Certify pm CLI 2026.9.21, move merge drivers onto the canonical pm-ops launcher, and fix release visibility - #121
Merged
unbraind merged 6 commits intoSep 22, 2026
Conversation
…cal pm-ops launcher - Pins @unbrained/pm-cli 2026.9.21, pm-ops 2026.9.18 and pm-changelog 2026.9.18 exactly (package.json and package-lock.json). - scripts/prepare-merge-driver.ts is now a thin launcher over pm-ops/merge-driver, replacing the untyped prepare-merge-driver.mjs; one canonical, tested installer instead of a private copy per repository. - CI installs the drivers before `pm health --strict-exit --require-merge-drivers`, so a clone without them fails the gate instead of hard-conflicting tracker files on the next merge. - Release workflow: 10-minute npm visibility window, GitHub Release decoupled from bun mirror lag with a visible gate step, and a best-effort backfill of missing Releases (companion pm-cli-website-3y5d). pm items: pm-linear-em7w, pm-linear-seq7. Companion epic pm-cli-website-5s6z. release:check exits 0.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Reviewer's GuideThis PR upgrades and pins the pm toolchain, replaces the repository-owned merge-driver setup with the canonical pm-ops launcher and strict CI installation gate, and restructures release automation to recover missing GitHub Releases while separating Bun mirror verification from release creation and making npm visibility failures explicit. Sequence diagram for release publication and visibility gatessequenceDiagram
participant Workflow
participant NPM
participant Git
participant GitHub
participant Bun
Workflow->>NPM: Publish npm package
Workflow->>NPM: Poll version and attestations for 10 minutes
alt npm version is visible and attested
Workflow->>Git: Push release tag
Workflow->>Bun: Verify bun install for 10 minutes
Workflow->>GitHub: Create GitHub Release
alt bun verification fails
Workflow->>Workflow: Fail job on bun verification failure
end
else npm visibility or attestation fails
Workflow->>Workflow: Refuse release and report explicit failure
end
Flow diagram for backfilling missing GitHub Releasesflowchart TD
TAGS[Enumerate release tags] --> EXISTS{GitHub Release exists?}
EXISTS -->|Yes| NEXT[Continue to next tag]
EXISTS -->|No| NPMCHECK[Check npm version visibility and attestations]
NPMCHECK -->|Missing or unattested| SKIP[Skip backfill with warning]
NPMCHECK -->|Published and attested| NOTES[Generate notes for tag range]
NOTES --> CREATE[Create GitHub Release]
CREATE --> CONTINUE[Continue today's release]
NOTES -. failure .-> CONTINUE
CREATE -. failure .-> CONTINUE
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
The prepare launcher statically imports pm-ops, a devDependency, so the README's promise that production / --omit=dev installs cannot break was only true for registry installs (npm never runs prepare for a registry tarball). A production install of a clone omits pm-ops as well and must pass --ignore-scripts, which is what this fleet's own Dockerfiles do. Raised by Greptile and Sourcery on pm-starter#113. The canonical guarded launcher is tracked as companion item pm-cli-website-xy19.
CI ran an explicit pm merge install right before pm health --require-merge-drivers, so the gate only verified the step before it and would have passed with a broken prepare hook. Without that step, the health gate asserts what a fresh clone actually relies on: npm ci runs the prepare launcher, which installs the drivers through pm-ops/merge-driver. Verified on a fresh git clone: no merge.pm* keys before npm ci, all of them after, and pm health --strict-exit --require-merge-drivers exits 1 once they are removed. Raised by Greptile on pm-github#93.
The backfill created a GitHub Release for any fleet-shaped tag whose npm version carried some attestation, without proving the tag's commit produced that artifact, so a stale, moved or hand-made tag could get a misleading Release. Comparing the attested commit with the tag commit is not the fix either: this fleet's provenance names the workflow trigger commit, measured as the tag's direct parent on three real releases. The correct check (same repository and workflow, attested commit an ancestor of the tag) belongs in the canonical pm-ops release verifier. The 10-minute npm visibility window and the Release decoupled from bun mirror lag remain; they fix the root causes. Raised by Greptile on pm-brief#124 and pm-linear#121.
- release.yml: max_attempts is declared before refuse_unattested_or_fail, which expands it, so its visibility no longer depends on call-time reasoning (the fleet's bindings-before-use rule; Greptile on pm-todos#99). Behaviour is unchanged. - pm records: the release Issue no longer claims the backfill that review removed, and the certify Task describes CI as it now is (health gate right after npm ci, no separate install step). The final release.yml is byte-identical to a fresh run of the anchored applier on origin/main (identical).
The resolution, expected result and close reason still described the backfill step that review removed, and the close reason cited the earlier 7-scenario harness run. All three now state the two changes that ship, the 5 applicable harness scenarios, and that the backfill moved to companion item pm-cli-website-mxrp. Raised by Greptile on pm-slack#115.
unbraind
deleted the
pm-cli-2026-9-21-canonical-merge-driver-release-window
branch
September 22, 2026 06:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fleet wave of 2026-09-22 (companion epic
pm-cli-website-5s6z), applied by the fleet's deterministic wave script and verified by this repository's own gates.scripts/prepare-merge-driver.tsis a thin launcher overpm-ops/merge-driver(removed: scripts/prepare-merge-driver.mjs). CI runspm health --strict-exit --require-merge-driversright afternpm ci, with no separate install step, so the gate proves that the prepare hook installed the drivers. A broken launcher fails CI instead of silently leaving clones that hard-conflict.toon/history files on the next multi-agent merge.pm items
Review follow-ups
Findings tracked centrally rather than fixed per repository (one pm-ops release moves the whole fleet):
pm-cli-website-xy19: a guarded launcher so thatnpm ci --omit=devin a clone no-ops instead of failingpm-cli-website-mxrp: the release-workflow recovery harness as a checked-in pm-ops verifier run by everyrelease:check, plus the backfill with provenance-ancestry verification (the attested commit must be an ancestor of the tag; this fleet's provenance names the trigger commit,pm-cli-website-nodo)Verification
git config --get-regexp '^merge\.pm'afternpm cipm health --strict-exit --require-merge-driversnpm run release:checkverify-release-publish-attestation: every publish invocation is attested.)changelog:fullthenchangelog:checkDependabot PRs are not absorbed here and will rebase onto this change.
Summary by Sourcery
Certify the updated pm toolchain, centralize merge-driver setup, and make release publication resilient to registry propagation and Bun mirror delays.
Bug Fixes:
Enhancements:
CI:
Documentation:
Tests:
Chores:
Summary by cubic
Certifies pm CLI 2026.9.21, moves merge-driver setup onto the canonical
pm-opslauncher, and reworks the release workflow so npm propagation and bun mirror lag no longer cause false failures or skipped GitHub Releases.Merge drivers
@unbrained/pm-cli2026.9.21,pm-ops2026.9.18 andpm-changelog2026.9.18 exactly.scripts/prepare-merge-driver.mjswith a thin launcher overpm-ops/merge-driver.pm health --strict-exit --require-merge-driverswith no explicit install first, so the gate proves thepreparehook installs the drivers on a fresh clone.--omit=dev) install of a clone must pass--ignore-scripts.Release fixes
max_attemptsis declared before the function that expands it.Written for commit 73584bf. Summary will update on new commits.