broken consumer during that window.Production has recovered: all twelve hourly schedule fires from 02:09 through 13:09 UTC succeeded. The 13:09 run completed its local Grok Agent Flow without fallback, posted 15 results, and finished with exit 0. No agent redeploy is required to recover this already-completed publication; this change prevents the next release from exposing the same incomplete graph.
Validation
npm run test:release— 118 passedgit diff --checkOptional platform packages/peers and dev dependencies do not block publication. The shared strict release-version parser preserves prerelease/build metadata. Workflow-generated caret peers wait on their declared version floor; the required release graph is core → sdk → cli/agents.
Note
Medium Risk
Changes when packages become installable on npm and can delay or fail parallel publish jobs, but behavior is bounded, fail-closed, and heavily tested on the release path only.
Overview
Release reconciliation now blocks
npm publishuntil required internal packages are registry-visible, closing the parallel-publish window where consumers (e.g.@relayfile/sdk) could ship while dependencies (e.g.@relayfile/core) were still propagating and installs hitETARGET.Before publishing,
reconcile-package.mjswalks the transitive@relayfile/*closure from localdependenciesand non-optionalpeerDependencies, polls the registry with backoff under a shared ~10 minute budget, expands the graph from returned manifests (so a published SDK still waits on core), and fails closed on ambiguous queries, bad metadata, unpinnable ranges, or oversized graphs. Preflight and dry-run stay read-only and skip this wait; the publish workflow comment documents the ordering intent (core → sdk → cli).Coverage is added in
reconcile-package.test.mjsfor transitive waits, peer floors, budgets, and partial-release scenarios.Reviewed by Cursor Bugbot for commit d4a67a9. Bugbot is set up for automated code reviews on this repo. Configure here.