Certify pm CLI 2026.9.21, move merge drivers onto the canonical pm-ops launcher, and fix release visibility - #115
Merged
unbraind merged 6 commits intoSep 22, 2026
Conversation
…cal pm-ops launcher - Pins @unbrained/pm-cli 2026.9.21, pm-ops 2026.9.18 and pm-changelog 2026.9.18 exactly (package.json and package-lock.json). - scripts/prepare-merge-driver.ts is now a thin launcher over pm-ops/merge-driver, replacing the untyped prepare-merge-driver.mjs; one canonical, tested installer instead of a private copy per repository. - CI installs the drivers before `pm health --strict-exit --require-merge-drivers`, so a clone without them fails the gate instead of hard-conflicting tracker files on the next merge. - Release workflow: 10-minute npm visibility window, GitHub Release decoupled from bun mirror lag with a visible gate step, and a best-effort backfill of missing Releases (companion pm-cli-website-3y5d). pm items: pm-slack-h3ba, pm-slack-x0wg. Companion epic pm-cli-website-5s6z. release:check exits 0.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Reviewer's GuideThis PR certifies the 2026.9.21 pm toolchain, centralizes merge-driver setup in pm-ops with CI enforcement, and hardens release automation against npm propagation and Bun mirror lag by adding attested release backfill, decoupled GitHub Release creation, and explicit Bun failure reporting. Sequence diagram for release publication and visibility handlingsequenceDiagram
participant Workflow
participant NPM
participant Git
participant Bun
participant GitHub
Workflow->>NPM: Publish package with provenance
NPM-->>Workflow: Publish result
alt Version not immediately visible
loop Up to 10-minute visibility window
Workflow->>NPM: npm view --prefer-online
NPM-->>Workflow: Version and attestations
end
end
Workflow->>Git: Push release tag
Workflow->>Bun: bun add published version
Bun-->>Workflow: Verification result
Workflow->>GitHub: Create Release after publish and tag push
alt Bun verification failed
Workflow->>Workflow: Fail job visibly
end
Flow diagram for backfilling missing GitHub Releasesflowchart TD
TAGS["Fetch fleet-shaped release tags"] --> EXISTS{"GitHub Release exists?"}
EXISTS -->|Yes| NEXT["Continue to next tag"]
EXISTS -->|No| VERSION["Convert tag to npm version"]
VERSION --> ATTESTED{"npm version visible with attestations?"}
ATTESTED -->|No| SKIP["Warn and skip backfill"]
ATTESTED -->|Yes| NOTES["Generate tag-scoped release notes"]
NOTES --> CREATE["gh release create --verify-tag"]
CREATE --> NEXT
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
The prepare launcher statically imports pm-ops, a devDependency, so the README's promise that production / --omit=dev installs cannot break was only true for registry installs (npm never runs prepare for a registry tarball). A production install of a clone omits pm-ops as well and must pass --ignore-scripts, which is what this fleet's own Dockerfiles do. Raised by Greptile and Sourcery on pm-starter#113. The canonical guarded launcher is tracked as companion item pm-cli-website-xy19.
CI ran an explicit pm merge install right before pm health --require-merge-drivers, so the gate only verified the step before it and would have passed with a broken prepare hook. Without that step, the health gate asserts what a fresh clone actually relies on: npm ci runs the prepare launcher, which installs the drivers through pm-ops/merge-driver. Verified on a fresh git clone: no merge.pm* keys before npm ci, all of them after, and pm health --strict-exit --require-merge-drivers exits 1 once they are removed. Raised by Greptile on pm-github#93.
The backfill created a GitHub Release for any fleet-shaped tag whose npm version carried some attestation, without proving the tag's commit produced that artifact, so a stale, moved or hand-made tag could get a misleading Release. Comparing the attested commit with the tag commit is not the fix either: this fleet's provenance names the workflow trigger commit, measured as the tag's direct parent on three real releases. The correct check (same repository and workflow, attested commit an ancestor of the tag) belongs in the canonical pm-ops release verifier. The 10-minute npm visibility window and the Release decoupled from bun mirror lag remain; they fix the root causes. Raised by Greptile on pm-brief#124 and pm-linear#121.
This comment has been minimized.
This comment has been minimized.
- release.yml: max_attempts is declared before refuse_unattested_or_fail, which expands it, so its visibility no longer depends on call-time reasoning (the fleet's bindings-before-use rule; Greptile on pm-todos#99). Behaviour is unchanged. - pm records: the release Issue no longer claims the backfill that review removed, and the certify Task describes CI as it now is (health gate right after npm ci, no separate install step). The final release.yml is byte-identical to a fresh run of the anchored applier on origin/main (identical).
The resolution, expected result and close reason still described the backfill step that review removed, and the close reason cited the earlier 7-scenario harness run. All three now state the two changes that ship, the 5 applicable harness scenarios, and that the backfill moved to companion item pm-cli-website-mxrp. Raised by Greptile on pm-slack#115.
unbraind
deleted the
pm-cli-2026-9-21-canonical-merge-driver-release-window
branch
September 22, 2026 06:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fleet wave of 2026-09-22 (companion epic
pm-cli-website-5s6z), applied by the fleet's deterministic wave script and verified by this repository's own gates.scripts/prepare-merge-driver.tsis a thin launcher overpm-ops/merge-driver(removed: scripts/prepare-merge-driver.mjs). CI runspm health --strict-exit --require-merge-driversright afternpm ci, with no separate install step, so the gate proves that the prepare hook installed the drivers. A broken launcher fails CI instead of silently leaving clones that hard-conflict.toon/history files on the next multi-agent merge.pm items
Review follow-ups
Findings tracked centrally rather than fixed per repository (one pm-ops release moves the whole fleet):
pm-cli-website-xy19: a guarded launcher so thatnpm ci --omit=devin a clone no-ops instead of failingpm-cli-website-mxrp: the release-workflow recovery harness as a checked-in pm-ops verifier run by everyrelease:check, plus the backfill with provenance-ancestry verification (the attested commit must be an ancestor of the tag; this fleet's provenance names the trigger commit,pm-cli-website-nodo)Verification
git config --get-regexp '^merge\.pm'afternpm cipm health --strict-exit --require-merge-driversnpm run release:checkok - the flag changes the heading: '## 2026.1.2 - 2026-01-02' with it, '## 2026.)changelog:fullthenchangelog:checkDependabot PRs are not absorbed here and will rebase onto this change.
Summary by cubic
Certifies pm CLI 2026.9.21 (pinned with
pm-changelog2026.9.18 andpm-ops2026.9.18), moves the merge-driver installer onto the canonicalpm-opslauncher with CI enforcement, and fixes release visibility when npm propagates late or bun's mirror lags.Merge drivers
scripts/prepare-merge-driver.tsis now a thin launcher overpm-ops/merge-driver, replacing the vendoredprepare-merge-driver.mjs.npm ciprepare hook doesn't wire the drivers fails instead of silently hard-conflicting tracker files.prepare, and a production install of a clone must pass--ignore-scripts.Release workflow
Written for commit bf45345. Summary will update on new commits.
Summary by Sourcery
Certify the updated pm toolchain, enforce canonical merge-driver setup, and make release publication resilient to registry propagation and Bun mirror delays.
Bug Fixes:
Enhancements:
CI:
Deployment:
Documentation:
Chores: