Repository navigation
fix(release): restore signed-artifact publisher - #1125
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
📝 Info: Restoration matches prior publisher
The workflow exactly matches the public publisher immediately before PR #1124. Review risk therefore centers on inherited publisher behavior, not restoration drift.
Was this helpful? React with 👍 or 👎 to provide feedback.
| node -e 'const fs=require("node:fs"); const p=JSON.parse(fs.readFileSync("package.json","utf8")); p.name="@evalops/maestro"; fs.writeFileSync("package.json", JSON.stringify(p, null, "\t")+"\n")' | ||
| ALIAS_PACK_JSON=$(npm pack --json) |
There was a problem hiding this comment.
🟡 Maestro updates target Deixic Code
When users update @evalops/maestro, its launcher exports MAESTRO_PACKAGE_NAME=@evalops/deixic-code. materialize-native-package embeds the name before package.json changes, so install_package targets the other package. Updates can fail on conflicting global binaries or silently migrate the installation.
Learn more
The package materializer generates bin/maestro with MAESTRO_PACKAGE_NAME copied from the current package metadata. The workflow runs it while the name is still @evalops/deixic-code, then changes only package.json before packing the alias. The native updater reads that embedded variable and passes it to install_package. The alias package therefore requests a global installation of the canonical package instead of upgrading itself.
Example: A user installed @evalops/maestro@0.10.88 and runs its update command. The launcher identifies the installation as @evalops/deixic-code, so the updater executes npm install -g @evalops/deixic-code@<version> rather than updating @evalops/maestro.
Recommended fix: Regenerate the launchers after changing package.json.name and before creating ALIAS_PACK_JSON. Keep the first tarball unchanged so each package embeds its own npm coordinate.
| node -e 'const fs=require("node:fs"); const p=JSON.parse(fs.readFileSync("package.json","utf8")); p.name="@evalops/maestro"; fs.writeFileSync("package.json", JSON.stringify(p, null, "\t")+"\n")' | |
| ALIAS_PACK_JSON=$(npm pack --json) | |
| node -e 'const fs=require("node:fs"); const p=JSON.parse(fs.readFileSync("package.json","utf8")); p.name="@evalops/maestro"; fs.writeFileSync("package.json", JSON.stringify(p, null, "\t")+"\n")' | |
| node scripts/materialize-native-package.mjs --input-dir release-binaries | |
| ALIAS_PACK_JSON=$(npm pack --json) |
Was this helpful? React with 👍 or 👎 to provide feedback.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1252dffdc0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ${{ steps.pack.outputs.alias_tarball }} | ||
| - name: Publish to npm | ||
| env: | ||
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} |
There was a problem hiding this comment.
When NPM_TOKEN is populated, this step exports it as NODE_AUTH_TOKEN for every command, including publish_with_oidc. npm's authentication-precedence documentation states that the CLI prioritizes a configured token over OIDC, so the supposed OIDC-first call actually uses the fallback token; if that token is expired or unauthorized, both attempts use the same broken credential and the release cannot publish despite a correctly configured trusted publisher. Store the secret under a fallback-only variable and export NODE_AUTH_TOKEN only inside publish_with_token.
Useful? React with 👍 / 👎.
1 participant
Issue
No-Issue: PR #1124 replaced the public signed-artifact publication workflow with Mono's nested private build template.
What changed
Restore the public-owned release workflow from the last working public main. It accepts
maestro-signed-release, verifies Mono's signed artifact manifest and source receipt, packages the verified binaries, publishes through npm OIDC, and finalizes the public release and channel manifest. The copied build template cannot perform this handoff on the public runner group.Verification
bash scripts/run-ci-tooling.sh— passed with the restored workflow.node --test .github/workflows/*.test.mjs— 108 passed.git diff --check— passed.Risk / rollback
The workflow returns to its previous publication design; the current public-main release template is not a usable publisher. Revert this PR only after replacing the signed-artifact handoff with a verified successor. The matching source test is being delivered through Mono's protected mirror path.