From 23b9aaa8e697dc9808e2229eea357da24e69560e Mon Sep 17 00:00:00 2001 From: Devin Foley Date: Fri, 9 Oct 2026 17:14:32 -0700 Subject: [PATCH] fix(release): reuse publisher lockfile for canary smoke (#15712) ## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Every master push publishes an exact canary and tests its onboarding flow. > - The publisher resolves dependencies before building, while the smoke job checks out the committed lockfile again. > - Patch or manifest changes can land before the separate lockfile refresh, so the smoke fails before testing the published app. > - This pull request passes the publisher's resolved lockfile to the same-source smoke job. > - The smoke keeps frozen dependency validation and tests the exact published canary version. ## Linked Issues or Issue Description Refs #10393, #13689. Related work: #13690 documents lockfile drift; #12115 addresses refresh-PR check triggering. This change addresses the canary smoke handoff. #15678 only refreshed the opencode importer. #15164 incidentally corrected the earlier patch hash on master. **What happened?** Canary publication succeeded, but the fresh onboarding smoke install failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` on sources `0b80ea17ef` and `ab8dcab809`. The committed `acpx@0.13.1` hash no longer matched its patch. A later run on `6080daf262` failed with `ERR_PNPM_OUTDATED_LOCKFILE` after an `opencode-ai` manifest addition. The current master lockfile has since caught up; the workflow still permits this race on future changes. **Expected behavior** The exact published canary reaches the onboarding smoke with test dependencies resolved for its source. A mismatched or missing lockfile must fail validation. **Steps to reproduce** Check out either affected source and run `pnpm install --frozen-lockfile` with pnpm 9.15.4. The smoke fails before a browser starts, although the publisher already installed that source with a resolved lockfile. ## What Changed - Pin both canary publisher and onboarding smoke checkouts to the triggering SHA. - Save the publisher's resolved lockfile before restoring tracked files or rewriting release versions. - Restore that same-run, source-named artifact before the unchanged frozen smoke install. - Add offline real-pnpm regressions for patch-hash and manifest drift, plus wrong-source rejection and workflow binding checks. - Document artifact retention and job reruns. No manifest or committed lockfile changes. ## Verification - Focused release workflow, exact-source verification and image-contract tests: 45 passed. - Negative control: both new real-pnpm fixture cases fail against the original workflow with their respective original lockfile errors; both pass with the handoff. - `pnpm install --frozen-lockfile` passed on the current source. - `pnpm -r typecheck` and `pnpm build` passed after reclaiming disposable build-cache space. - The browser onboarding smoke passed against exact published `2026.1009.0-canary.7`: 1 test passed using a fresh temporary instance. - Full local `pnpm test:run` was attempted twice. The first hit disk exhaustion; the second reported one chat integration failure and then a Vitest worker `ENOTCONN` crash before completing. This is not a full-suite pass. The named chat case passed in isolation without changes. All full sharded PR CI checks passed on the final head. - Independent source review and a clean-checkout run also passed all 45 focused tests, with separate real-pnpm negative controls. - The supply-chain scan is neutral because managed intelligence could not scan the pinned official `download-artifact` action. It reported no defect; independent review inspected the action source, same-run scope and v4/v4 compatibility. - Reviewed the diff for secrets, personal data and generated artifacts; none found. ## Risks - The smoke now depends on a same-run GitHub artifact retained for 14 days. A missing artifact intentionally fails instead of resolving a different dependency set. - A publisher rerun replaces its source-named artifact; a smoke-only rerun reuses the retained artifact. - Frozen validation and the exact published version remain required. The source app and publication logic do not change. ## Model Used OpenAI GPT-6 through Codex, with tool execution and parallel independent review. The exact serving variant and context-window size are not exposed in this session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip --- .github/workflows/release.yml | 23 +++++ doc/RELEASING.md | 12 +++ .../release-verify-workflow.test.mjs | 96 ++++++++++++++++++- 3 files changed, 130 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 32b36ea242..cdb91e941d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -354,6 +354,7 @@ jobs: - name: Checkout repository uses: actions/checkout@v7 with: + ref: ${{ github.sha }} fetch-depth: 0 - name: Setup pnpm @@ -373,6 +374,18 @@ jobs: - name: Install dependencies run: pnpm install --no-frozen-lockfile + # Master can precede the separate lockfile-refresh PR. Preserve the + # resolution used for this build before release tooling restores the + # tracked lockfile or rewrites workspace versions. + - name: Save canary smoke lockfile + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + with: + name: canary-smoke-lockfile-${{ github.sha }} + path: pnpm-lock.yaml + if-no-files-found: error + overwrite: true + retention-days: 14 + - name: Restore tracked install-time changes run: git checkout -- pnpm-lock.yaml @@ -447,6 +460,9 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + ref: ${{ github.sha }} + persist-credentials: false - name: Setup pnpm uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 @@ -458,6 +474,13 @@ jobs: with: node-version: 24 + # Default download scope is this workflow run, including job reruns. + # A missing artifact fails instead of resolving a different dependency set. + - name: Restore canary smoke lockfile + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + with: + name: canary-smoke-lockfile-${{ github.sha }} + - name: Install test dependencies run: pnpm install --frozen-lockfile diff --git a/doc/RELEASING.md b/doc/RELEASING.md index 3eb0059316..fe7fb13fdf 100644 --- a/doc/RELEASING.md +++ b/doc/RELEASING.md @@ -103,6 +103,18 @@ It: - fails by default if npm leaves `latest` pointing at a canary; use `--allow-canary-latest` only when that state is intentional - creates a git tag `canary/vYYYY.MDD.P-canary.N` +After publication, the onboarding smoke checks out the same source SHA and +installs its test dependencies from the publisher's resolved lockfile with +`--frozen-lockfile`. The same-run artifact is captured before tracked files are +restored or release versions are rewritten. This lets a source commit use its +current patches and manifests while the separate lockfile-refresh PR is still +pending, without resolving new dependencies in the smoke job. The smoke still installs and tests +the exact published canary version, not a workspace build. + +The lockfile artifact is retained for 14 days. A publisher-job rerun replaces its +source-named artifact; a smoke-only rerun uses the existing artifact. A missing +artifact fails the job rather than falling back to a different dependency set. + Users install canaries with: ```bash diff --git a/scripts/__tests__/release-verify-workflow.test.mjs b/scripts/__tests__/release-verify-workflow.test.mjs index 98717aa8af..cc1602d086 100644 --- a/scripts/__tests__/release-verify-workflow.test.mjs +++ b/scripts/__tests__/release-verify-workflow.test.mjs @@ -1,6 +1,7 @@ import assert from "node:assert/strict"; import { spawnSync } from "node:child_process"; -import { existsSync, readdirSync, readFileSync } from "node:fs"; +import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; +import os from "node:os"; import path from "node:path"; import { fileURLToPath } from "node:url"; import test from "node:test"; @@ -170,6 +171,99 @@ test("published canaries are gated by the exact-version onboarding browser smoke assert.match(releaseWorkflow, /tests\/canary-onboarding\/playwright-report/); }); +test("canary smoke consumes its publisher's source-bound lockfile before frozen installation", () => { + const workflow = readWorkflow("release.yml"); + const publish = workflow.split(" publish_canary:\n")[1].split(" smoke_canary_onboarding:\n")[0]; + const smoke = workflow.split(" smoke_canary_onboarding:\n")[1].split(" # ----- Nightly lane")[0]; + for (const job of [publish, smoke]) { + assert.match(job, /name: Checkout repository\n\s+uses: actions\/checkout@[^\n]+\n\s+with:\n\s+ref: \$\{\{ github\.sha \}\}/); + assert.match(job, /name: canary-smoke-lockfile-\$\{\{ github\.sha \}\}/); + assert.match(job, /version: 9\.15\.4/); + } + assert.match(publish, /name: Save canary smoke lockfile\n\s+uses: actions\/upload-artifact@[0-9a-f]{40} # v4\n\s+with:\n\s+name: canary-smoke-lockfile-\$\{\{ github\.sha \}\}\n\s+path: pnpm-lock\.yaml\n\s+if-no-files-found: error\n\s+overwrite: true\n\s+retention-days: 14/); + assert.ok(publish.indexOf("name: Install dependencies") < publish.indexOf("name: Save canary smoke lockfile")); + assert.ok(publish.indexOf("name: Save canary smoke lockfile") < publish.indexOf("name: Restore tracked install-time changes")); + assert.ok(publish.indexOf("name: Restore tracked install-time changes") < publish.indexOf("name: Publish canary")); + assert.match(smoke, /name: Restore canary smoke lockfile\n\s+uses: actions\/download-artifact@[0-9a-f]{40} # v4\n\s+with:\n\s+name: canary-smoke-lockfile-\$\{\{ github\.sha \}\}/); + assert.ok(smoke.indexOf("name: Restore canary smoke lockfile") < smoke.indexOf("name: Install test dependencies")); + assert.doesNotMatch(smoke, /run-id:|github-token:|repository:|continue-on-error|--no-frozen-lockfile/); +}); + +for (const drift of ["patch", "manifest"]) { + test(`a publisher lockfile lets a fresh smoke install retain validation after ${drift} drift`, (t) => { + const root = mkdtempSync(path.join(os.tmpdir(), "canary-smoke-lockfile-test-")); + t.after(() => rmSync(root, { recursive: true, force: true })); + const source = path.join(root, "package"); + mkdirSync(source); + writeFileSync(path.join(source, "package.json"), JSON.stringify({ name: "smoke-fixture-dependency", version: "1.0.0" })); + writeFileSync(path.join(source, "index.js"), 'module.exports = "original";\n'); + const pack = spawnSync("npm", ["pack", "--ignore-scripts", "--pack-destination", root], { cwd: source, encoding: "utf8" }); + assert.equal(pack.status, 0, pack.stderr); + const manifest = { + name: "canary-smoke-fixture", private: true, + packageManager: "pnpm@9.15.4", + dependencies: { "smoke-fixture-dependency": "file:smoke-fixture-dependency-1.0.0.tgz" }, + pnpm: { patchedDependencies: { "smoke-fixture-dependency@1.0.0": "fixture.patch" } }, + }; + writeFileSync(path.join(root, "package.json"), JSON.stringify(manifest)); + writeFileSync(path.join(root, "pnpm-workspace.yaml"), "packages: []\n"); + const patch = (value) => writeFileSync(path.join(root, "fixture.patch"), [ + "diff --git a/index.js b/index.js", "index 1111111..2222222 100644", + "--- a/index.js", "+++ b/index.js", "@@ -1 +1 @@", + '-module.exports = "original";', `+module.exports = "${value}";`, "", + ].join("\n")); + const workflow = readWorkflow("release.yml"); + const publish = workflow.split(" publish_canary:\n")[1].split(" smoke_canary_onboarding:\n")[0]; + const smoke = workflow.split(" smoke_canary_onboarding:\n")[1].split(" # ----- Nightly lane")[0]; + const installArgs = (name) => { + const job = name === "Install dependencies" ? publish : smoke; + const command = job.match(new RegExp(`name: ${name}\\n\\s+run: (pnpm install[^\\n]+)`))?.[1]; + assert.ok(command, `missing ${name}`); + return [...command.split(" ").slice(1), "--offline", "--ignore-scripts"]; + }; + const install = (args) => spawnSync("pnpm", args, { + cwd: root, encoding: "utf8", env: { ...process.env, CI: "true" }, + }); + const success = (result) => assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`); + patch(drift === "patch" ? "old-patch" : "published-patch"); + success(install(installArgs("Install dependencies"))); + const staleLock = readFileSync(path.join(root, "pnpm-lock.yaml")); + if (drift === "patch") { + patch("published-patch"); + } else { + copyFileSync(path.join(root, "smoke-fixture-dependency-1.0.0.tgz"), path.join(root, "updated-dependency.tgz")); + manifest.dependencies["smoke-fixture-dependency"] = "file:updated-dependency.tgz"; + writeFileSync(path.join(root, "package.json"), JSON.stringify(manifest)); + } + const before = install(installArgs("Install test dependencies")); + assert.notEqual(before.status, 0); + assert.match(before.stdout + before.stderr, drift === "patch" ? /ERR_PNPM_LOCKFILE_CONFIG_MISMATCH/ : /ERR_PNPM_OUTDATED_LOCKFILE/); + + // Capture the publisher's resolution, then reproduce its tracked-file restore + // and a fresh smoke runner with no installed workspace dependencies. + success(install(installArgs("Install dependencies"))); + const artifact = path.join(root, "publisher-lock.yaml"); + if (publish.includes("name: Save canary smoke lockfile")) { + copyFileSync(path.join(root, "pnpm-lock.yaml"), artifact); + } + writeFileSync(path.join(root, "pnpm-lock.yaml"), staleLock); + rmSync(path.join(root, "node_modules"), { recursive: true, force: true }); + if (smoke.includes("name: Restore canary smoke lockfile")) { + copyFileSync(artifact, path.join(root, "pnpm-lock.yaml")); + } + success(install(installArgs("Install test dependencies"))); + assert.equal(readFileSync(path.join(root, "node_modules/smoke-fixture-dependency/index.js"), "utf8"), 'module.exports = "published-patch";\n'); + assert.deepEqual(readFileSync(path.join(root, "pnpm-lock.yaml")), readFileSync(artifact)); + + // A lockfile from the wrong source still fails closed; restoring an artifact + // must not disable hash validation or resolve another version in the smoke job. + patch("different-source"); + const wrongSource = install(installArgs("Install test dependencies")); + assert.notEqual(wrongSource.status, 0); + assert.match(wrongSource.stdout + wrongSource.stderr, /ERR_PNPM_LOCKFILE_CONFIG_MISMATCH/); + }); +} + test("every lane's tag push degrades to recovery instructions when rejected", () => { const releaseWorkflow = readWorkflow("release.yml");