mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-04 19:28:46 +01:00
DottaandPaperclip
4a38ff9c92
## Thinking Path > - Paperclip manages agent work and preserves task state. > - Cloud readiness verifies an exact source revision before release. > - Its workspace tests must wait for execution and database cleanup to finish. > - Two attempts hit the same ten-second polling limit and read a running row. > - The second attempt also lost AWS runners and exceeded a fixture cleanup limit. > - This pull request waits for owned execution, bounds client shutdown, and gives verification reruns an independent runner pool. > - Assertions, source identity and required verification gates stay in place. ## Linked Issues or Issue Description **What happened?** [Cloud readiness run 41684102136](https://github.com/paperclipai/paperclip/actions/runs/41684102136) failed twice on master `367f29478d14003cc5c0f161b7ce8f3164993634`. Attempt 1 failed `heartbeat-workspace-busy.test.ts:473`: expected `succeeded`, received `running`. Attempt 2 failed the same helper in the inherited-workspace resume case at line 744. The helper polls for ten seconds, then returns the active row as if the wait finished. Attempt 2 also exceeded the 30-second `workspace-preparation.test.ts` teardown limit. Its client close had no deadline, and database plus directory cleanup shared the default hook budget despite the fixture's existing 90-second startup budget. Other attempt-2 failures show runner shutdown or lost communication. Several shutdown signals arrived at 18:05:17 UTC. Read-only AWS inspection confirms that all eight infrastructure-failed instances carry `runs-on-workflow-job-interrupted=true`. Five have explicit `Server.SpotInstanceTermination` reasons, including the server-1 runner that lost communication. Three were terminated through the fleet's shutdown path. CloudTrail records the Rust runner's interruption tag at 18:03:37 UTC and its termination by the RunsOn fleet role at 18:05:31 UTC, despite EC2 showing a user-initiated termination. Repeating the entire workflow reused the same Spot fleet. **Expected behavior** Wait for owned heartbeat execution before reading final state or scheduled retries. Bound database-client shutdown and allow the fixture's cleanup cost class to finish. Rerun verification on GitHub-hosted runners after an interrupted fleet attempt. Preserve all checks and report prior failures. **Steps to reproduce** 1. Delay the test adapter beyond the helper's ten-second polling window. 2. Invoke the ordinary local shared-workspace run or resume the deferred sandbox run. 3. Observe the old helper return `running` before the execution completes. 4. Evaluate the old runner expressions with `github.run_attempt = 2`; they still choose the interrupted AWS pool. **Paperclip version or commit** Base: `367f29478d14003cc5c0f161b7ce8f3164993634`. **Deployment mode** GitHub Actions Cloud readiness, with disposable PostgreSQL fixtures. Related: #11293 fixed the earlier gap between cancellation and retry-row insertion. This change waits for the complete execution instead. Duplicate searches covered the workspace test, retention fixture and runner shutdown reports. ## What Changed - Replace both workspace-test polling helpers with the existing heartbeat completion barrier. Keep final status, retry and coordination assertions. - Bound workspace-preparation client shutdown to one second. Apply the existing embedded-PostgreSQL fixture budget to its teardown. - Use AWS only for the first exact-source attempt. Route later verification, chaos and cloud-migrator planning/build attempts to GitHub-hosted runners. The publisher keeps its existing routing. The final branch also incorporates upstream #18821's CODEOWNER routing fix. - Add runner-expression coverage for numeric, string, missing and later attempt values. Document retry routing. ## Verification - The original workflow's failed assertions and interrupted jobs remain linked above. A local two-suite run also passed all 157 assertions and failed only the original 30-second teardown hook. - All 341 workflow contracts pass. After the master synchronization, all 347 routing and CI-planner controls pass. Actionlint passes for the three changed workflows. - A matched delayed-adapter comparison uses disposable PostgreSQL 17 databases, the same 11-second adapter delay, and the same 90-second experimental outer budget. The old helper fails with `running`; the completion barrier passes. Production test deadlines stay unchanged. - Earlier experiments hit a 30-second experimental outer limit and the macOS host's shared-memory limit during native database startup. The completed comparison uses task-owned databases on an existing test server. Those earlier attempts are not counted as passes. - All 31 workspace-busy cases pass with normal test deadlines. The 126-case workspace fixture also passes with its 90-second teardown budget. - Final-head cleanup measurements: main client close 7 ms, owned database cleanup 20,938 ms, and workspace-home removal 826 ms. A measured fixture held 124,494 PostgreSQL files (208 MiB) after repeated table resets. The measured database cleanup alone consumes most of the old 30-second hook budget. The separate baseline reproduced a timeout at that hook; the fixture now uses its established 90-second cost class. - Repository typecheck and build pass on synchronized head `2aceb3abd144a569efddabed3b7e0550ea23ceb2`. - All 157 focused cases pass on the synchronized branch, including complete PostgreSQL 18 fixture shutdown. [Full hosted CI](https://github.com/paperclipai/paperclip/actions/runs/41697804471) passes on the final head, including the required verification and E2E aggregates, all server/chat/workspace groups, Runner lanes and all eight browser shards. The separate GitHub quality-review workflow also passes. All 60 reported checks are terminal: 54 pass, three are informational neutral results, and three are expected skips. There are no failures or pending checks. The complete local `pnpm test:run` command was not run; targeted fixtures already encountered this host's shared-memory limit. Hosted CI supplies the full Vitest and browser matrix. - Greptile and Paperclip Review both give synchronized head `2aceb3abd144a569efddabed3b7e0550ea23ceb2` 5/5. There are no open review threads. - Module-boundary and whitespace checks pass. ## Risks - Hosted reruns can have different cache hit rates and queue times. They execute the same source and verification commands. - The first attempt retains the existing AWS Spot fleet policy. AWS evidence establishes several interruption-triggered failures; later verification attempts use an independent pool. This does not change the fleet's external capacity policy. - The completion barrier waits for owned background execution. A hung execution still fails the test's outer deadline. - The larger teardown budget remains finite. PostgreSQL's bounded stop protocol and cleanup errors still fail the hook. - No production execution, database schema or provider contract changes. ## Model Used OpenAI Codex, based on GPT-6, with reasoning, repository inspection, code edits and test execution. The runtime does not expose the exact serving model ID or context-window size. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-Authored-By: Paperclip <noreply@paperclip.ing>
1678 lines
73 KiB
YAML
1678 lines
73 KiB
YAML
name: Release
|
|
run-name: ${{ inputs.channel == 'preview' && format('Stack deploy {0} build', inputs.request_id) || inputs.channel == 'cloud-migrator' && format('Cloud migrator {0}', inputs.source_ref) || 'Release' }}
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
schedule:
|
|
# Nightly cut at 09:00 UTC, after the workday's merges have settled.
|
|
- cron: "0 9 * * *"
|
|
workflow_dispatch:
|
|
inputs:
|
|
channel:
|
|
description: Release channel to publish
|
|
required: true
|
|
type: choice
|
|
options:
|
|
- stable
|
|
- beta
|
|
- nightly
|
|
- preview
|
|
- cloud-migrator
|
|
default: stable
|
|
source_ref:
|
|
description: Stable source ref, or full immutable SHA for a preview or cloud migrator build
|
|
required: true
|
|
type: string
|
|
default: master
|
|
request_id:
|
|
description: (preview/cloud-migrator) Correlation UUID
|
|
type: string
|
|
default: ""
|
|
preview_migrator:
|
|
description: (preview) Publish isolated shared and database packages if missing
|
|
type: boolean
|
|
default: false
|
|
stable_date:
|
|
description: Enter a UTC date in YYYY-MM-DD format, for example 2026-03-18. Do not enter a version string. The workflow will resolve that date to a stable version such as 2026.318.0, then 2026.318.1 for the next same-day stable.
|
|
required: false
|
|
type: string
|
|
source_version:
|
|
description: For nightly, the explicit canary version to promote (empty selects the newest canary on master). For beta, the explicit nightly version to promote (empty selects the newest nightly on master).
|
|
required: false
|
|
type: string
|
|
candidate_branch:
|
|
description: (beta) candidate/beta-* branch to build a cherry-picked beta from. Leave empty to promote a nightly. Mutually exclusive with source_version.
|
|
required: false
|
|
type: string
|
|
skip_soak_justification:
|
|
description: (stable) Written justification for publishing a stable whose source has not soaked as a beta for 3 days. Leave empty for normal releases.
|
|
required: false
|
|
type: string
|
|
dry_run:
|
|
description: Preview the release without publishing
|
|
required: true
|
|
type: boolean
|
|
default: false
|
|
|
|
concurrency:
|
|
group: ${{ (inputs.channel == 'preview' || inputs.channel == 'cloud-migrator') && format('{0}-{1}', inputs.channel, inputs.source_ref) || format('release-{0}-{1}', github.event_name, github.ref) }}
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
# npm accepts a publish immediately, but the registry's CDN can lag packument
|
|
# propagation by several minutes (observed 2.5-4+ minutes on 2026-08-21,
|
|
# which failed four consecutive canary runs mid-loop). Give release.sh's
|
|
# post-publish visibility poll a 10-minute budget per package instead of its
|
|
# 60-second default; a healthy publish still exits the poll on the first
|
|
# visible check. (A 5-minute budget missed by seconds on 2026-08-21:
|
|
# adapter-opencode-local was accepted at 07:02:27 and became visible at
|
|
# 07:07:40.) The publish jobs' timeout-minutes are sized for several
|
|
# laggard packages; if most of a batch lags the full budget, npm is having
|
|
# a real incident and the job failing is correct.
|
|
#
|
|
# Raised to 30 minutes on 2026-09-14, when 10 was not enough twice in a
|
|
# row: @paperclipai/server was accepted at 17:49:09 and became visible at
|
|
# 18:04:29 — five minutes after the poll gave up. Each timeout aborts the
|
|
# release mid-batch, leaving that version half-published, and because the
|
|
# next version number is derived from what is already on npm the retry
|
|
# moves to a new number and meets the same lag. Waiting is cheap; a
|
|
# half-published release is not.
|
|
#
|
|
# Packages are published and verified one at a time, so the publish jobs'
|
|
# timeout-minutes went to 150 alongside this: a 30-minute build plus four
|
|
# packages each lagging the full budget still finishes inside the job,
|
|
# instead of the job timing out mid-batch and leaving the same
|
|
# half-published state this budget exists to avoid.
|
|
NPM_PUBLISH_VERIFY_ATTEMPTS: "180"
|
|
NPM_PUBLISH_VERIFY_DELAY_SECONDS: "10"
|
|
|
|
jobs:
|
|
plan_preview:
|
|
# Only the current master commit can use AWS. A preview or older source
|
|
# falls back to GitHub-hosted runners, including raced merge dispatches.
|
|
name: Check preview artifacts
|
|
if: github.ref == 'refs/heads/master' && github.event_name == 'workflow_dispatch' && (inputs.channel == 'preview' || inputs.channel == 'cloud-migrator') && !inputs.dry_run
|
|
runs-on: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.run_attempt == 1 && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.event_name == 'workflow_dispatch' && inputs.channel == 'cloud-migrator' && github.sha != '' && inputs.source_ref == github.sha && 'runs-on/fleet=paperclip-post-merge-x64/env=public-ci' || 'ubuntu-latest' }}
|
|
permissions:
|
|
contents: read
|
|
# Preserve the previous hosted default; only AWS needs the Fleet limit.
|
|
timeout-minutes: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.run_attempt == 1 && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.event_name == 'workflow_dispatch' && inputs.channel == 'cloud-migrator' && github.sha != '' && inputs.source_ref == github.sha && 10 || 360 }}
|
|
outputs:
|
|
image: ${{ steps.plan.outputs.image }}
|
|
packages: ${{ steps.plan.outputs.packages }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- name: Validate immutable source and inspect existing artifacts
|
|
id: plan
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.source_ref }}
|
|
REQUEST_ID: ${{ inputs.request_id }}
|
|
PREVIEW_MIGRATOR: ${{ inputs.preview_migrator }}
|
|
PLAN_COMMAND: ${{ inputs.channel == 'cloud-migrator' && 'plan-migrator' || 'plan' }}
|
|
run: node scripts/preview-artifacts.mjs "$PLAN_COMMAND" "$SOURCE_SHA" "$REQUEST_ID" "$PREVIEW_MIGRATOR"
|
|
|
|
package_preview:
|
|
name: Build preview migrator
|
|
needs: plan_preview
|
|
if: needs.plan_preview.outputs.packages == 'true'
|
|
runs-on: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.run_attempt == 1 && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.event_name == 'workflow_dispatch' && inputs.channel == 'cloud-migrator' && github.sha != '' && inputs.source_ref == github.sha && 'runs-on/fleet=paperclip-post-merge-x64/env=public-ci' || 'ubuntu-latest' }}
|
|
timeout-minutes: 30
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
path: trusted
|
|
persist-credentials: false
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
ref: ${{ inputs.source_ref }}
|
|
path: source
|
|
persist-credentials: false
|
|
- uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
|
|
with:
|
|
version: 9.15.4
|
|
run_install: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- name: Install build dependencies without lifecycle scripts
|
|
working-directory: source
|
|
run: pnpm install --ignore-scripts --no-frozen-lockfile
|
|
- name: Build and pack exact-source preview packages
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.source_ref }}
|
|
run: node trusted/scripts/preview-artifacts.mjs pack source packages "$SOURCE_SHA"
|
|
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: preview-packages
|
|
overwrite: true
|
|
path: packages/*.tgz
|
|
if-no-files-found: error
|
|
retention-days: 7
|
|
|
|
publish_preview:
|
|
# npm trusted publishing supports GitHub-hosted runners only.
|
|
name: Publish preview migrator
|
|
needs: [plan_preview, package_preview]
|
|
if: github.ref == 'refs/heads/master' && needs.plan_preview.outputs.packages == 'true' && needs.package_preview.result == 'success'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
# A manual preview and a merge-triggered migrator may compile in parallel.
|
|
# Serialize only publication so they cannot race an immutable npm version,
|
|
# without making the migrator wait for a preview's separate image build.
|
|
concurrency:
|
|
group: preview-package-publish-${{ inputs.source_ref }}
|
|
cancel-in-progress: false
|
|
# Reuse release.yml's established npm trusted-publisher identity. This job
|
|
# publishes only isolated preview versions; it cannot advance lane tags.
|
|
environment: npm-canary
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- name: Install npm with trusted publishing support
|
|
run: npm install --global npm@11.18.0 --ignore-scripts
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: preview-packages
|
|
path: preview-packages
|
|
- name: Publish immutable preview packages without running package code
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.source_ref }}
|
|
run: node scripts/preview-artifacts.mjs publish preview-packages "$SOURCE_SHA"
|
|
|
|
image_preview:
|
|
name: Build preview cloud image
|
|
needs: plan_preview
|
|
if: needs.plan_preview.outputs.image == 'true'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
ref: ${{ inputs.source_ref }}
|
|
persist-credentials: false
|
|
- uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
|
|
with:
|
|
version: 9.15.4
|
|
run_install: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- name: Prepare locked image context
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.source_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
|
|
pnpm install --resolution-only --ignore-scripts --ignore-pnpmfile --no-frozen-lockfile
|
|
echo "TOOLS_EPOCH=$(date -u +%G-W%V)" >> "$GITHUB_ENV"
|
|
- uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
|
|
with:
|
|
buildkitd-config-inline: |
|
|
[registry."docker.io"]
|
|
mirrors = ["mirror.gcr.io"]
|
|
- name: Build the immutable cloud image without registry credentials
|
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
|
|
with:
|
|
context: .
|
|
target: cloud
|
|
platforms: linux/amd64
|
|
push: false
|
|
provenance: false # Docker archives cannot carry registry attestations.
|
|
outputs: type=docker,dest=${{ runner.temp }}/preview-image.tar
|
|
tags: ghcr.io/paperclipai/paperclip:sha-${{ inputs.source_ref }}-cloud
|
|
build-args: |
|
|
CLOUD_BUNDLED_PLUGINS=daytona
|
|
CLOUD_BUNDLED_SERVER_DEPS=@sentry/node
|
|
PAPERCLIP_BUILD_COMMIT=${{ inputs.source_ref }}
|
|
PAPERCLIP_BUILD_VERSION=0.0.0-preview.g${{ inputs.source_ref }}
|
|
CLI_TOOLS_CACHE_EPOCH=${{ env.TOOLS_EPOCH }}
|
|
labels: |
|
|
org.opencontainers.image.revision=${{ inputs.source_ref }}
|
|
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: preview-image
|
|
overwrite: true
|
|
path: ${{ runner.temp }}/preview-image.tar
|
|
compression-level: 0
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
publish_image_preview:
|
|
name: Publish preview cloud image
|
|
needs: [plan_preview, image_preview]
|
|
if: github.ref == 'refs/heads/master' && needs.plan_preview.outputs.image == 'true' && needs.image_preview.result == 'success'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
# This existing environment has an external master-only branch policy.
|
|
environment: npm-canary
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: preview-image
|
|
path: preview-image
|
|
- uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.repository_owner }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: Verify image identity and publish without executing image code
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.source_ref }}
|
|
run: node scripts/preview-artifacts.mjs publish-image preview-image/preview-image.tar "$SOURCE_SHA"
|
|
|
|
result_preview:
|
|
name: Verify preview artifacts
|
|
needs: [plan_preview, image_preview, publish_image_preview, package_preview, publish_preview]
|
|
if: >-
|
|
always() && inputs.channel == 'preview' && needs.plan_preview.result == 'success' &&
|
|
(needs.publish_image_preview.result == 'success' || needs.plan_preview.outputs.image == 'false') &&
|
|
(needs.publish_preview.result == 'success' || needs.plan_preview.outputs.packages == 'false')
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- name: Confirm exact artifacts are visible
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.source_ref }}
|
|
REQUEST_ID: ${{ inputs.request_id }}
|
|
PREVIEW_MIGRATOR: ${{ inputs.preview_migrator }}
|
|
run: node scripts/preview-artifacts.mjs result "$SOURCE_SHA" "$REQUEST_ID"
|
|
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: stack-deploy-result
|
|
overwrite: true
|
|
path: stack-deploy-result/result.json
|
|
if-no-files-found: error
|
|
retention-days: 30
|
|
|
|
verify_canary:
|
|
name: Reuse exact-source verification
|
|
if: github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 50
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- name: Require successful source checks for this exact master push
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
SOURCE_SHA: ${{ github.sha }}
|
|
run: node scripts/cloud-source-verification.mjs "$SOURCE_SHA"
|
|
|
|
release_runner_source:
|
|
needs: [verify_canary, select_nightly, select_beta, preflight_stable]
|
|
if: >-
|
|
!cancelled() && (
|
|
(github.event_name == 'push' && needs.verify_canary.result == 'success') ||
|
|
(needs.select_nightly.result == 'success' && needs.select_nightly.outputs.proceed == 'true') ||
|
|
needs.select_beta.result == 'success' || needs.preflight_stable.result == 'success')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
sha: ${{ steps.source.outputs.sha }}
|
|
required: ${{ steps.source.outputs.required }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
with:
|
|
ref: ${{ needs.preflight_stable.outputs.sha || needs.select_beta.outputs.sha || needs.select_nightly.outputs.sha || github.sha }}
|
|
persist-credentials: false
|
|
- name: Read the exact source packaging contract
|
|
id: source
|
|
env:
|
|
SOURCE_SHA: ${{ needs.preflight_stable.outputs.sha || needs.select_beta.outputs.sha || needs.select_nightly.outputs.sha || github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
[[ "$SOURCE_SHA" =~ ^[a-f0-9]{40}$ ]] || exit 1
|
|
[[ "$(git rev-parse HEAD)" == "$SOURCE_SHA" ]] || exit 1
|
|
echo "sha=$SOURCE_SHA" >> "$GITHUB_OUTPUT"
|
|
source_script="$(git show "$SOURCE_SHA:scripts/release.sh")" || exit 1
|
|
if printf '%s\n' "$source_script" | grep -F 'assemble-daemons "$PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR"' > /dev/null; then
|
|
echo "required=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "required=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
release_runner_binaries:
|
|
needs: release_runner_source
|
|
if: ${{ !cancelled() && needs.release_runner_source.result == 'success' && needs.release_runner_source.outputs.required == 'true' }}
|
|
uses: ./.github/workflows/release-verify.yml
|
|
with:
|
|
ref: ${{ needs.release_runner_source.outputs.sha }}
|
|
runner_binaries_only: true
|
|
|
|
publish_canary:
|
|
if: ${{ !cancelled() && github.event_name == 'push' && needs.verify_canary.result == 'success' && needs.release_runner_source.result == 'success' && (needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') }}
|
|
needs: [verify_canary, release_runner_source, release_runner_binaries]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 150
|
|
environment: npm-canary
|
|
outputs:
|
|
canary_version: ${{ steps.canary_tag.outputs.version }}
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
# For the explicit docker.yml dispatch below.
|
|
actions: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
fetch-depth: 0
|
|
|
|
- name: Attach verified canary source to local master
|
|
env:
|
|
SOURCE_SHA: ${{ github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ "$GITHUB_REPOSITORY" != "paperclipai/paperclip" ] ||
|
|
[ "$GITHUB_EVENT_NAME" != "push" ] ||
|
|
[ "$GITHUB_REF" != "refs/heads/master" ]; then
|
|
echo "Error: canary branch attachment requires a trusted master push." >&2
|
|
exit 1
|
|
fi
|
|
if ! [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]] ||
|
|
[ "$(git rev-parse HEAD)" != "$SOURCE_SHA" ]; then
|
|
echo "Error: canary checkout does not match the pinned source SHA." >&2
|
|
exit 1
|
|
fi
|
|
git checkout -B master "$SOURCE_SHA"
|
|
test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
|
|
|
|
- name: Download exact-source release daemon receipts
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-runner-inputs
|
|
merge-multiple: true
|
|
- name: Download target-owned Linux provider-pack identities
|
|
if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.provider_pack_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-provider-pack-inputs
|
|
merge-multiple: true
|
|
- name: Bind provider-pack inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
|
|
run: echo "PAPERCLIP_RELEASE_PROVIDER_PACK_ARTIFACTS_DIR=$RUNNER_TEMP/release-provider-pack-inputs" >> "$GITHUB_ENV"
|
|
- name: Bind daemon inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 9.15.4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: Validate release package manifest
|
|
run: node ./scripts/release-package-map.mjs check
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --no-frozen-lockfile
|
|
|
|
# Master can precede the separate lockfile-refresh PR. Preserve the
|
|
# resolution used for this build before release tooling restores the
|
|
# tracked lockfile or rewrites workspace versions.
|
|
- name: Save canary smoke lockfile
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: canary-smoke-lockfile-${{ github.sha }}
|
|
path: pnpm-lock.yaml
|
|
if-no-files-found: error
|
|
overwrite: true
|
|
retention-days: 14
|
|
|
|
- name: Restore tracked install-time changes
|
|
run: git checkout -- pnpm-lock.yaml
|
|
|
|
- name: Configure git author
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
|
|
- name: Publish canary
|
|
env:
|
|
GITHUB_ACTIONS: "true"
|
|
run: ./scripts/release.sh canary --skip-verify
|
|
|
|
- name: Dump npm debug logs
|
|
if: failure()
|
|
run: |
|
|
shopt -s nullglob
|
|
for f in "$HOME"/.npm/_logs/*.log; do
|
|
echo "===== $f ====="
|
|
tail -n 300 "$f" | sed -E \
|
|
-e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig'
|
|
done
|
|
|
|
- name: Push canary tag
|
|
id: canary_tag
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^canary/v' | head -1)"
|
|
if [ -z "$tag" ]; then
|
|
echo "Error: no canary tag points at HEAD after release." >&2
|
|
exit 1
|
|
fi
|
|
git push origin "refs/tags/${tag}"
|
|
echo "version=${tag#canary/v}" >> "$GITHUB_OUTPUT"
|
|
|
|
# Canary images previously relied on the master-push docker.yml run,
|
|
# whose single pending concurrency slot gets superseded by every
|
|
# newer push — on a busy day no canary image publishes at all (five
|
|
# consecutive canaries shipped npm packages with no cloud image on
|
|
# 2026-09-06, starving downstream managed deploys for ~18 hours).
|
|
# Tag pushes made with GITHUB_TOKEN do not fire docker.yml's
|
|
# triggers, so dispatch the image build at the canary tag
|
|
# explicitly, exactly like the nightly and beta lanes: the run keys
|
|
# its concurrency off the tag ref, so no master push can supersede
|
|
# it, and docker.yml's `type=sha` mapping publishes the
|
|
# standard sha-<short> images either way.
|
|
- name: Build Docker images for the canary tag
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
{
|
|
echo "## Canary published"
|
|
echo ""
|
|
echo "- Published canary: \`${{ steps.canary_tag.outputs.version }}\`"
|
|
echo "- Docker build dispatched at \`canary/v${{ steps.canary_tag.outputs.version }}\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
gh workflow run docker.yml --ref "refs/tags/canary/v${{ steps.canary_tag.outputs.version }}" --repo "$GITHUB_REPOSITORY"
|
|
|
|
# The package is already public when this gate runs. A red result leaves the
|
|
# immutable canary in npm, but makes the release workflow visibly fail before
|
|
# anyone mistakes an installable package for an onboardable one.
|
|
smoke_canary_onboarding:
|
|
needs: publish_canary
|
|
if: ${{ !cancelled() && needs.publish_canary.result == 'success' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
PAPERCLIPAI_VERSION: ${{ needs.publish_canary.outputs.canary_version }}
|
|
PAPERCLIP_PLAYWRIGHT_CHANNEL: chrome
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
persist-credentials: false
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
|
|
with:
|
|
version: 9.15.4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
|
|
# Default download scope is this workflow run, including job reruns.
|
|
# A missing artifact fails instead of resolving a different dependency set.
|
|
- name: Restore canary smoke lockfile
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
|
|
with:
|
|
name: canary-smoke-lockfile-${{ github.sha }}
|
|
|
|
- name: Install test dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Show browser version
|
|
run: google-chrome --version
|
|
|
|
- name: Smoke exact published canary through onboarding
|
|
env:
|
|
PAPERCLIP_CANARY_SMOKE_SERVER_LOG: ${{ runner.temp }}/canary-onboarding-server.log
|
|
run: pnpm run test:canary-onboarding-smoke
|
|
|
|
- name: Upload failed canary onboarding diagnostics
|
|
if: failure()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: canary-onboarding-smoke-${{ needs.publish_canary.outputs.canary_version }}
|
|
if-no-files-found: warn
|
|
retention-days: 14
|
|
path: |
|
|
${{ runner.temp }}/canary-onboarding-server.log
|
|
tests/canary-onboarding/playwright-report/
|
|
tests/canary-onboarding/test-results/
|
|
|
|
# ----- Nightly lane -----------------------------------------------------
|
|
# Once a night (or on a forced nightly dispatch), promote the newest master
|
|
# commit that already shipped a green canary: smoke-test that exact
|
|
# published canary first, then republish the same commit under the nightly
|
|
# identity. The candidate commit already passed release-verify during its
|
|
# canary publish, so the nightly publish skips re-verification.
|
|
|
|
select_nightly:
|
|
if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.channel == 'nightly')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
proceed: ${{ steps.select.outputs.proceed }}
|
|
sha: ${{ steps.select.outputs.sha }}
|
|
canary_version: ${{ steps.select.outputs.canary_version }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: master
|
|
fetch-depth: 0
|
|
|
|
- name: Select nightly candidate
|
|
id: select
|
|
env:
|
|
EXPLICIT_CANARY_VERSION: ${{ github.event_name == 'workflow_dispatch' && inputs.source_version || '' }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
git fetch origin --tags --prune --quiet
|
|
|
|
skip() {
|
|
echo "proceed=false" >> "$GITHUB_OUTPUT"
|
|
{
|
|
echo "## Nightly skipped"
|
|
echo ""
|
|
echo "$1"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
echo "Nightly skipped: $1"
|
|
}
|
|
|
|
if [ -n "${EXPLICIT_CANARY_VERSION:-}" ]; then
|
|
tag="canary/v${EXPLICIT_CANARY_VERSION}"
|
|
sha="$(git rev-list -n 1 "$tag" 2>/dev/null || true)"
|
|
if [ -z "$sha" ]; then
|
|
echo "Error: tag $tag does not exist." >&2
|
|
exit 1
|
|
fi
|
|
else
|
|
# Newest canary-tagged commit on master. Canary tags are pushed
|
|
# only after a successful canary publish, so tag presence is the
|
|
# green-publish signal. Walk master newest-first and stop at the
|
|
# first commit that carries a canary tag.
|
|
sha="$(grep -m1 -F \
|
|
-f <(git for-each-ref 'refs/tags/canary/v*' --format='%(objectname)') \
|
|
<(git rev-list origin/master -n 500) || true)"
|
|
|
|
if [ -z "$sha" ]; then
|
|
skip "No canary/v* tag found on the last 500 commits of master."
|
|
exit 0
|
|
fi
|
|
|
|
tag="$(git tag --points-at "$sha" | grep '^canary/v' | sort -V | tail -1)"
|
|
fi
|
|
|
|
canary_version="${tag#canary/v}"
|
|
|
|
existing_nightly="$(git tag --points-at "$sha" | grep '^nightly/v' | head -1 || true)"
|
|
if [ -n "$existing_nightly" ]; then
|
|
skip "Candidate \`$sha\` (canary \`$canary_version\`) already shipped as \`$existing_nightly\`."
|
|
exit 0
|
|
fi
|
|
|
|
# Promotions run the release tooling of the source commit, so the
|
|
# source must already understand the nightly channel. (Literal match
|
|
# of release.sh's channel case arm; if that line is reformatted this
|
|
# fails closed and should be updated alongside it.)
|
|
if ! git show "${sha}:scripts/release.sh" | grep -qF 'canary|nightly'; then
|
|
echo "Error: source commit $sha predates nightly release tooling; promote a newer canary." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "proceed=true" >> "$GITHUB_OUTPUT"
|
|
echo "sha=$sha" >> "$GITHUB_OUTPUT"
|
|
echo "canary_version=$canary_version" >> "$GITHUB_OUTPUT"
|
|
{
|
|
echo "## Nightly candidate"
|
|
echo ""
|
|
echo "- Source SHA: \`$sha\`"
|
|
echo "- Source canary: \`$canary_version\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
# Gate the promotion on the release smoke suite, run against the exact
|
|
# published canary artifact that would become tonight's nightly. Red smoke
|
|
# means no nightly tonight. Skipped for dry-run dispatches.
|
|
smoke_nightly:
|
|
needs: select_nightly
|
|
if: needs.select_nightly.outputs.proceed == 'true' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run)
|
|
uses: ./.github/workflows/release-smoke.yml
|
|
with:
|
|
paperclip_version: ${{ needs.select_nightly.outputs.canary_version }}
|
|
artifact_name: nightly-release-smoke
|
|
|
|
publish_nightly:
|
|
needs: [select_nightly, smoke_nightly, release_runner_source, release_runner_binaries]
|
|
# Publish when smoke passed, or when smoke was deliberately skipped by a
|
|
# dry-run dispatch (the publish itself is a dry-run in that case).
|
|
if: >-
|
|
!cancelled() &&
|
|
needs.select_nightly.outputs.proceed == 'true' &&
|
|
needs.release_runner_source.result == 'success' &&
|
|
(needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') &&
|
|
(needs.smoke_nightly.result == 'success' ||
|
|
(needs.smoke_nightly.result == 'skipped' && github.event_name == 'workflow_dispatch' && inputs.dry_run))
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 150
|
|
environment: npm-canary
|
|
# The workflow-level concurrency group is per event, so a forced dispatch
|
|
# nightly could otherwise overlap the scheduled one and race it to the
|
|
# same next -nightly.N version. Serialize actual nightly publishes across
|
|
# events here; release.sh additionally refuses to double-publish a commit
|
|
# that already carries a nightly tag.
|
|
concurrency:
|
|
group: release-publish-nightly
|
|
cancel-in-progress: false
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
actions: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ needs.select_nightly.outputs.sha }}
|
|
fetch-depth: 0
|
|
|
|
- name: Download exact-source release daemon receipts
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-runner-inputs
|
|
merge-multiple: true
|
|
- name: Download target-owned Linux provider-pack identities
|
|
if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.provider_pack_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-provider-pack-inputs
|
|
merge-multiple: true
|
|
- name: Bind provider-pack inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
|
|
run: echo "PAPERCLIP_RELEASE_PROVIDER_PACK_ARTIFACTS_DIR=$RUNNER_TEMP/release-provider-pack-inputs" >> "$GITHUB_ENV"
|
|
- name: Bind daemon inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 9.15.4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: Validate release package manifest
|
|
run: node ./scripts/release-package-map.mjs check
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --no-frozen-lockfile
|
|
|
|
- name: Restore tracked install-time changes
|
|
run: git checkout -- pnpm-lock.yaml
|
|
|
|
- name: Configure git author
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
|
|
- name: Publish nightly
|
|
env:
|
|
GITHUB_ACTIONS: "true"
|
|
run: |
|
|
args=(nightly --skip-verify)
|
|
if [ "${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}" = "true" ]; then
|
|
args+=(--dry-run)
|
|
fi
|
|
./scripts/release.sh "${args[@]}"
|
|
|
|
- name: Dump npm debug logs
|
|
if: failure()
|
|
run: |
|
|
shopt -s nullglob
|
|
for f in "$HOME"/.npm/_logs/*.log; do
|
|
echo "===== $f ====="
|
|
tail -n 300 "$f" | sed -E \
|
|
-e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig'
|
|
done
|
|
|
|
- name: Push nightly tag
|
|
if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry_run) }}
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^nightly/v' | head -1)"
|
|
if [ -z "$tag" ]; then
|
|
echo "Error: no nightly tag points at HEAD after release." >&2
|
|
exit 1
|
|
fi
|
|
if ! git push origin "refs/tags/${tag}"; then
|
|
sha="$(git rev-parse HEAD)"
|
|
{
|
|
echo "## Tag push rejected"
|
|
echo ""
|
|
echo "The npm publish succeeded, but pushing \`${tag}\` was rejected."
|
|
echo "This usually means the tagged commit modifies workflow files,"
|
|
echo "which GITHUB_TOKEN may not reference when creating refs from"
|
|
echo "dispatch or scheduled runs. Recover with maintainer credentials:"
|
|
echo ""
|
|
echo '```'
|
|
echo "git tag ${tag} ${sha}"
|
|
echo "git push origin refs/tags/${tag}"
|
|
echo "gh workflow run docker.yml --ref refs/tags/${tag}"
|
|
echo '```'
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
echo "::error::Tag push rejected; see the job summary for recovery commands." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Tag pushes made with GITHUB_TOKEN do not fire docker.yml's tag
|
|
# trigger (GitHub suppresses workflow runs caused by GITHUB_TOKEN
|
|
# pushes), so dispatch the image build at the new tag explicitly.
|
|
- name: Build Docker images for the nightly tag
|
|
if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry_run) }}
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^nightly/v' | head -1)"
|
|
{
|
|
echo "## Nightly published"
|
|
echo ""
|
|
echo "- Source SHA: \`${{ needs.select_nightly.outputs.sha }}\`"
|
|
echo "- Source canary: \`${{ needs.select_nightly.outputs.canary_version }}\`"
|
|
echo "- Published nightly: \`${tag#nightly/v}\`"
|
|
echo "- Docker build dispatched at \`${tag}\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
gh workflow run docker.yml --ref "refs/tags/${tag}" --repo "$GITHUB_REPOSITORY"
|
|
|
|
# ----- Beta lane --------------------------------------------------------
|
|
# Beta is a manual, human-approved promotion of a nightly. Unlike the
|
|
# scheduled nightly lane, a beta dispatch is explicit operator intent, so
|
|
# selection problems fail the run loudly instead of skipping quietly. The
|
|
# publish runs behind the npm-beta environment, whose required reviewers
|
|
# are the approval gate.
|
|
|
|
select_beta:
|
|
if: github.event_name == 'workflow_dispatch' && inputs.channel == 'beta'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
sha: ${{ steps.select.outputs.sha }}
|
|
nightly_version: ${{ steps.select.outputs.nightly_version }}
|
|
mode: ${{ steps.select.outputs.mode }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: master
|
|
fetch-depth: 0
|
|
|
|
- name: Select beta candidate
|
|
id: select
|
|
env:
|
|
EXPLICIT_NIGHTLY_VERSION: ${{ inputs.source_version }}
|
|
CANDIDATE_BRANCH: ${{ inputs.candidate_branch }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
git fetch origin --tags --prune --quiet
|
|
|
|
# Candidate mode: build a cherry-picked beta from a short-lived
|
|
# candidate branch instead of promoting a nightly.
|
|
if [ -n "${CANDIDATE_BRANCH:-}" ]; then
|
|
if [ -n "${EXPLICIT_NIGHTLY_VERSION:-}" ]; then
|
|
echo "Error: candidate_branch and source_version are mutually exclusive." >&2
|
|
exit 1
|
|
fi
|
|
case "$CANDIDATE_BRANCH" in
|
|
candidate/beta-*) ;;
|
|
*)
|
|
echo "Error: candidate branches must be named candidate/beta-<target> (got: $CANDIDATE_BRANCH)." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
git fetch origin "$CANDIDATE_BRANCH" --quiet
|
|
sha="$(git rev-parse --verify "origin/${CANDIDATE_BRANCH}^{commit}" 2>/dev/null || true)"
|
|
if [ -z "$sha" ]; then
|
|
echo "Error: candidate branch $CANDIDATE_BRANCH does not exist on origin." >&2
|
|
exit 1
|
|
fi
|
|
|
|
existing_beta="$(git tag --points-at "$sha" | grep '^beta/v' | head -1 || true)"
|
|
if [ -n "$existing_beta" ]; then
|
|
echo "Error: candidate head $sha already shipped as $existing_beta." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! git show "${sha}:scripts/release.sh" | grep -qF -- '--from-candidate'; then
|
|
echo "Error: candidate head $sha predates candidate-build release tooling; rebase the candidate onto a newer base." >&2
|
|
exit 1
|
|
fi
|
|
|
|
merge_base="$(git merge-base origin/master "$sha")"
|
|
echo "mode=candidate" >> "$GITHUB_OUTPUT"
|
|
echo "sha=$sha" >> "$GITHUB_OUTPUT"
|
|
echo "nightly_version=" >> "$GITHUB_OUTPUT"
|
|
{
|
|
echo "## Beta candidate branch"
|
|
echo ""
|
|
echo "- Branch: \`$CANDIDATE_BRANCH\`"
|
|
echo "- Head: \`$sha\`"
|
|
echo "- Base (merge-base with master): \`$merge_base\`"
|
|
echo "- Cherry-picked commits:"
|
|
echo ""
|
|
echo '\`\`\`'
|
|
git log --oneline "${merge_base}..${sha}"
|
|
echo '\`\`\`'
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
|
|
echo "mode=promote" >> "$GITHUB_OUTPUT"
|
|
|
|
if [ -n "${EXPLICIT_NIGHTLY_VERSION:-}" ]; then
|
|
tag="nightly/v${EXPLICIT_NIGHTLY_VERSION}"
|
|
sha="$(git rev-list -n 1 "$tag" 2>/dev/null || true)"
|
|
if [ -z "$sha" ]; then
|
|
echo "Error: tag $tag does not exist." >&2
|
|
exit 1
|
|
fi
|
|
else
|
|
# Newest nightly-tagged commit on master.
|
|
sha="$(grep -m1 -F \
|
|
-f <(git for-each-ref 'refs/tags/nightly/v*' --format='%(objectname)') \
|
|
<(git rev-list origin/master -n 2000) || true)"
|
|
|
|
if [ -z "$sha" ]; then
|
|
echo "Error: no nightly/v* tag found on the last 2000 commits of master. Publish a nightly first, or pass source_version." >&2
|
|
exit 1
|
|
fi
|
|
|
|
tag="$(git tag --points-at "$sha" | grep '^nightly/v' | sort -V | tail -1)"
|
|
fi
|
|
|
|
nightly_version="${tag#nightly/v}"
|
|
|
|
existing_beta="$(git tag --points-at "$sha" | grep '^beta/v' | head -1 || true)"
|
|
if [ -n "$existing_beta" ]; then
|
|
echo "Error: candidate $sha (nightly $nightly_version) already shipped as $existing_beta." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Promotions run the release tooling of the source commit, so the
|
|
# source must already understand the beta channel. (Literal match of
|
|
# release.sh's channel case arm; if that line is reformatted this
|
|
# fails closed and should be updated alongside it.)
|
|
if ! git show "${sha}:scripts/release.sh" | grep -qF 'canary|nightly|beta|stable)'; then
|
|
echo "Error: source commit $sha predates beta release tooling; promote a newer nightly whose source contains the beta channel." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "sha=$sha" >> "$GITHUB_OUTPUT"
|
|
echo "nightly_version=$nightly_version" >> "$GITHUB_OUTPUT"
|
|
{
|
|
echo "## Beta candidate"
|
|
echo ""
|
|
echo "- Source SHA: \`$sha\`"
|
|
echo "- Source nightly: \`$nightly_version\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
# Candidate-branch heads are new commits that never went through a canary
|
|
# or nightly, so they must pass full verification before publishing.
|
|
# Promoted nightlies were already verified by their canary run and skip it.
|
|
verify_beta_candidate:
|
|
needs: select_beta
|
|
if: needs.select_beta.outputs.mode == 'candidate'
|
|
uses: ./.github/workflows/release-verify.yml
|
|
with:
|
|
ref: ${{ needs.select_beta.outputs.sha }}
|
|
|
|
publish_beta:
|
|
needs: [select_beta, verify_beta_candidate, release_runner_source, release_runner_binaries]
|
|
if: >-
|
|
!cancelled() &&
|
|
needs.select_beta.result == 'success' &&
|
|
needs.release_runner_source.result == 'success' &&
|
|
(needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') &&
|
|
(needs.verify_beta_candidate.result == 'success' ||
|
|
(needs.verify_beta_candidate.result == 'skipped' && needs.select_beta.outputs.mode == 'promote'))
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 150
|
|
environment: npm-beta
|
|
# Serialize beta publishes so two dispatches cannot race to the same next
|
|
# -beta.N version; release.sh additionally refuses to double-publish a
|
|
# commit that already carries a beta tag.
|
|
concurrency:
|
|
group: release-publish-beta
|
|
cancel-in-progress: false
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
actions: write
|
|
outputs:
|
|
beta_version: ${{ steps.result.outputs.beta_version }}
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ needs.select_beta.outputs.sha }}
|
|
fetch-depth: 0
|
|
|
|
- name: Download exact-source release daemon receipts
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-runner-inputs
|
|
merge-multiple: true
|
|
- name: Download target-owned Linux provider-pack identities
|
|
if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.provider_pack_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-provider-pack-inputs
|
|
merge-multiple: true
|
|
- name: Bind provider-pack inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
|
|
run: echo "PAPERCLIP_RELEASE_PROVIDER_PACK_ARTIFACTS_DIR=$RUNNER_TEMP/release-provider-pack-inputs" >> "$GITHUB_ENV"
|
|
- name: Bind daemon inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 9.15.4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: Validate release package manifest
|
|
run: node ./scripts/release-package-map.mjs check
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --no-frozen-lockfile
|
|
|
|
- name: Restore tracked install-time changes
|
|
run: git checkout -- pnpm-lock.yaml
|
|
|
|
- name: Configure git author
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
|
|
- name: Publish beta
|
|
env:
|
|
GITHUB_ACTIONS: "true"
|
|
run: |
|
|
args=(beta --skip-verify)
|
|
if [ "${{ needs.select_beta.outputs.mode }}" = "candidate" ]; then
|
|
args+=(--from-candidate)
|
|
fi
|
|
if [ "${{ inputs.dry_run }}" = "true" ]; then
|
|
args+=(--dry-run)
|
|
fi
|
|
./scripts/release.sh "${args[@]}"
|
|
|
|
- name: Dump npm debug logs
|
|
if: failure()
|
|
run: |
|
|
shopt -s nullglob
|
|
for f in "$HOME"/.npm/_logs/*.log; do
|
|
echo "===== $f ====="
|
|
tail -n 300 "$f" | sed -E \
|
|
-e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig'
|
|
done
|
|
|
|
- name: Push beta tag
|
|
if: ${{ !inputs.dry_run }}
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^beta/v' | head -1)"
|
|
if [ -z "$tag" ]; then
|
|
echo "Error: no beta tag points at HEAD after release." >&2
|
|
exit 1
|
|
fi
|
|
if ! git push origin "refs/tags/${tag}"; then
|
|
sha="$(git rev-parse HEAD)"
|
|
{
|
|
echo "## Tag push rejected"
|
|
echo ""
|
|
echo "The npm publish succeeded, but pushing \`${tag}\` was rejected."
|
|
echo "This usually means the tagged commit modifies workflow files,"
|
|
echo "which GITHUB_TOKEN may not reference when creating refs from"
|
|
echo "dispatch or scheduled runs. Recover with maintainer credentials:"
|
|
echo ""
|
|
echo '```'
|
|
echo "git tag ${tag} ${sha}"
|
|
echo "git push origin refs/tags/${tag}"
|
|
echo "gh workflow run docker.yml --ref refs/tags/${tag}"
|
|
echo '```'
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
echo "::error::Tag push rejected; see the job summary for recovery commands." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Tag pushes made with GITHUB_TOKEN do not fire docker.yml's tag
|
|
# trigger (GitHub suppresses workflow runs caused by GITHUB_TOKEN
|
|
# pushes), so dispatch the image build at the new tag explicitly.
|
|
- name: Build Docker images for the beta tag
|
|
id: result
|
|
if: ${{ !inputs.dry_run }}
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^beta/v' | head -1)"
|
|
echo "beta_version=${tag#beta/v}" >> "$GITHUB_OUTPUT"
|
|
{
|
|
echo "## Beta published"
|
|
echo ""
|
|
echo "- Source SHA: \`${{ needs.select_beta.outputs.sha }}\`"
|
|
echo "- Source nightly: \`${{ needs.select_beta.outputs.nightly_version }}\`"
|
|
echo "- Published beta: \`${tag#beta/v}\`"
|
|
echo "- Docker build dispatched at \`${tag}\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
gh workflow run docker.yml --ref "refs/tags/${tag}" --repo "$GITHUB_REPOSITORY"
|
|
|
|
# Draft the eventual stable's release notes the moment the beta exists:
|
|
# the promoted bits are frozen now, and the 3-day soak is the natural
|
|
# review window. The draft lands on a machine-owned branch; a human opens
|
|
# and merges the PR, because a PR created with GITHUB_TOKEN would not
|
|
# trigger the pr.yml checks a merge requires.
|
|
draft_stable_notes:
|
|
needs: [select_beta, publish_beta]
|
|
if: ${{ !cancelled() && !inputs.dry_run && needs.publish_beta.result == 'success' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: write
|
|
# gh pr view needs PR read for the skeleton's nested summaries;
|
|
# without it the enrichment silently degrades to bare subjects.
|
|
pull-requests: read
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: master
|
|
fetch-depth: 0
|
|
|
|
- name: Configure git author
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
|
|
- name: Draft stable notes from the published beta
|
|
env:
|
|
# gh needs a token so the generator can nest each PR's summary
|
|
# under its subject line (best-effort thoroughness).
|
|
GH_TOKEN: ${{ github.token }}
|
|
BETA_VERSION: ${{ needs.publish_beta.outputs.beta_version }}
|
|
SOURCE_SHA: ${{ needs.select_beta.outputs.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
git fetch origin --tags --quiet
|
|
# A rejected beta tag push (the workflows-permission case) leaves
|
|
# the tag absent from origin while npm already has the beta;
|
|
# recreate it locally so drafting does not block on the manual
|
|
# tag recovery.
|
|
if ! git rev-parse --verify "refs/tags/beta/v${BETA_VERSION}" >/dev/null 2>&1; then
|
|
git tag "beta/v${BETA_VERSION}" "${SOURCE_SHA}"
|
|
fi
|
|
./scripts/draft-stable-notes.sh "${BETA_VERSION}"
|
|
|
|
- name: Push the draft branch
|
|
env:
|
|
BETA_VERSION: ${{ needs.publish_beta.outputs.beta_version }}
|
|
run: |
|
|
set -euo pipefail
|
|
branch="release-notes/v${BETA_VERSION}"
|
|
git checkout -B "$branch"
|
|
git add "releases/beta/v${BETA_VERSION}.md"
|
|
git commit -m "docs(release): draft stable notes for beta ${BETA_VERSION}"
|
|
# Machine-owned branch: force push so a re-run regenerates cleanly.
|
|
git push -f origin "$branch"
|
|
{
|
|
echo "## Stable notes draft pushed"
|
|
echo ""
|
|
echo "- Branch: \`${branch}\`"
|
|
echo "- Open the PR (a human opens it so CI runs):"
|
|
echo " https://github.com/${GITHUB_REPOSITORY}/compare/master...${branch}?expand=1"
|
|
echo "- Edit it during the soak. The stable promotion reads"
|
|
echo " \`releases/beta/v${BETA_VERSION}.md\` from master."
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
# Post-publish verification: run the release smoke suite against the exact
|
|
# beta version that was just published.
|
|
#
|
|
# The condition must carry an explicit status-check function: without one,
|
|
# GitHub attaches an implicit success(), which evaluates the needs chain
|
|
# transitively — and publish_beta's chain contains verify_beta_candidate,
|
|
# which is skipped on every promote-mode beta. The implicit form silently
|
|
# skipped this job on the first promote-mode beta after the candidate
|
|
# lane landed.
|
|
smoke_beta:
|
|
needs: publish_beta
|
|
if: ${{ !cancelled() && needs.publish_beta.result == 'success' && !inputs.dry_run }}
|
|
uses: ./.github/workflows/release-smoke.yml
|
|
with:
|
|
paperclip_version: ${{ needs.publish_beta.outputs.beta_version }}
|
|
artifact_name: beta-release-smoke
|
|
|
|
# ----- Stable lane ------------------------------------------------------
|
|
|
|
# Stable releases promote a soaked beta. The preflight enforces that the
|
|
# source commit shipped as a beta at least 3 days ago (measured from the
|
|
# npm publish time of that beta version), unless a written justification
|
|
# is provided. Dry runs report soak state without blocking.
|
|
# Resolves source_ref to an immutable commit exactly once; every downstream
|
|
# stable job consumes that SHA. Otherwise a branch or movable tag that
|
|
# advances mid-run could be soak-checked at one commit and verified or
|
|
# published at another.
|
|
preflight_stable:
|
|
if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
sha: ${{ steps.soak.outputs.sha }}
|
|
beta_version: ${{ steps.soak.outputs.beta_version }}
|
|
stable_version: ${{ steps.notes.outputs.stable_version }}
|
|
notes_mode: ${{ steps.notes.outputs.notes_mode }}
|
|
notes_path: ${{ steps.notes.outputs.notes_path }}
|
|
notes_ref: ${{ steps.notes.outputs.notes_ref }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: master
|
|
fetch-depth: 0
|
|
|
|
- name: Check beta soak
|
|
id: soak
|
|
env:
|
|
SOURCE_REF: ${{ inputs.source_ref }}
|
|
JUSTIFICATION: ${{ inputs.skip_soak_justification }}
|
|
DRY_RUN: ${{ inputs.dry_run }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
git fetch origin --tags --prune --quiet
|
|
|
|
sha="$(git rev-parse --verify "${SOURCE_REF}^{commit}" 2>/dev/null || true)"
|
|
if [ -z "$sha" ]; then
|
|
git fetch origin "$SOURCE_REF" --quiet || true
|
|
sha="$(git rev-parse --verify "FETCH_HEAD^{commit}" 2>/dev/null || true)"
|
|
fi
|
|
if [ -z "$sha" ]; then
|
|
echo "Error: could not resolve source_ref '$SOURCE_REF' to a commit." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "sha=$sha" >> "$GITHUB_OUTPUT"
|
|
{
|
|
echo "## Stable source pinned"
|
|
echo ""
|
|
echo "- source_ref: \`${SOURCE_REF}\` -> \`$sha\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
fail_or_justify() {
|
|
if [ -n "${JUSTIFICATION:-}" ]; then
|
|
{
|
|
echo "## Stable soak gate bypassed"
|
|
echo ""
|
|
echo "$1"
|
|
echo ""
|
|
echo "Justification: ${JUSTIFICATION}"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
echo "::warning::Soak gate bypassed: $1"
|
|
return 0
|
|
fi
|
|
if [ "${DRY_RUN}" = "true" ]; then
|
|
echo "::warning::Soak gate would block a real release: $1"
|
|
{
|
|
echo "## Stable soak gate (dry run)"
|
|
echo ""
|
|
echo "A real release would be blocked: $1"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
return 0
|
|
fi
|
|
echo "Error: $1" >&2
|
|
echo "Pass skip_soak_justification with a written reason to release anyway." >&2
|
|
exit 1
|
|
}
|
|
|
|
beta_tag="$(git tag --points-at "$sha" | grep '^beta/v' | sort -V | tail -1 || true)"
|
|
if [ -z "$beta_tag" ]; then
|
|
fail_or_justify "source commit $sha never shipped as a beta (no beta/v* tag)."
|
|
exit 0
|
|
fi
|
|
|
|
beta_version="${beta_tag#beta/v}"
|
|
echo "beta_version=${beta_version}" >> "$GITHUB_OUTPUT"
|
|
publish_time="$(npm view "paperclipai@${beta_version}" time --json 2>/dev/null \
|
|
| node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{const t=JSON.parse(d);process.stdout.write(typeof t === "string" ? t : (t[process.argv[1]] ?? ""))})' "$beta_version" || true)"
|
|
if [ -z "$publish_time" ]; then
|
|
fail_or_justify "could not determine the npm publish time of beta ${beta_version}."
|
|
exit 0
|
|
fi
|
|
|
|
age_seconds="$(node -e 'process.stdout.write(String(Math.floor((Date.now() - Date.parse(process.argv[1])) / 1000)))' "$publish_time")"
|
|
min_seconds=$((3 * 24 * 60 * 60))
|
|
age_days="$(node -e 'process.stdout.write((Number(process.argv[1]) / 86400).toFixed(1))' "$age_seconds")"
|
|
|
|
if [ "$age_seconds" -lt "$min_seconds" ]; then
|
|
fail_or_justify "beta ${beta_version} has only soaked ${age_days} days (minimum is 3)."
|
|
exit 0
|
|
fi
|
|
|
|
{
|
|
echo "## Stable soak gate passed"
|
|
echo ""
|
|
echo "- Source beta: \`${beta_version}\`"
|
|
echo "- Soak time: ${age_days} days"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
# The stable notes need not exist inside the promoted source commit:
|
|
# a promoted beta's notes are drafted on master (releases/beta/v*.md)
|
|
# at beta-publish time and edited during the soak. Resolve which copy
|
|
# publish_stable should read, and fail early — before the npm-stable
|
|
# approval gate — when none exists. Notes inside the source tree
|
|
# (the candidate fix path) take precedence.
|
|
- name: Resolve stable release notes
|
|
id: notes
|
|
env:
|
|
SHA: ${{ steps.soak.outputs.sha }}
|
|
BETA_VERSION: ${{ steps.soak.outputs.beta_version }}
|
|
STABLE_DATE: ${{ inputs.stable_date }}
|
|
DRY_RUN: ${{ inputs.dry_run }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# Pin the master revision the notes were resolved at, so the
|
|
# publish and canonicalization steps read the same content even
|
|
# when master advances during the approval delay.
|
|
echo "notes_ref=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
|
|
|
|
args=(stable --print-version)
|
|
if [ -n "${STABLE_DATE}" ]; then
|
|
args+=(--date "${STABLE_DATE}")
|
|
fi
|
|
version="$(./scripts/release.sh "${args[@]}")"
|
|
echo "stable_version=${version}" >> "$GITHUB_OUTPUT"
|
|
|
|
if git cat-file -e "${SHA}:releases/v${version}.md" 2>/dev/null; then
|
|
echo "notes_mode=source_tree" >> "$GITHUB_OUTPUT"
|
|
echo "notes_path=releases/v${version}.md" >> "$GITHUB_OUTPUT"
|
|
echo "- Stable notes: \`releases/v${version}.md\` at the source commit" >> "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
|
|
if [ -n "${BETA_VERSION}" ] && [ -f "releases/beta/v${BETA_VERSION}.md" ]; then
|
|
echo "notes_mode=master_beta" >> "$GITHUB_OUTPUT"
|
|
echo "notes_path=releases/beta/v${BETA_VERSION}.md" >> "$GITHUB_OUTPUT"
|
|
echo "- Stable notes: \`releases/beta/v${BETA_VERSION}.md\` on master" >> "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
|
|
msg="no release notes found for stable ${version}: neither releases/v${version}.md at the source commit nor releases/beta/v${BETA_VERSION:-<beta>}.md on master. Merge the notes PR from the beta's draft branch (release-notes/v<beta-version>), or add the file to the source ref."
|
|
if [ "${DRY_RUN}" = "true" ]; then
|
|
echo "::warning::${msg}"
|
|
echo "- Stable notes: MISSING (a real release would be blocked)" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "notes_mode=missing" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
echo "::error::${msg}"
|
|
exit 1
|
|
|
|
verify_stable:
|
|
if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable'
|
|
needs: preflight_stable
|
|
uses: ./.github/workflows/release-verify.yml
|
|
with:
|
|
ref: ${{ needs.preflight_stable.outputs.sha }}
|
|
|
|
preview_stable:
|
|
if: ${{ !cancelled() && github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && inputs.dry_run && needs.preflight_stable.result == 'success' && needs.verify_stable.result == 'success' && needs.release_runner_source.result == 'success' && (needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') }}
|
|
needs: [preflight_stable, verify_stable, release_runner_source, release_runner_binaries]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 0
|
|
ref: ${{ needs.preflight_stable.outputs.sha }}
|
|
|
|
- name: Download exact-source release daemon receipts
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-runner-inputs
|
|
merge-multiple: true
|
|
- name: Download target-owned Linux provider-pack identities
|
|
if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.provider_pack_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-provider-pack-inputs
|
|
merge-multiple: true
|
|
- name: Bind provider-pack inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
|
|
run: echo "PAPERCLIP_RELEASE_PROVIDER_PACK_ARTIFACTS_DIR=$RUNNER_TEMP/release-provider-pack-inputs" >> "$GITHUB_ENV"
|
|
- name: Bind daemon inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 9.15.4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: Validate release package manifest
|
|
run: node ./scripts/release-package-map.mjs check
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --no-frozen-lockfile
|
|
|
|
- name: Dry-run stable release
|
|
env:
|
|
GITHUB_ACTIONS: "true"
|
|
run: |
|
|
args=(stable --skip-verify --dry-run)
|
|
if [ -n "${{ inputs.stable_date }}" ]; then
|
|
args+=(--date "${{ inputs.stable_date }}")
|
|
fi
|
|
./scripts/release.sh "${args[@]}"
|
|
|
|
publish_stable:
|
|
if: ${{ !cancelled() && github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && !inputs.dry_run && needs.preflight_stable.result == 'success' && needs.verify_stable.result == 'success' && needs.release_runner_source.result == 'success' && (needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') }}
|
|
needs: [preflight_stable, verify_stable, release_runner_source, release_runner_binaries]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 150
|
|
environment: npm-stable
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
actions: write
|
|
outputs:
|
|
stable_version: ${{ steps.tag.outputs.version }}
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 0
|
|
ref: ${{ needs.preflight_stable.outputs.sha }}
|
|
|
|
- name: Download exact-source release daemon receipts
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-runner-inputs
|
|
merge-multiple: true
|
|
- name: Download target-owned Linux provider-pack identities
|
|
if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.provider_pack_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-provider-pack-inputs
|
|
merge-multiple: true
|
|
- name: Bind provider-pack inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true' && needs.release_runner_binaries.outputs.provider_pack_artifact_prefix != ''
|
|
run: echo "PAPERCLIP_RELEASE_PROVIDER_PACK_ARTIFACTS_DIR=$RUNNER_TEMP/release-provider-pack-inputs" >> "$GITHUB_ENV"
|
|
- name: Bind daemon inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 9.15.4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --no-frozen-lockfile
|
|
|
|
- name: Restore tracked install-time changes
|
|
run: git checkout -- pnpm-lock.yaml
|
|
|
|
- name: Configure git author
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
|
|
# A promoted beta's notes live on master (drafted at beta publish,
|
|
# edited during the soak), not inside the promoted source commit — a
|
|
# commit cannot carry a file named for a promotion date that was
|
|
# unknown when it was created. Materialize them outside the worktree
|
|
# so release.sh still runs against a clean source checkout.
|
|
- name: Materialize stable release notes from master
|
|
if: needs.preflight_stable.outputs.notes_mode == 'master_beta'
|
|
env:
|
|
NOTES_REF: ${{ needs.preflight_stable.outputs.notes_ref }}
|
|
NOTES_PATH: ${{ needs.preflight_stable.outputs.notes_path }}
|
|
run: |
|
|
set -euo pipefail
|
|
git fetch origin master --quiet
|
|
git show "${NOTES_REF}:${NOTES_PATH}" > "$RUNNER_TEMP/stable-notes.md"
|
|
echo "STABLE_NOTES_FILE=$RUNNER_TEMP/stable-notes.md" >> "$GITHUB_ENV"
|
|
|
|
- name: Publish stable
|
|
env:
|
|
GITHUB_ACTIONS: "true"
|
|
run: |
|
|
args=(stable --skip-verify)
|
|
if [ -n "${{ inputs.stable_date }}" ]; then
|
|
args+=(--date "${{ inputs.stable_date }}")
|
|
fi
|
|
if [ -n "${STABLE_NOTES_FILE:-}" ]; then
|
|
args+=(--notes-file "$STABLE_NOTES_FILE")
|
|
fi
|
|
./scripts/release.sh "${args[@]}"
|
|
|
|
- name: Dump npm debug logs
|
|
if: failure()
|
|
run: |
|
|
shopt -s nullglob
|
|
for f in "$HOME"/.npm/_logs/*.log; do
|
|
echo "===== $f ====="
|
|
tail -n 300 "$f" | sed -E \
|
|
-e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig'
|
|
done
|
|
|
|
- name: Push stable tag
|
|
id: tag
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^v' | head -1)"
|
|
if [ -z "$tag" ]; then
|
|
echo "Error: no stable tag points at HEAD after release." >&2
|
|
exit 1
|
|
fi
|
|
echo "version=${tag#v}" >> "$GITHUB_OUTPUT"
|
|
if ! git push origin "refs/tags/${tag}"; then
|
|
sha="$(git rev-parse HEAD)"
|
|
{
|
|
echo "## Tag push rejected"
|
|
echo ""
|
|
echo "The npm publish succeeded, but pushing \`${tag}\` was rejected."
|
|
echo "This usually means the tagged commit modifies workflow files,"
|
|
echo "which GITHUB_TOKEN may not reference when creating refs from"
|
|
echo "dispatch or scheduled runs. Recover with maintainer credentials:"
|
|
echo ""
|
|
echo '```'
|
|
echo "git tag ${tag} ${sha}"
|
|
echo "git push origin refs/tags/${tag}"
|
|
echo "gh workflow run docker.yml --ref refs/tags/${tag}"
|
|
echo "./scripts/create-github-release.sh ${tag#v}"
|
|
echo '```'
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
echo "::error::Tag push rejected; see the job summary for recovery commands." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Tag pushes made with GITHUB_TOKEN do not fire docker.yml's tag
|
|
# trigger (GitHub suppresses workflow runs caused by GITHUB_TOKEN
|
|
# pushes), so dispatch the image build at the new tag explicitly. This
|
|
# is what moves Docker `:latest` and publishes the versioned stable
|
|
# image tags.
|
|
- name: Build Docker images for the stable tag
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^v' | head -1)"
|
|
if gh workflow run docker.yml --ref "refs/tags/${tag}" --repo "$GITHUB_REPOSITORY"; then
|
|
echo "Dispatched docker.yml at ${tag}."
|
|
else
|
|
# Older source commits may predate docker.yml's workflow_dispatch
|
|
# trigger; the dispatch then fails while the npm release is
|
|
# already complete and correct.
|
|
echo "::warning::Could not dispatch docker.yml at ${tag}. Run docker.yml manually at that tag to publish the stable images."
|
|
fi
|
|
|
|
- name: Create GitHub Release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PUBLISH_REMOTE: origin
|
|
run: |
|
|
version="$(git tag --points-at HEAD | grep '^v' | head -1 | sed 's/^v//')"
|
|
if [ -z "$version" ]; then
|
|
echo "Error: no v* tag points at HEAD after stable release." >&2
|
|
exit 1
|
|
fi
|
|
args=("$version")
|
|
if [ -n "${STABLE_NOTES_FILE:-}" ]; then
|
|
args+=(--notes-file "$STABLE_NOTES_FILE")
|
|
fi
|
|
./scripts/create-github-release.sh "${args[@]}"
|
|
|
|
# After a stable ships from master-side beta notes, move the file to its
|
|
# canonical home (releases/vYYYY.MDD.P.md) so the stable-notes invariant
|
|
# holds durably. Machine-owned branch + human-opened PR, as with the
|
|
# draft job above.
|
|
canonicalize_stable_notes:
|
|
needs: [preflight_stable, publish_stable]
|
|
if: ${{ needs.preflight_stable.outputs.notes_mode == 'master_beta' && needs.publish_stable.result == 'success' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: master
|
|
fetch-depth: 0
|
|
|
|
- name: Configure git author
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
|
|
- name: Push the canonicalization branch
|
|
env:
|
|
STABLE_VERSION: ${{ needs.publish_stable.outputs.stable_version }}
|
|
NOTES_PATH: ${{ needs.preflight_stable.outputs.notes_path }}
|
|
NOTES_REF: ${{ needs.preflight_stable.outputs.notes_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
branch="release-notes/v${STABLE_VERSION}-canonicalize"
|
|
git checkout -B "$branch"
|
|
# Canonicalize exactly what shipped: take the notes at the pinned
|
|
# revision the release read them from, so a master edit made
|
|
# during the run surfaces as a reviewable diff in this PR instead
|
|
# of silently diverging from the published GitHub Release.
|
|
git show "${NOTES_REF}:${NOTES_PATH}" > "releases/v${STABLE_VERSION}.md"
|
|
git add "releases/v${STABLE_VERSION}.md"
|
|
if git ls-files --error-unmatch "${NOTES_PATH}" >/dev/null 2>&1; then
|
|
git rm -q "${NOTES_PATH}"
|
|
fi
|
|
git commit -m "docs(release): canonicalize stable notes for v${STABLE_VERSION}"
|
|
git push -f origin "$branch"
|
|
{
|
|
echo "## Stable notes canonicalization pushed"
|
|
echo ""
|
|
echo "- Branch: \`${branch}\`"
|
|
echo "- Open and merge the PR (a human opens it so CI runs):"
|
|
echo " https://github.com/${GITHUB_REPOSITORY}/compare/master...${branch}?expand=1"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|