2026-03-09 13:55:30 -05:00
|
|
|
#!/usr/bin/env bash
|
|
|
|
|
|
|
|
|
|
if [ -z "${REPO_ROOT:-}" ]; then
|
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
release_info() {
|
|
|
|
|
echo "$@"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
release_warn() {
|
|
|
|
|
echo "Warning: $*" >&2
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
release_fail() {
|
|
|
|
|
echo "Error: $*" >&2
|
|
|
|
|
exit 1
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
git_remote_exists() {
|
|
|
|
|
git -C "$REPO_ROOT" remote get-url "$1" >/dev/null 2>&1
|
|
|
|
|
}
|
|
|
|
|
|
2026-03-09 16:43:53 -05:00
|
|
|
github_repo_from_remote() {
|
|
|
|
|
local remote_url
|
|
|
|
|
|
|
|
|
|
remote_url="$(git -C "$REPO_ROOT" remote get-url "$1" 2>/dev/null || true)"
|
|
|
|
|
[ -n "$remote_url" ] || return 1
|
|
|
|
|
|
|
|
|
|
remote_url="${remote_url%.git}"
|
|
|
|
|
remote_url="${remote_url#ssh://}"
|
|
|
|
|
|
|
|
|
|
node - "$remote_url" <<'NODE'
|
|
|
|
|
const remoteUrl = process.argv[2];
|
|
|
|
|
|
|
|
|
|
const patterns = [
|
|
|
|
|
/^https?:\/\/github\.com\/([^/]+\/[^/]+)$/,
|
|
|
|
|
/^git@github\.com:([^/]+\/[^/]+)$/,
|
|
|
|
|
/^[^:]+:([^/]+\/[^/]+)$/
|
|
|
|
|
];
|
|
|
|
|
|
|
|
|
|
for (const pattern of patterns) {
|
|
|
|
|
const match = remoteUrl.match(pattern);
|
|
|
|
|
if (!match) continue;
|
|
|
|
|
process.stdout.write(match[1]);
|
|
|
|
|
process.exit(0);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
process.exit(1);
|
|
|
|
|
NODE
|
|
|
|
|
}
|
|
|
|
|
|
2026-03-09 13:55:30 -05:00
|
|
|
resolve_release_remote() {
|
|
|
|
|
local remote="${RELEASE_REMOTE:-${PUBLISH_REMOTE:-}}"
|
|
|
|
|
|
|
|
|
|
if [ -n "$remote" ]; then
|
|
|
|
|
git_remote_exists "$remote" || release_fail "git remote '$remote' does not exist."
|
|
|
|
|
printf '%s\n' "$remote"
|
|
|
|
|
return
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
if git_remote_exists public-gh; then
|
|
|
|
|
printf 'public-gh\n'
|
|
|
|
|
return
|
|
|
|
|
fi
|
|
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
if git_remote_exists public; then
|
|
|
|
|
printf 'public\n'
|
|
|
|
|
return
|
|
|
|
|
fi
|
|
|
|
|
|
2026-03-09 13:55:30 -05:00
|
|
|
if git_remote_exists origin; then
|
|
|
|
|
printf 'origin\n'
|
|
|
|
|
return
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
release_fail "no git remote found. Configure RELEASE_REMOTE or PUBLISH_REMOTE."
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
fetch_release_remote() {
|
|
|
|
|
git -C "$REPO_ROOT" fetch "$1" --prune --tags
|
|
|
|
|
}
|
|
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
git_current_branch() {
|
|
|
|
|
git -C "$REPO_ROOT" symbolic-ref --quiet --short HEAD 2>/dev/null || true
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
git_local_tag_exists() {
|
|
|
|
|
git -C "$REPO_ROOT" show-ref --verify --quiet "refs/tags/$1"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
git_remote_tag_exists() {
|
|
|
|
|
git -C "$REPO_ROOT" ls-remote --exit-code --tags "$2" "refs/tags/$1" >/dev/null 2>&1
|
|
|
|
|
}
|
|
|
|
|
|
2026-03-09 13:55:30 -05:00
|
|
|
get_last_stable_tag() {
|
|
|
|
|
git -C "$REPO_ROOT" tag --list 'v*' --sort=-version:refname | head -1
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
get_current_stable_version() {
|
|
|
|
|
local tag
|
|
|
|
|
tag="$(get_last_stable_tag)"
|
|
|
|
|
if [ -z "$tag" ]; then
|
|
|
|
|
printf '0.0.0\n'
|
|
|
|
|
else
|
|
|
|
|
printf '%s\n' "${tag#v}"
|
|
|
|
|
fi
|
|
|
|
|
}
|
|
|
|
|
|
2026-03-18 07:50:33 -05:00
|
|
|
stable_version_slot_for_date() {
|
2026-03-17 14:08:55 -05:00
|
|
|
node - "${1:-}" <<'NODE'
|
|
|
|
|
const input = process.argv[2];
|
2026-03-09 13:55:30 -05:00
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
const date = input ? new Date(`${input}T00:00:00Z`) : new Date();
|
|
|
|
|
if (Number.isNaN(date.getTime())) {
|
|
|
|
|
console.error(`invalid date: ${input}`);
|
|
|
|
|
process.exit(1);
|
2026-03-09 13:55:30 -05:00
|
|
|
}
|
|
|
|
|
|
2026-03-18 07:50:33 -05:00
|
|
|
const month = String(date.getUTCMonth() + 1);
|
|
|
|
|
const day = String(date.getUTCDate()).padStart(2, '0');
|
|
|
|
|
|
|
|
|
|
process.stdout.write(`${date.getUTCFullYear()}.${month}${day}`);
|
2026-03-17 14:08:55 -05:00
|
|
|
NODE
|
2026-03-09 13:55:30 -05:00
|
|
|
}
|
|
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
utc_date_iso() {
|
|
|
|
|
node <<'NODE'
|
|
|
|
|
const date = new Date();
|
|
|
|
|
const y = date.getUTCFullYear();
|
|
|
|
|
const m = String(date.getUTCMonth() + 1).padStart(2, '0');
|
|
|
|
|
const d = String(date.getUTCDate()).padStart(2, '0');
|
|
|
|
|
process.stdout.write(`${y}-${m}-${d}`);
|
2026-03-09 13:55:30 -05:00
|
|
|
NODE
|
|
|
|
|
}
|
|
|
|
|
|
2026-03-18 07:50:33 -05:00
|
|
|
next_stable_version() {
|
|
|
|
|
local release_date="$1"
|
|
|
|
|
shift
|
|
|
|
|
|
|
|
|
|
node - "$release_date" "$@" <<'NODE'
|
|
|
|
|
const input = process.argv[2];
|
|
|
|
|
const packageNames = process.argv.slice(3);
|
|
|
|
|
const { execSync } = require("node:child_process");
|
|
|
|
|
|
|
|
|
|
const date = input ? new Date(`${input}T00:00:00Z`) : new Date();
|
|
|
|
|
if (Number.isNaN(date.getTime())) {
|
|
|
|
|
console.error(`invalid date: ${input}`);
|
|
|
|
|
process.exit(1);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
const stableSlot = `${date.getUTCFullYear()}.${date.getUTCMonth() + 1}${String(date.getUTCDate()).padStart(2, "0")}`;
|
|
|
|
|
const pattern = new RegExp(`^${stableSlot.replace(/\./g, '\\.')}\.(\\d+)$`);
|
|
|
|
|
let max = -1;
|
|
|
|
|
|
|
|
|
|
for (const packageName of packageNames) {
|
|
|
|
|
let versions = [];
|
|
|
|
|
|
|
|
|
|
try {
|
|
|
|
|
const raw = execSync(`npm view ${JSON.stringify(packageName)} versions --json`, {
|
|
|
|
|
encoding: "utf8",
|
|
|
|
|
stdio: ["ignore", "pipe", "ignore"],
|
|
|
|
|
}).trim();
|
|
|
|
|
|
|
|
|
|
if (raw) {
|
|
|
|
|
const parsed = JSON.parse(raw);
|
|
|
|
|
versions = Array.isArray(parsed) ? parsed : [parsed];
|
|
|
|
|
}
|
|
|
|
|
} catch {
|
|
|
|
|
versions = [];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
for (const version of versions) {
|
|
|
|
|
const match = version.match(pattern);
|
|
|
|
|
if (!match) continue;
|
|
|
|
|
max = Math.max(max, Number(match[1]));
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
process.stdout.write(`${stableSlot}.${max + 1}`);
|
|
|
|
|
NODE
|
|
|
|
|
}
|
|
|
|
|
|
2026-03-09 13:55:30 -05:00
|
|
|
next_canary_version() {
|
|
|
|
|
local stable_version="$1"
|
2026-03-17 16:31:38 -05:00
|
|
|
shift
|
2026-03-09 13:55:30 -05:00
|
|
|
|
2026-03-17 16:31:38 -05:00
|
|
|
node - "$stable_version" "$@" <<'NODE'
|
2026-03-09 13:55:30 -05:00
|
|
|
const stable = process.argv[2];
|
2026-03-17 16:31:38 -05:00
|
|
|
const packageNames = process.argv.slice(3);
|
|
|
|
|
const { execSync } = require("node:child_process");
|
2026-03-09 13:55:30 -05:00
|
|
|
|
|
|
|
|
const pattern = new RegExp(`^${stable.replace(/\./g, '\\.')}-canary\\.(\\d+)$`);
|
|
|
|
|
let max = -1;
|
|
|
|
|
|
2026-03-17 16:31:38 -05:00
|
|
|
for (const packageName of packageNames) {
|
|
|
|
|
let versions = [];
|
|
|
|
|
|
|
|
|
|
try {
|
|
|
|
|
const raw = execSync(`npm view ${JSON.stringify(packageName)} versions --json`, {
|
|
|
|
|
encoding: "utf8",
|
|
|
|
|
stdio: ["ignore", "pipe", "ignore"],
|
|
|
|
|
}).trim();
|
|
|
|
|
|
|
|
|
|
if (raw) {
|
|
|
|
|
const parsed = JSON.parse(raw);
|
|
|
|
|
versions = Array.isArray(parsed) ? parsed : [parsed];
|
|
|
|
|
}
|
|
|
|
|
} catch {
|
|
|
|
|
versions = [];
|
|
|
|
|
}
|
2026-03-18 07:50:33 -05:00
|
|
|
|
2026-03-17 16:31:38 -05:00
|
|
|
for (const version of versions) {
|
|
|
|
|
const match = version.match(pattern);
|
|
|
|
|
if (!match) continue;
|
|
|
|
|
max = Math.max(max, Number(match[1]));
|
|
|
|
|
}
|
2026-03-09 13:55:30 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
process.stdout.write(`${stable}-canary.${max + 1}`);
|
|
|
|
|
NODE
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
release_notes_file() {
|
|
|
|
|
printf '%s/releases/v%s.md\n' "$REPO_ROOT" "$1"
|
|
|
|
|
}
|
|
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
stable_tag_name() {
|
|
|
|
|
printf 'v%s\n' "$1"
|
2026-03-09 13:55:30 -05:00
|
|
|
}
|
|
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
canary_tag_name() {
|
|
|
|
|
printf 'canary/v%s\n' "$1"
|
2026-03-09 13:55:30 -05:00
|
|
|
}
|
|
|
|
|
|
2026-03-12 12:42:00 -05:00
|
|
|
npm_package_version_exists() {
|
|
|
|
|
local package_name="$1"
|
|
|
|
|
local version="$2"
|
|
|
|
|
local resolved
|
|
|
|
|
|
|
|
|
|
resolved="$(npm view "${package_name}@${version}" version 2>/dev/null || true)"
|
|
|
|
|
[ "$resolved" = "$version" ]
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
wait_for_npm_package_version() {
|
|
|
|
|
local package_name="$1"
|
|
|
|
|
local version="$2"
|
|
|
|
|
local attempts="${3:-12}"
|
|
|
|
|
local delay_seconds="${4:-5}"
|
|
|
|
|
local attempt=1
|
|
|
|
|
|
|
|
|
|
while [ "$attempt" -le "$attempts" ]; do
|
|
|
|
|
if npm_package_version_exists "$package_name" "$version"; then
|
|
|
|
|
return 0
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
if [ "$attempt" -lt "$attempts" ]; then
|
|
|
|
|
sleep "$delay_seconds"
|
|
|
|
|
fi
|
|
|
|
|
attempt=$((attempt + 1))
|
|
|
|
|
done
|
|
|
|
|
|
|
|
|
|
return 1
|
|
|
|
|
}
|
|
|
|
|
|
fix: harden release registry verification against npm lag (#4816)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - Its release automation publishes canary packages to npm and then
validates the published registry state before considering the release
healthy
> - The failing canary run `25139465018` showed that npm can expose a
newly published version through version-specific endpoints before the
root package document has fully converged
> - That made a successful canary publish look like a failed release
because the verifier trusted stale root metadata too early
> - This pull request hardens the registry verification path by
preferring version-specific manifest checks, retrying
convergence-sensitive failures, and distinguishing permanent failures
from propagation lag
> - While validating that change in CI, a separate teardown race in
`heartbeat-stale-queue-invalidation.test.ts` surfaced and was hardened
so the PR could pass reliably
> - The benefit is that transient npm propagation lag no longer fails a
successful canary publish, while genuine registry-state and
dependency-integrity failures still stop the release flow promptly
## What Changed
- Hardened `scripts/verify-release-registry-state.mjs` so it prefers
version-specific manifest resolution over stale root metadata, adds
bounded registry-fetch timeouts, and classifies failures as retriable vs
non-retriable.
- Updated `scripts/release-lib.sh` and `scripts/release.sh` so
post-publish registry verification retries only convergence-sensitive
failures and reports immediate permanent failures clearly.
- Expanded `scripts/verify-release-registry-state.test.mjs` with
regression coverage for stale root metadata, fetch timeout behavior,
peer dependency range handling, non-retriable canary-latest cases, and
related verifier edge cases.
- Hardened
`server/src/__tests__/heartbeat-stale-queue-invalidation.test.ts`
teardown to tolerate the late-comment foreign-key race that CI exposed
while validating this branch.
## Verification
- `pnpm run test:release-registry`
- `node --check scripts/verify-release-registry-state.mjs`
- `bash -n scripts/release.sh && bash -n scripts/release-lib.sh`
- PR checks passed on head `5c422600fc12acac61f6b7c267a4dc915df622b1`:
`policy`, `verify`, `e2e`, `security/snyk`, and `Greptile Review`
## Risks
- Low risk. The main behavioral changes are limited to release
automation and verifier retry semantics, plus a test-only teardown
hardening for a CI race.
> I checked [`ROADMAP.md`](ROADMAP.md). This is a narrow release bugfix
and does not overlap planned core feature work.
## Model Used
- OpenAI Codex via Paperclip `codex_local` with tool use and local code
execution enabled. This agent session runs on a GPT-5-class coding
model; the exact backend model ID/context window is not exposed by the
local adapter runtime.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [ ] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I have addressed all Greptile and reviewer comments before
requesting merge
2026-05-09 22:18:12 -07:00
|
|
|
wait_for_release_registry_state() {
|
|
|
|
|
local attempts="${1:-12}"
|
|
|
|
|
local delay_seconds="${2:-5}"
|
|
|
|
|
shift 2
|
|
|
|
|
local attempt=1
|
|
|
|
|
local output
|
|
|
|
|
local status
|
|
|
|
|
|
|
|
|
|
while [ "$attempt" -le "$attempts" ]; do
|
|
|
|
|
if output="$(node "$REPO_ROOT/scripts/verify-release-registry-state.mjs" "$@" 2>&1)"; then
|
|
|
|
|
[ -n "$output" ] && printf '%s\n' "$output"
|
|
|
|
|
return 0
|
|
|
|
|
fi
|
|
|
|
|
status=$?
|
|
|
|
|
|
|
|
|
|
printf '%s\n' "$output" >&2
|
|
|
|
|
|
|
|
|
|
if [ "$status" -eq 2 ]; then
|
|
|
|
|
return "$status"
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
if [ "$attempt" -lt "$attempts" ]; then
|
|
|
|
|
release_warn "npm registry metadata has not converged yet (attempt ${attempt}/${attempts}); retrying in ${delay_seconds}s."
|
|
|
|
|
sleep "$delay_seconds"
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
attempt=$((attempt + 1))
|
|
|
|
|
done
|
|
|
|
|
|
|
|
|
|
return "${status:-1}"
|
|
|
|
|
}
|
|
|
|
|
|
2026-03-09 13:55:30 -05:00
|
|
|
require_clean_worktree() {
|
|
|
|
|
if [ -n "$(git -C "$REPO_ROOT" status --porcelain)" ]; then
|
|
|
|
|
release_fail "working tree is not clean. Commit, stash, or remove changes before releasing."
|
|
|
|
|
fi
|
|
|
|
|
}
|
|
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
require_on_master_branch() {
|
2026-03-09 13:55:30 -05:00
|
|
|
local current_branch
|
2026-03-17 14:08:55 -05:00
|
|
|
current_branch="$(git_current_branch)"
|
|
|
|
|
if [ "$current_branch" != "master" ]; then
|
|
|
|
|
release_fail "this release step must run from branch master, but current branch is ${current_branch:-<detached>}."
|
|
|
|
|
fi
|
2026-03-09 13:55:30 -05:00
|
|
|
}
|
|
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
require_npm_publish_auth() {
|
|
|
|
|
local dry_run="$1"
|
2026-03-09 13:55:30 -05:00
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
if [ "$dry_run" = true ]; then
|
|
|
|
|
return
|
|
|
|
|
fi
|
2026-03-09 13:55:30 -05:00
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
if npm whoami >/dev/null 2>&1; then
|
|
|
|
|
release_info " ✓ Logged in to npm as $(npm whoami)"
|
|
|
|
|
return
|
2026-03-09 13:55:30 -05:00
|
|
|
fi
|
|
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
if [ "${GITHUB_ACTIONS:-}" = "true" ]; then
|
|
|
|
|
release_info " ✓ npm publish auth will be provided by GitHub Actions trusted publishing"
|
|
|
|
|
return
|
2026-03-09 13:55:30 -05:00
|
|
|
fi
|
|
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
release_fail "npm publish auth is not available. Use 'npm login' locally or run from GitHub Actions with trusted publishing."
|
|
|
|
|
}
|
2026-03-09 13:55:30 -05:00
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
list_public_package_info() {
|
|
|
|
|
node "$REPO_ROOT/scripts/release-package-map.mjs" list
|
2026-03-09 13:55:30 -05:00
|
|
|
}
|
|
|
|
|
|
2026-03-17 14:08:55 -05:00
|
|
|
set_public_package_version() {
|
|
|
|
|
node "$REPO_ROOT/scripts/release-package-map.mjs" set-version "$1"
|
2026-03-09 13:55:30 -05:00
|
|
|
}
|