fix(ci): verify committed native artifacts without main self-push - #261
Conversation
🦋 Changeset detectedLatest commit: 60872a5 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
…ifact-freshness # Conflicts: # artifact/agent-bundle.compile-evidence.json # artifact/agent-bundle.manifest.json # artifact/hooks/event-route-session-start.claude.mjs # artifact/hooks/event-route-session-start.codex.mjs # artifact/hooks/event-route-session-start.cursor.mjs # artifact/hooks/event-route-stop.claude.mjs # artifact/hooks/event-route-stop.codex.mjs # artifact/hooks/event-route-stop.cursor.mjs # artifact/hooks/event-route-tool-after.claude.execute.mjs # artifact/hooks/event-route-tool-after.claude.mjs # artifact/hooks/event-route-tool-after.codex.execute.mjs # artifact/hooks/event-route-tool-after.codex.mjs # artifact/hooks/event-route-tool-after.cursor.execute.mjs # artifact/hooks/event-route-tool-after.cursor.mjs # artifact/hooks/event-route-tool-before.claude.execute.mjs # artifact/hooks/event-route-tool-before.claude.mjs # artifact/hooks/event-route-tool-before.codex.execute.mjs # artifact/hooks/event-route-tool-before.codex.mjs # artifact/hooks/event-route-tool-before.cursor.execute.mjs # artifact/hooks/event-route-tool-before.cursor.mjs # artifact/mcp/mcp-hauler-2b8242f9.mjs
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6b86e280f9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| assert.deepEqual( | ||
| committed.manifest.compiler.project.sourceInputs, | ||
| current.projectContext.sourceInputs, | ||
| 'Run pnpm build and commit the generated artifact and repository marketplaces.', |
There was a problem hiding this comment.
When a contributor changes marketplace-producing configuration and commits artifact/ but omits one of the repository-root marketplace manifests, this equality still passes because .claude-plugin/marketplace.json, .agents/plugins/marketplace.json, and .cursor-plugin/marketplace.json are absent from both sourceInputs lists. The subsequent pnpm build silently regenerates them, and no later check rejects the dirty worktree; the existing marketplace test only checks fixed fields after that rebuild. With the release self-push removed, stale metadata can therefore remain committed and be consumed directly by GitHub installs, so these outputs need a pre-build freshness comparison too.
AGENTS.md reference: AGENTS.md:L23-L26
Useful? React with 👍 / 👎.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
1 participant
Fix
Remove the release workflow's generated-output main self-push. The pinned Changesets action's
prepareBranchresets to the immutable event SHA, so pre-action self-commits are not its versioning base. Contributors instead commit native build outputs with their source changes; Changesetsrelease:versionremains the sole next-version artifact emitter.pnpm check:artifactruns before any build in the full gate. One native Node test compares the committed manifest'scompiler.project.sourceInputswith the framework publicinspect()API's fresh complete inventory. It catches added/deleted inputs, SHA-256 drift, and source executable-mode drift without a filesystem walker, timestamp check, root-dependent bundle comparison, or custom output generation.validate --artifactchecks committed output bytes/modes before rebuilding too.Preserve native repository marketplace emission, the
runInstallCliinstaller,push-with-git-cli: truerelease transport, Actions OIDC publishing, and authored application/skills/state. Rebuild and commit artifact output exclusively throughpnpm build; no hand-edited generated files or package versions.Verification
pnpm check: passed (pre-build freshness/committed artifact validation, build, source validation, typecheck, Effect diagnostics 0 errors/0 warnings, unit/integration 1,289 passed/1 existing skip, routes/packed-native installation 48 passed/0 skips, browser App 2 passed, generated artifact validation).pnpm check:artifactafter the full gate: passed.pnpm install --frozen-lockfile,actionlint .github/workflows/ci.yml .github/workflows/release.yml, authored-diff whitespace check: passed.Parent coordinator owns independent review and merge. No local publication, Version Packages merge, or installation mutation.