ci(release): make engine npm-publish opt-in; keep GitHub Release binaries#162
Merged
Conversation
…ries `@opencoven/coven-code` is deprecated — the engine now ships as a GitHub Release binary that `coven` installs and pins. So npm publishing must never be automatic: - release.yml: add a `publish_npm` input (default false) and gate the npm-publish dispatch on it. Default releases produce binaries + checksums only. - npm-publish.yml: drop the `workflow_run: [Release]` auto-trigger (it would otherwise fire on any Release completion and republish the deprecated package, undoing the deprecation). Now workflow_dispatch-only; release.yml invokes it explicitly only when publish_npm=true. Removed the now-dead workflow_run checkout branch.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Pull request overview
This PR updates the engine release automation so that publishing the deprecated @opencoven/coven-code npm package is opt-in, while continuing to produce GitHub Release binaries and checksums (the installation path used by coven).
Changes:
- Adds a
publish_npmboolean input (defaultfalse) torelease.ymland gates dispatchingnpm-publish.ymlon it. - Removes the
workflow_runauto-trigger fromnpm-publish.yml, making itworkflow_dispatch-only, while still allowingrelease.ymlto dispatch it when explicitly requested.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/release.yml | Adds an opt-in input and conditionally dispatches npm publishing. |
| .github/workflows/npm-publish.yml | Removes automatic workflow_run triggering so npm publishing is manual/explicit only. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
397
to
+401
| # auto-cut releases. Dispatching directly here makes the publish step | ||
| # deterministic — the workflow_run trigger stays as a manual-release | ||
| # fallback. | ||
| - name: Dispatch npm-publish.yml | ||
| if: ${{ inputs.publish_npm }} |
| (github.event_name == 'workflow_run' && | ||
| github.event.workflow_run.conclusion == 'success' && | ||
| github.event.workflow_run.head_branch == 'main') | ||
| if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' |
12 tasks
BunsDev
added a commit
that referenced
this pull request
Jul 15, 2026
…164) Close out the coven CLI unification paperwork now that every phase has landed: - unification.md: status complete; phase table rows 5 and 6 finalized (Phase 5 landed via #154/#158/#160 with the npm deprecation executed and npm-publish made opt-in in #162; Phase 6 decided NO-GO via #155); npm-package note rewritten in past tense. - superpowers plans: COMPLETE status banners on the master plan and the phase 3/4/5 sub-plans pointing at docs/unification.md as the living summary; phase 5 task 5.3 marked done (coven-side version_line landed) and task 5.6 recorded as executed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Prep for cutting the engine's v0.7.0 release (unification + brand) without republishing the now-deprecated
@opencoven/coven-codenpm package.coveninstalls and pins the engine as a GitHub Release binary, so an engine release only needs archives + checksums — not npm. But todayrelease.ymlunconditionally dispatchesnpm-publish.yml, andnpm-publish.ymlhas aworkflow_run: [Release]auto-trigger. Either path would publish a fresh@opencoven/coven-codeversion, which is not covered by the existing blanket deprecation — silently un-deprecating the package.Changes
release.yml— newpublish_npmboolean input (defaultfalse); the "Dispatch npm-publish.yml" step is gated on it. Default releases = binaries + checksums only.npm-publish.yml— removed theworkflow_runauto-trigger and its dead checkout branch; job is nowworkflow_dispatch-only.release.ymlstill invokes it explicitly whenpublish_npm=true, so intentional re-publishes remain possible.Verification
ruby -ryaml); each now exposes only theworkflow_dispatchtrigger.No change to the binary build, GitHub Release, or checksum steps.