infra[notask]: make publish-sdk publish-only + build/publish SDK against co-published inference - #4026
Merged
Merged
Conversation
- publish-sdk ran on pull_request_target but never published on PRs (publish jobs gate on push/dispatch); the PR run only built — against base main and the published @qvac/inference — producing false reds during co-development - PR validation is already owned by required checks: pr-checks-sdk-pod (sdk/inference/bare-sdk build+lint+typecheck on PR head vs workspace inference), pr-checks-sdk-python, and pr-release-guard for release-* PRs - drop the pull_request_target trigger; publish-sdk runs on push/dispatch only - release publishing (push to release-*) and its release-merge-guard (push/dispatch-gated) are unchanged
Contributor
Review StatusCurrent Status: ✅ APPROVED |
Contributor
License compliance — cleanNo new dependency license findings in this PR. Warn-only (shadow) mode — this check does not block merges yet. Updated automatically by the canonical license compliance workflow. NOTICE presence (advisory)Missing NOTICE (advisory, does not block):
|
Contributor
Workflow security (shadow mode)zizmor found 1061 finding(s) in Findings are annotated inline on the changed files and listed in the job summary. Reproduce locally: pipx run zizmor==1.27.0 --offline .github/ |
- build-sdk installed the published @qvac/inference, which lags the unreleased engine API the SDK already consumes (e.g. VideoClientParams.reference_images); compile against the in-repo inference via sdk-source:workspace so the dist matches this run's engine - GPR mono builds published the SDK depending on stale public @qvac/inference; pin @qvac/inference to the @tetherto/inference-mono published in the same run (npm alias, versions match via shared GITHUB_RUN_ID) so a plain install of the mono SDK resolves a coherent engine - expose published_version from publish-gpr-inference; publish-gpr now needs it - npm/release path unchanged: dist compiles against the in-repo inference, the manifest keeps its committed range which resolves to the inference released in the same run
lauripiisang
changed the title
opaninakuffo
previously approved these changes
Aug 24, 2026
…PR context - pin @qvac/inference only when publish-gpr-inference actually succeeded; the GPR action writes gpr_published_version even on a failed publish, so a non-empty check alone could pin the SDK mono to a never-published inference (install -> 404). publish-gpr-inference is continue-on-error, so its failure doesn't skip publish-gpr - remove pull_request_target artifacts orphaned by dropping the PR trigger: base.sha/base.repo checkout fallbacks, "Fetch PR head commits" steps, and the PR_HEAD_SHA lockstep indirection — all resolved to github.sha on push
…tipacked) - add persist-credentials: false to the 11 actions/checkout steps zizmor flagged as artipacked (build, build-bare-sdk, build-inference, build-sdk-python, publish-gpr*, publish-npm*, release-merge-guard) - safe: none of these jobs do authenticated git writes — tag/release creation lives in the reusable create-* workflows; these checkouts only read git locally or feed npm/GPR publish, so not persisting the token changes nothing - clears all 11 medium artipacked findings; zizmor reports no new findings
opaninakuffo
approved these changes
Aug 24, 2026
Victor-Rodzko
approved these changes
Aug 24, 2026
donriddo
added a commit
that referenced
this pull request
Aug 26, 2026
#4076) * infra[notask]: build the sdk-python worker against workspace inference build_worker.py compiles the sibling packages/sdk from source, and since #3595 the SDK sources its surface from @qvac/inference. Both sdk-python e2e workflows install that from the registry, so they typecheck SDK source against a published engine that lags the API the SDK already consumes. Any branch fails, including main on its own reference_images and ltx2 usage. #3595 wired sdk-e2e-prepare-inference into the five JS e2e workflows and #4026 did the equivalent for publish-sdk.yml; neither covered the two python ones. Uses the publish-sdk.yml approach, a single sdk-source:workspace step, since these run one job on a full checkout and need no artifact hand-off. * infra[notask]: link workspace inference in build_worker instead of the workflows The two workflow steps only covered the two e2e legs. build_worker.py is also called by on-pr-sdk-python-wheel-e2e.yml, build-sdk-python-fat-wheels.yml and the local dev flow, all of which compile the same SDK source against the same registry engine. Moves it into build() behind a sibling-inference check, so every caller gets it and a standalone SDK checkout still takes the plain install. sdk-source:workspace installs the SDK against file:../inference, so it replaces that install rather than adding to it. * infra[notask]: restore the SDK manifest after linking the workspace engine sdk-source:workspace rewrites packages/sdk/package.json to file:../inference and leaves it that way, so build_worker.py was handing every local caller a dirty manifest that could be committed and break publishing. Restores it in a finally once the install has run. node_modules keeps the link, so the tsc below still compiles against the workspace engine; pr-checks-sdk-pod relies on the same thing. Explicit utf-8 because these also run on Windows, where read_text/write_text would otherwise use the locale encoding. * infra[notask]: require the link script, not just a sibling inference dir packages/inference landed 2026-08-05 and sdk-source:workspace only on 08-14, so a QVAC_POC_SDK_DIR checkout from that window has the directory without the script. Selecting workspace mode on the directory alone made build_worker fail there where a plain bun install had worked. Checks that the SDK declares both the @qvac/inference dependency and the sdk-source:workspace script, and falls back to bun install otherwise. A malformed or unreadable manifest takes the fallback rather than raising. * infra[notask]: drop the unexplained date arithmetic from the guard docstring 'predates by nine days' referred to two dates the comment did not carry, so it read as an unexplained number with no reason attached. States the condition it actually guards instead; the dates stay in the commit that added it. * infra[notask]: cut the comments back to what the code cannot say Fifteen lines of comment for eleven of code, and several restated it: the return expression, the if/else, a cross-reference to another workflow. Keeps only the three things a reader cannot derive - that the published engine lags the SDK source, that a sibling directory does not imply the link script, and that node_modules holds the link so restoring the manifest is safe. * infra[notask]: reject malformed manifest shapes in the workspace guard Invalid JSON and unreadable files already fell back, but structurally wrong manifests raised out of a predicate: a top-level array, string or number hit AttributeError on .get, and a null dependencies or scripts hit TypeError on the membership test. Checks each level is a mapping before indexing into it, so any manifest shape the guard cannot read takes the plain install. * infra[notask]: require usable values, not just present keys, in the guard A manifest could declare @qvac/inference and sdk-source:workspace with null or empty values and still select workspace mode, so bun run would fail on a script that is present but has nothing to run - the case the fallback exists to avoid. Both entries must now carry a non-empty string. * Revert "infra[notask]: require usable values, not just present keys, in the guard" This reverts commit c8ec9d6.
opaninakuffo
added a commit
that referenced
this pull request
Aug 27, 2026
* doc: point Bare consumers at @qvac/inference @qvac/bare-sdk is discontinued after 0.18.1; docs and error copy should send in-process Bare users to the engine instead of the deprecated package. * doc: import the inference Bare quickstart in the SDK docs packages/sdk/examples/quickstart.bare.ts is gone; the docs site build failed on the leftover file= import. * chore: retrigger CI after publish-sdk drop of pull_request_target Empty commit so #4018 re-runs against main after #4026. * doc: treat in-process Bare as @qvac/inference only Drop the leftover SDK-on-Bare compatibility copy from the deprecation docs. * doc: drop leftover in-process Bare SDK claims @qvac/sdk always spawns a Bare worker over bare-rpc. Point Bare in-process at @qvac/inference in how-it-works and the deployment diagram. * doc: drop architecture files overlapping #3982 Yury is rewriting ARCHITECTURE.md and the deployment diagram there. Leave those to that PR; keep website, READMEs, and error copy here. * doc: set last @qvac/bare-sdk release to 0.18.2 The lockstep patch shipped; last npm version is 0.18.2, not 0.18.1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎯 What problem does this PR solve?
After the inference split,
publish-sdk.ymlis broken for co-development: the SDK consumes engine API (VideoClientParams.reference_images) that isn't in any published@qvac/inference, so building/publishing the SDK against the published engine either fails or ships an incoherent artifact.Two concrete problems:
pull_request_target, built the base commit against published inference, and went red on PRs — a false red on a non-required check, duplicating the required gate.@qvac/inference— sonpm install @tetherto/sdk-monogave a broken engine.📝 How does it solve it?
PR side — publish-only workflow. Drop the
pull_request_targettrigger;publish-sdk.ymlruns onpush/workflow_dispatchonly. PR validation is owned by the required checks that already do it correctly on the PR head against the in-repo inference:pr-checks-sdk-pod.yml,pr-checks-sdk-python.yml, andpr-release-guard.yml(release-* PRs).Push side — build and publish against the co-published inference.
build: compile the SDK against the in-repo@qvac/inferenceat this commit (sdk-source:workspace), so the dist matches the engine being published in this run.publish-gpr: pin the SDK's@qvac/inferenceto the@tetherto/inference-monopublished in the same run (npm alias). The GPR action versions as${version}-tmp.runid-${GITHUB_RUN_ID}, andGITHUB_RUN_IDis shared across jobs, so the pin matches exactly. A plainnpm install @tetherto/sdk-mononow resolves a coherent engine.publish-gpr-inferenceexposespublished_version;publish-gprdepends on it.Release / npm path: unchanged & coherent
The inference-mono pin runs only on the dev/GPR path (its
ifis main/feature/tmp). Onrelease-*, the SDK dist still compiles against the in-repo inference, and the published manifest keeps its committed@qvac/inferencerange — which resolves to the@qvac/inferencereleased in the same run. Release publishing and itsrelease-merge-guard(push-gated) are untouched.Verified
publish-gpr→[build, publish-logic, publish-gpr-inference]; new build/pin steps in place).0.18.1).pull_requestworkflows; publishing is push-only).Caveats / out of scope
push/publish workflow only runs its new version once merged; first live validation is the post-mergemainpush. (Inherent to editing this workflow.)build-bare-sdk/publish-gpr-bare-sdkare left as-is —@qvac/bare-sdkis being removed in QVAC-23467 chore: drop @qvac/bare-sdk from the lockstep pipeline #4019. If that lands first the jobs disappear; otherwise they'd want the same treatment. Full main-green depends on QVAC-23467 chore: drop @qvac/bare-sdk from the lockstep pipeline #4019 or a follow-up for those jobs.ERESOLVEis fixed separately in fix[notask]: align SDK @qvac/inference range to the 0.18 line #4021 (@qvac/inferencerange bump).