Skip to content

Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher - #114

Merged
unbraind merged 2 commits into
mainfrom
certify-pm-cli-2026-9-23-and-roll-out-guarded-merge-driver-launcher
Sep 25, 2026
Merged

unbraind merged 2 commits into
mainfrom
certify-pm-cli-2026-9-23-and-roll-out-guarded-merge-driver-launcher

Conversation

@unbraind

@unbraind unbraind commented Sep 25, 2026 •

Copy link
Copy Markdown
Owner

Summary

Fleet wave of 2026-09-25 (companion epic pm-cli-website-5s6z, launcher rollout pm-cli-website-xy19), applied by the fleet's wave script, finished by hand where this repository needed it, and verified by its own gates.

  • Certify pm CLI 2026.9.23, exact pins in package.json and package-lock.json: @unbrained/pm-cli 2026.9.21 -> 2026.9.23, pm-changelog 2026.9.18 -> 2026.9.23, pm-ops 2026.9.18 -> 2026.9.23.
  • Guarded merge-driver launcher: scripts/prepare-merge-driver.ts is now the template pm-ops 2026.9.23 ships, copied unchanged. It imports nothing from pm-ops, so a production install of a clone (npm ci --omit=dev) skips with one notice instead of dying on ERR_MODULE_NOT_FOUND, while a stale or broken pm-ops still fails the install. test/prepare-merge-driver.test.ts compares it byte-for-byte with the pinned template and runs it as npm's prepare hook would, inside fresh git init checkouts: the exact driver set .gitattributes declares, the omit-dev skip, a stale pm-ops, and failing and signal-killed installers.
  • The wave's first gate run was cut off by its 40-minute timeout on a saturated 4-core host; this run finished it.

pm items

Verification

Check Result
CI health block (pm health ... --require-merge-drivers), executed from ci.yml exit 0
npm run release:check exit 0 (ok - the flag changes the heading: '## 2026.1.2-1 - 2026-01-02' with it, '## 2026.1.2-1' w)
changelog:full then changelog:check regenerated after the pm writes, consistent

Summary by Sourcery

Certify the 2026.9.23 pm toolchain, adopt its guarded merge-driver launcher, and make release publication and verification outcomes accurately reflect registry and Bun availability.

New Features:

  • Certify the pm CLI toolchain and related dependencies at version 2026.9.23.
  • Adopt a guarded merge-driver launcher that supports production installs without dev dependencies while rejecting stale or broken pm-ops installations.

Bug Fixes:

  • Ensure late npm publication visibility is reported accurately with an expanded online verification window.
  • Create GitHub Releases after successful publication and tag pushes even when Bun verification fails, while still failing the workflow visibly for Bun verification errors.

Enhancements:

  • Make release verification distinguish npm publication status from Bun mirror availability and provide accurate failure reporting.
  • Add comprehensive merge-driver launcher validation for full installs, omit-dev installs, stale dependencies, installer failures, and signal termination.

CI:

  • Harden the release workflow's npm and Bun publication checks with online reads, longer propagation windows, and an explicit Bun failure gate.

Documentation:

  • Update installation and merge-driver documentation to describe the guarded launcher behavior.

Tests:

  • Verify the launcher matches the pinned pm-ops template byte-for-byte and registers the merge drivers declared by .gitattributes.

Chores:

  • Record the associated project-management chore and issue artifacts and update changelog entries.

Summary by cubic

Certifies the pm CLI toolchain at 2026.9.23 and adopts pm-ops's guarded merge-driver launcher so a production install of a clone (npm ci --omit=dev) skips with one notice instead of failing, while a stale or broken pm-ops still fails the install. Also hardens release verification so bun mirror lag no longer skips the GitHub Release and a late-visible publish is reported honestly.

Bug Fixes

  • GitHub Releases now depend only on publish and tag-push success; a bun verification failure fails the job via a gate step instead of being reported as mirror lag.
  • The npm visibility window grows to 10 minutes with --prefer-online reads, and an unseen publish reports "registry shows nothing" instead of a false "failed after 3 attempts".

Refactors

  • scripts/prepare-merge-driver.ts is now the unmodified pm-ops launcher template, kept byte-identical by a new test that exercises full installs, omit-dev installs, stale pm-ops, and installer failures and signal deaths in fresh git init checkouts.
  • Restores the launcher to coverageGate.sources, where it was on main; npm run coverage reports it at 100/100/100 through the fixture suite's child processes.

Written for commit b5a9c61. Summary will update on new commits.

Review in cubic

…uncher

- Pins @unbrained/pm-cli 2026.9.21 -> 2026.9.23, pm-changelog 2026.9.18 -> 2026.9.23, pm-ops 2026.9.18 -> 2026.9.23 exactly (package.json and package-lock.json).
- scripts/prepare-merge-driver.ts is now the launcher template pm-ops ships, copied unchanged: it
  imports nothing from pm-ops, so `npm ci --omit=dev` in a clone skips with one notice instead of
  failing, while a stale or broken pm-ops still fails. A test keeps it byte-identical to the pinned
  template and exercises every branch in isolated git-init checkouts.
- The wave's first gate run was cut off by its 40-minute timeout on a saturated 4-core host; this run finished it.

pm items: pm-graph-at6i, pm-graph-1k7d. Companion epic pm-cli-website-5s6z. release:check exits 0.

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @unbraind, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 3 days and 20 hours by commenting @sourcery-ai review. Upgrade to get a review now.

@coderabbitai

coderabbitai Bot commented Sep 25, 2026 •

Copy link
Copy Markdown

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8db4bd8c-3327-4880-869a-7de8ae5b2105


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sourcery-ai

sourcery-ai Bot commented Sep 25, 2026

Copy link
Copy Markdown

Reviewer's Guide

This PR certifies the 2026.9.23 pm toolchain, adopts the pm-ops-provided guarded merge-driver launcher with comprehensive fresh-checkout tests, and hardens release automation by separating npm publication and GitHub Release success from independently visible Bun mirror verification.

Sequence diagram for the guarded merge-driver prepare hook

sequenceDiagram
    participant NPM
    participant Launcher as prepare-merge-driver.ts
    participant Resolver as Node module resolver
    participant PMOps as pm-ops installer
    participant Git

    NPM->>Launcher: execute prepare hook
    Launcher->>Resolver: resolve pm-ops/merge-driver/prepare
    alt pm-ops absent
        Resolver-->>Launcher: MODULE_NOT_FOUND
        Launcher-->>NPM: print skip notice
    else pm-ops present
        Resolver-->>Launcher: installer path
        Launcher->>PMOps: spawnSync installer
        PMOps->>Git: pm merge install
        Git-->>PMOps: driver registration result
        PMOps-->>Launcher: exit status
        Launcher-->>NPM: propagate installer status
    end
Loading

File-Level Changes

Change Details Files
Certify the pm CLI dependency set at 2026.9.23 and update project release metadata.
  • Pin pm-cli, pm-changelog, and pm-ops to 2026.9.23 in package manifests and lockfile.
  • Record the associated tracker items, history, task updates, and changelog entries.
  • Adjust coverage sources for the launcher and retain release-check/changelog verification expectations.
package.json
package-lock.json
CHANGELOG.md
.agents/pm/chores/pm-graph-at6i.toon
.agents/pm/issues/pm-graph-1k7d.toon
.agents/pm/history/pm-graph-1k7d.jsonl
.agents/pm/history/pm-graph-at6i.jsonl
.agents/pm/history/pm-graph-yuzr.jsonl
.agents/pm/tasks/pm-graph-yuzr.toon
Replace the merge-driver prepare hook with the guarded pm-ops 2026.9.23 launcher and add subprocess-based installation coverage.
  • Resolve and spawn pm-ops's prepare entry without importing pm-ops, allowing omit-dev installs to skip only when the package is absent.
  • Propagate stale-package resolution errors and installer exit or signal failures.
  • Compare the checked-in launcher byte-for-byte with the pinned pm-ops template.
  • Exercise full, omit-dev, stale, failing-installer, signal-killed, and fresh Git checkout scenarios, including every driver declared by .gitattributes.
scripts/prepare-merge-driver.ts
test/prepare-merge-driver.test.ts
README.md
Make npm publication reconciliation resilient to registry propagation while decoupling GitHub release creation from Bun mirror verification.
  • Use online-preferred registry reads and extend attestation reconciliation to a ten-minute window with a final read.
  • Clarify failure reporting when npm acceptance or visibility cannot be established.
  • Retry Bun installation across the same ten-minute window without treating mirror lag as success.
  • Create the GitHub Release after successful publish and tag push even if Bun verification fails, then explicitly fail the job when Bun verification fails.
.github/workflows/release.yml

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@greptile-apps

greptile-apps Bot commented Sep 25, 2026 •

Copy link
Copy Markdown

RetriggerConfidence Score: 5/5

[High risk] Upgrades build toolchain and rewrites the merge-driver launcher.

The PR appears safe to merge; no outstanding review finding or new actionable issue was identified.

Summary

The PR pins the pm toolchain to 2026.9.23, adopts a guarded merge-driver prepare hook, and changes release verification so Bun failures remain visible without preventing a GitHub Release after successful publication and tagging. Since the previous review, it restores the launcher to the required coverage sources and records that correction. The previous coverage finding is fixed, and its thread is resolved.

Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Publish[npm publish] --> Tag[Push tag]
  Tag --> Bun[Bun install verification]
  Tag --> Release[Create GitHub Release]
  Bun -->|failure| Gate[Fail job visibly]
Loading

Reviews (2) · Last reviewed commit: "Keep the prepare launcher in the coverag..."

Comment thread package.json
The wave dropped scripts/prepare-merge-driver.ts from coverageGate.sources (Greptile).
It is back where it was on main: Node's test coverage follows the fixture suite's child
processes, and npm run coverage reports the launcher at 100/100/100.

pm item: pm-graph-at6i.
@unbraind

Copy link
Copy Markdown
Owner Author

Review round complete before merge. All 1 inline bot threads were answered in-thread, and each was either fixed in this PR or tracked on the companion hub (launcher template: pm-cli-website-dqg7; release-workflow verifier: pm-cli-website-mxrp). Greptile's latest review covers the current head b5a9c61 with Confidence Score: 5/5. Sourcery skipped this head (its weekly diff allowance), so its earlier findings on this PR are the last it gave, and all were answered. CodeRabbit posted only its free-plan notice: this repository has fewer than 10 stars, so it doesn't review automatically, and its one-review-per-hour allowance is kept for PRs that need it. Every required check is green on b5a9c61.

@unbraind
unbraind merged commit 03fa564 into main Sep 25, 2026
12 checks passed
@unbraind
unbraind deleted the certify-pm-cli-2026-9-23-and-roll-out-guarded-merge-driver-launcher branch September 25, 2026 09:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant