mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-15 20:53:23 +02:00
DottaandPaperclip
d67e3507b2
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Native execution needs a compatible installed daemon and provider dependency. > - The Codex-default work found missing platform packages and clean-install startup failures. > - Release builds also repeat dependency compilation and run preparation serially. > - This prerequisite packages four daemon targets and verifies installed native startup. > - It also caches hosted Cargo dependencies and overlaps JavaScript preparation with compilation. > - Agent creation defaults and experimental gates stay at the current master behavior. ## Linked Issues or Issue Description Refs #15683. Refs #15555. Refs #15422. Refs #15926. Refs #15932. Extract runtime and installation support from #15683. This prerequisite has 65 changed files. Creation, onboarding, imports, UI runner selection and graduation remain in the dependent PR. Feature/access maps and the Storybook source catalog stay synchronized. Existing agents keep their execution choices. ## What Changed - Correct the existing runner test fixtures. Reserve owned credential quorum listeners through the existing bounded fixture helper. Keep foreign listeners intact, run actual credential staging once, and preserve its rejection and unchanged-auth assertions. Reuse the durable-resume outer-limit correction. Wait for actual warm-completion and held-authorization callback entry under the existing recovery deadline and surface early request errors. Preserve every semantic assertion. - Retain bounded installation failure diagnostics through the existing qualification receipt upload. Keep the original error, 10-minute deadline and all success checks. - Keep startup ownership until credential preparation and registration drain. Reject duplicate and post-close startup/resume work. Observe shutdown during normal and adopted authentication readiness. Preserve the primary failure and retain private state when cleanup is unconfirmed. - Package Linux x64/ARM64 and macOS Apple Silicon/Intel daemons. Verify target headers, source identities, manifests, and hashes before assembly and installation. - Reuse the existing release producer/consumer workflows. Cache Cargo dependencies by target, OS, compiler, lockfile, and contract inputs. Rebuild workspace binaries. Permit trusted cache writes only for canonical exact-source master pushes. - Overlap JavaScript preparation with native compilation. Join both commands and failure/cancellation cleanup before artifact verification. - Preserve shell positional arguments in the shared SSH runner and apply environment assignments correctly. Reject environment option keys. Six before/after controls and two real SSH subprocess paths pass with zero provider calls; this fix lands before both Codex and Claude defaults. - Admit verified suspended SSH backups during cold controller continuation, using the same full-scope, integrity and lifecycle checks as sandbox targets. Two positive SSH cases fail before; all 14 positive/negative matrix cases pass afterward. Active ownership and corrupt/malformed/nonempty state remain rejected. - Record measured sandbox platform facts through the existing explicit environment probe. Bind facts to the company, effective provider configuration, immutable OCI image and actual captured image binding. Check the returned cleanup receipt. Reject client-authored proof and stale or named boot identities. Creation and discovery allocate nothing. Preserve connection-only behavior. - Resolve the actual remote Codex target and preserve same-host development overrides. Preserve runtime artifact verification. Use actual protocol/model compatibility rather than a numerical CLI version fence. - Resolve the installed Codex login dependency on 64-bit Linux and Mac independently of the daemon libc baseline. Preserve account homes and safe errors. - Fix actual clean-install TOML table comparison. Preserve strict semantic checks, comments, private writes, and malformed-input rejection. Preserve primary startup failures and bounded cleanup. - Document GNU libc 2.39+ and stock Ubuntu sandbox prerequisites. Qualify ARM startup with a scoped distribution profile and unchanged global restrictions. Preserve Windows and Alpine deferral. - Preserve selected and saved native Codex reasoning effort in the existing UI builder, while excluding it from other providers. This small shared correction prevents import edits higher in the stack from dropping effort. - Reuse existing installed-package checks and assertions. Paperclip tarballs contain no Codex native payloads. Official npm dependencies supply the consumer's Codex binaries. All Docker and native builds stay remote. ## Verification Candidate: `271d434c170e74bdedde65d0b13059a55419c943`. It includes current master `e168512f7bdbb6af6ea01954c6d7ed80b91e903e` and preserves prior candidates through ordinary commits. Current [full CI](https://github.com/paperclipai/paperclip/actions/runs/38346601686) is successful on attempt 2. GitHub reports 54 successful checks and four conditional skips, including required verify and browser aggregates, workspace typecheck/tests/build, Linux DB controls, both runner shards and [isolated native compilation](https://github.com/paperclipai/paperclip/actions/runs/38346601609). Fresh current-head Greptile is 5/5 with all four threads resolved. The passing build's clean Grok/Codex report records CI merge source `7a82a37438e6e448abc7cc5caa60dc2519a97be0`, 18 installed packages, omitted Codex payloads, official host-only npm dependencies and zero provider calls. Pi setup and its no-prompt lease verification also pass. The first attempt's single 60-second Node archive download timeout remains retained; its DNS/TLS/download cause remains unknown. One unchanged-source retry was requested through the normal Build-job dialog with debug logging disabled. GitHub's attempt 2 graph reports the other CI jobs as well; no second retry or source/deadline relaxation was made. The [final exact-source package campaign](https://github.com/paperclipai/paperclip/actions/runs/38347027535) is successful on literal `271d434c170e74bdedde65d0b13059a55419c943`. It passes all four native producers, public Linux package assembly and clean installed consumers on Apple Silicon, Intel Mac and Linux ARM64. The nine qualification-mode skips are intentional; full CI above covers their ordinary gates. Native builds and Docker assembly ran remotely. The predecessor [`dae808` package campaign](https://github.com/paperclipai/paperclip/actions/runs/38342104102) remains literal historical evidence. Only tests and the dated record differ from that source; runtime, package and workflow code is unchanged. The reused credential fixture correction passes all 42 canonical Node 24 controls with synthetic data and independent matching-source review, and the current hosted runner shard passes. Production credential behavior is unchanged. **Merge hold:** current-source CI, fresh 5/5 review and exact-source package qualification pass. Actual code-owner approval and normal protected merge remain pending. No slice has merged or deployed. GitHub CLI authentication needs refresh; the normal signed-in embedded GitHub UI provided this status without credential workarounds. - The master merge preserves both Storybook source-review appendices and the guarded test-home cleanup. All six existing cleanup controls pass without skips. Master's isolated-home helper/test/setup are byte-identical. The two existing whitespace lines in master's unrelated privacy test remain outside this PR's diff. - Canonical Node 24 passes all 24 existing public-install helper tests. Three narrow added cases prove bounded/redacted failure metadata, symlink exclusions, original exception identity, failed diagnostic writes and no false failure on success. The Mac installer now uses `--timing`; at most two 16 KiB tails and 32 structured entries per tail enter the existing receipt upload. Raw argv, URLs, environment, error text and stacks are omitted. A failed receipt explicitly remains FAILED/unqualified/runtime-not-attempted. The 600,000 ms install deadline and every real package/hash/payload/lock/lifecycle/runtime oracle are unchanged. - Canonical Node 24 reproduces the durable-resume outer timeout under controlled fake latency. Only its outer test limit changes to 15 seconds; internal 500 ms/5 second deadlines and usage/effect assertions remain. Controlled warm-recovery and before-bootstrap authorization scheduling delays reproduce their callback polling failures, while the explicit entry signals pass. Early recovery errors surface unchanged. Independent review is clear. Historical mock binaries support the fixture controls; fresh full hosted CI remains decisive. The original hosted callback failure cause is inconclusive. - The composed runner/surfaces/server/E2E TypeScript checks pass. Map checks pass 35 areas/171 capability IDs. Token gates pass. The existing Storybook catalog passes 223 files/2,210 stories; story IDs and classifications remain intact. The current master had 25 inherited stale fingerprints from three changed map recipes. Only those guarded fingerprints and a source-only review note change; all 92 non-map story/component/fixture inputs remain unchanged. Existing classifications are retained. This proves source structure, not visual or live acceptance. - The 65-file contribution audit has no code file crossing from below 1,000 lines to above the limit. Earlier comment cleanup preserves executable emissions, parsed workflows and action pins. Independent cleanup/catalog and three-file reporting reviews are clear. No new workflow, suite, grader or local native/Docker build was added. **Prior `dae808` gate evidence:** fresh Greptile is 5/5 with four resolved threads, isolated native compilation and the browser aggregate pass. Its first runner shard passes the previous two corrections but fails a different held-authorization cell at the implicit one-second polling deadline. It records 1,672 passes/one failure/three skips. This candidate applies the verified entry-signal correction without changing production deadlines or any semantic assertions. Its original hosted cause remains inconclusive until fresh CI. **Previous-source evidence, kept literal:** the [exact `16a532` package campaign](https://github.com/paperclipai/paperclip/actions/runs/38338806076) passes all four native producers, public Linux package assembly, Apple Silicon, Intel Mac and Linux ARM64 installed consumers. Its fresh review is 5/5 with all four threads resolved. Full CI records 52 successful checks, four conditional skips and the two fixture failures corrected here. This is not a green full-CI candidate or proof for the new source. `64c074fb8da1b31f8d6042c4fef48dc4164e759b` passed [full CI](https://github.com/paperclipai/paperclip/actions/runs/38332726938), 54 checks/four conditional skips, [isolated native compilation](https://github.com/paperclipai/paperclip/actions/runs/38332726787/job/115085895328), and fresh Greptile 5/5/all four resolved threads. The hosted transport suite passed 246 tests and startup trust passed 22, closing that source's local fake-binary limitation. These are historical after reconciliation. The [previous exact-source package campaign](https://github.com/paperclipai/paperclip/actions/runs/38332921463) built all four platform daemons and passed public Linux package assembly plus Apple Silicon and Linux ARM64 installed consumers. **Intel Mac failed:** its initial scripts-disabled npm install timed out before lifecycle/runtime assertions. The underlying download/resolution/host cause is unknown because the old helper deleted the npm logs. This is the concrete baseline for the diagnostic change. The failed campaign remains failed; no all-platform signoff or automatic retry is claimed. The earlier `a200495` [four-target campaign](https://github.com/paperclipai/paperclip/actions/runs/38283695248) and [scoped ARM qualification](https://github.com/paperclipai/paperclip/actions/runs/38291535914) remain component evidence. Cargo restores were cold misses; no warm-cache speedup is claimed. Paperclip tarballs contain no Codex payloads. Official npm dependencies supply Codex on the user's platform. Current-source full workspace typecheck/tests/build, Linux DB controls, static/Rust/native tests, all browser shards and exact-source package consumers must pass. New-agent defaults and final managed onboarding belong to #15683. Actual private Cloud composition, warm/cold signup, task/follow-up and rollback compatibility remain later release gates. Source audits found that ordinary managed onboarding does not run the saved platform probe and Cloud distributes named snapshots without a verified final boot-image binding. These dependent release blockers remain open; prequalified E2E fixtures do not close them. Master adds task-workspace migrations; the final image/migrator and previous-image checks must include them. ARM paid task/follow-up and ordinary OS APT installation are not proven. ## Risks - Multi-target packages require source and header agreement. Missing or mismatched artifacts fail explicitly. Existing execution choices remain unchanged. - Linux requires GNU libc 2.39+ and compatible sandbox prerequisites. The scoped hosted ARM preparation does not qualify arbitrary containers or kernels. Windows, 32-bit ARM, and Alpine remain deferred. - Only dependency crates are cached. Preview jobs cannot write trusted caches. Concurrent command cleanup must preserve the primary failure. - Native-free Paperclip packaging retains official Codex npm dependencies. No Codex payload bundling, schema migration, automatic agent migration, or production deployment is included. ## Model Used OpenAI Codex, GPT-6 family, with reasoning, repository tools, code execution, and parallel agents. The exact serving model snapshot and context-window size are not exposed. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
1628 lines
68 KiB
YAML
1628 lines
68 KiB
YAML
name: Release
|
|
run-name: ${{ inputs.channel == 'preview' && format('Stack deploy {0} build', inputs.request_id) || inputs.channel == 'cloud-migrator' && format('Cloud migrator {0}', inputs.source_ref) || 'Release' }}
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
schedule:
|
|
# Nightly cut at 09:00 UTC, after the workday's merges have settled.
|
|
- cron: "0 9 * * *"
|
|
workflow_dispatch:
|
|
inputs:
|
|
channel:
|
|
description: Release channel to publish
|
|
required: true
|
|
type: choice
|
|
options:
|
|
- stable
|
|
- beta
|
|
- nightly
|
|
- preview
|
|
- cloud-migrator
|
|
default: stable
|
|
source_ref:
|
|
description: Stable source ref, or full immutable SHA for a preview or cloud migrator build
|
|
required: true
|
|
type: string
|
|
default: master
|
|
request_id:
|
|
description: (preview/cloud-migrator) Correlation UUID
|
|
type: string
|
|
default: ""
|
|
preview_migrator:
|
|
description: (preview) Publish isolated shared and database packages if missing
|
|
type: boolean
|
|
default: false
|
|
stable_date:
|
|
description: Enter a UTC date in YYYY-MM-DD format, for example 2026-03-18. Do not enter a version string. The workflow will resolve that date to a stable version such as 2026.318.0, then 2026.318.1 for the next same-day stable.
|
|
required: false
|
|
type: string
|
|
source_version:
|
|
description: For nightly, the explicit canary version to promote (empty selects the newest canary on master). For beta, the explicit nightly version to promote (empty selects the newest nightly on master).
|
|
required: false
|
|
type: string
|
|
candidate_branch:
|
|
description: (beta) candidate/beta-* branch to build a cherry-picked beta from. Leave empty to promote a nightly. Mutually exclusive with source_version.
|
|
required: false
|
|
type: string
|
|
skip_soak_justification:
|
|
description: (stable) Written justification for publishing a stable whose source has not soaked as a beta for 3 days. Leave empty for normal releases.
|
|
required: false
|
|
type: string
|
|
dry_run:
|
|
description: Preview the release without publishing
|
|
required: true
|
|
type: boolean
|
|
default: false
|
|
|
|
concurrency:
|
|
group: ${{ (inputs.channel == 'preview' || inputs.channel == 'cloud-migrator') && format('{0}-{1}', inputs.channel, inputs.source_ref) || format('release-{0}-{1}', github.event_name, github.ref) }}
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
# npm accepts a publish immediately, but the registry's CDN can lag packument
|
|
# propagation by several minutes (observed 2.5-4+ minutes on 2026-08-21,
|
|
# which failed four consecutive canary runs mid-loop). Give release.sh's
|
|
# post-publish visibility poll a 10-minute budget per package instead of its
|
|
# 60-second default; a healthy publish still exits the poll on the first
|
|
# visible check. (A 5-minute budget missed by seconds on 2026-08-21:
|
|
# adapter-opencode-local was accepted at 07:02:27 and became visible at
|
|
# 07:07:40.) The publish jobs' timeout-minutes are sized for several
|
|
# laggard packages; if most of a batch lags the full budget, npm is having
|
|
# a real incident and the job failing is correct.
|
|
#
|
|
# Raised to 30 minutes on 2026-09-14, when 10 was not enough twice in a
|
|
# row: @paperclipai/server was accepted at 17:49:09 and became visible at
|
|
# 18:04:29 — five minutes after the poll gave up. Each timeout aborts the
|
|
# release mid-batch, leaving that version half-published, and because the
|
|
# next version number is derived from what is already on npm the retry
|
|
# moves to a new number and meets the same lag. Waiting is cheap; a
|
|
# half-published release is not.
|
|
#
|
|
# Packages are published and verified one at a time, so the publish jobs'
|
|
# timeout-minutes went to 150 alongside this: a 30-minute build plus four
|
|
# packages each lagging the full budget still finishes inside the job,
|
|
# instead of the job timing out mid-batch and leaving the same
|
|
# half-published state this budget exists to avoid.
|
|
NPM_PUBLISH_VERIFY_ATTEMPTS: "180"
|
|
NPM_PUBLISH_VERIFY_DELAY_SECONDS: "10"
|
|
|
|
jobs:
|
|
plan_preview:
|
|
# Only the current master commit can use AWS. A preview or older source
|
|
# falls back to GitHub-hosted runners, including raced merge dispatches.
|
|
name: Check preview artifacts
|
|
if: github.ref == 'refs/heads/master' && github.event_name == 'workflow_dispatch' && (inputs.channel == 'preview' || inputs.channel == 'cloud-migrator') && !inputs.dry_run
|
|
runs-on: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.event_name == 'workflow_dispatch' && inputs.channel == 'cloud-migrator' && github.sha != '' && inputs.source_ref == github.sha && 'runs-on/fleet=paperclip-post-merge-x64/env=public-ci' || 'ubuntu-latest' }}
|
|
permissions:
|
|
contents: read
|
|
# Preserve the previous hosted default; only AWS needs the Fleet limit.
|
|
timeout-minutes: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.event_name == 'workflow_dispatch' && inputs.channel == 'cloud-migrator' && github.sha != '' && inputs.source_ref == github.sha && 10 || 360 }}
|
|
outputs:
|
|
image: ${{ steps.plan.outputs.image }}
|
|
packages: ${{ steps.plan.outputs.packages }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- name: Validate immutable source and inspect existing artifacts
|
|
id: plan
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.source_ref }}
|
|
REQUEST_ID: ${{ inputs.request_id }}
|
|
PREVIEW_MIGRATOR: ${{ inputs.preview_migrator }}
|
|
PLAN_COMMAND: ${{ inputs.channel == 'cloud-migrator' && 'plan-migrator' || 'plan' }}
|
|
run: node scripts/preview-artifacts.mjs "$PLAN_COMMAND" "$SOURCE_SHA" "$REQUEST_ID" "$PREVIEW_MIGRATOR"
|
|
|
|
package_preview:
|
|
name: Build preview migrator
|
|
needs: plan_preview
|
|
if: needs.plan_preview.outputs.packages == 'true'
|
|
runs-on: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.event_name == 'workflow_dispatch' && inputs.channel == 'cloud-migrator' && github.sha != '' && inputs.source_ref == github.sha && 'runs-on/fleet=paperclip-post-merge-x64/env=public-ci' || 'ubuntu-latest' }}
|
|
timeout-minutes: 30
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
path: trusted
|
|
persist-credentials: false
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
ref: ${{ inputs.source_ref }}
|
|
path: source
|
|
persist-credentials: false
|
|
- uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
|
|
with:
|
|
version: 9.15.4
|
|
run_install: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- name: Install build dependencies without lifecycle scripts
|
|
working-directory: source
|
|
run: pnpm install --ignore-scripts --no-frozen-lockfile
|
|
- name: Build and pack exact-source preview packages
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.source_ref }}
|
|
run: node trusted/scripts/preview-artifacts.mjs pack source packages "$SOURCE_SHA"
|
|
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: preview-packages
|
|
overwrite: true
|
|
path: packages/*.tgz
|
|
if-no-files-found: error
|
|
retention-days: 7
|
|
|
|
publish_preview:
|
|
# npm trusted publishing supports GitHub-hosted runners only.
|
|
name: Publish preview migrator
|
|
needs: [plan_preview, package_preview]
|
|
if: github.ref == 'refs/heads/master' && needs.plan_preview.outputs.packages == 'true' && needs.package_preview.result == 'success'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
# A manual preview and a merge-triggered migrator may compile in parallel.
|
|
# Serialize only publication so they cannot race an immutable npm version,
|
|
# without making the migrator wait for a preview's separate image build.
|
|
concurrency:
|
|
group: preview-package-publish-${{ inputs.source_ref }}
|
|
cancel-in-progress: false
|
|
# Reuse release.yml's established npm trusted-publisher identity. This job
|
|
# publishes only isolated preview versions; it cannot advance lane tags.
|
|
environment: npm-canary
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- name: Install npm with trusted publishing support
|
|
run: npm install --global npm@11.18.0 --ignore-scripts
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: preview-packages
|
|
path: preview-packages
|
|
- name: Publish immutable preview packages without running package code
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.source_ref }}
|
|
run: node scripts/preview-artifacts.mjs publish preview-packages "$SOURCE_SHA"
|
|
|
|
image_preview:
|
|
name: Build preview cloud image
|
|
needs: plan_preview
|
|
if: needs.plan_preview.outputs.image == 'true'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
ref: ${{ inputs.source_ref }}
|
|
persist-credentials: false
|
|
- uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
|
|
with:
|
|
version: 9.15.4
|
|
run_install: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- name: Prepare locked image context
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.source_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
|
|
pnpm install --resolution-only --ignore-scripts --ignore-pnpmfile --no-frozen-lockfile
|
|
echo "TOOLS_EPOCH=$(date -u +%G-W%V)" >> "$GITHUB_ENV"
|
|
- uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
|
|
with:
|
|
buildkitd-config-inline: |
|
|
[registry."docker.io"]
|
|
mirrors = ["mirror.gcr.io"]
|
|
- name: Build the immutable cloud image without registry credentials
|
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
|
|
with:
|
|
context: .
|
|
target: cloud
|
|
platforms: linux/amd64
|
|
push: false
|
|
provenance: false # Docker archives cannot carry registry attestations.
|
|
outputs: type=docker,dest=${{ runner.temp }}/preview-image.tar
|
|
tags: ghcr.io/paperclipai/paperclip:sha-${{ inputs.source_ref }}-cloud
|
|
build-args: |
|
|
CLOUD_BUNDLED_PLUGINS=daytona
|
|
CLOUD_BUNDLED_SERVER_DEPS=@sentry/node
|
|
PAPERCLIP_BUILD_COMMIT=${{ inputs.source_ref }}
|
|
PAPERCLIP_BUILD_VERSION=0.0.0-preview.g${{ inputs.source_ref }}
|
|
CLI_TOOLS_CACHE_EPOCH=${{ env.TOOLS_EPOCH }}
|
|
labels: |
|
|
org.opencontainers.image.revision=${{ inputs.source_ref }}
|
|
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: preview-image
|
|
overwrite: true
|
|
path: ${{ runner.temp }}/preview-image.tar
|
|
compression-level: 0
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
publish_image_preview:
|
|
name: Publish preview cloud image
|
|
needs: [plan_preview, image_preview]
|
|
if: github.ref == 'refs/heads/master' && needs.plan_preview.outputs.image == 'true' && needs.image_preview.result == 'success'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
# This existing environment has an external master-only branch policy.
|
|
environment: npm-canary
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: preview-image
|
|
path: preview-image
|
|
- uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.repository_owner }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: Verify image identity and publish without executing image code
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.source_ref }}
|
|
run: node scripts/preview-artifacts.mjs publish-image preview-image/preview-image.tar "$SOURCE_SHA"
|
|
|
|
result_preview:
|
|
name: Verify preview artifacts
|
|
needs: [plan_preview, image_preview, publish_image_preview, package_preview, publish_preview]
|
|
if: >-
|
|
always() && inputs.channel == 'preview' && needs.plan_preview.result == 'success' &&
|
|
(needs.publish_image_preview.result == 'success' || needs.plan_preview.outputs.image == 'false') &&
|
|
(needs.publish_preview.result == 'success' || needs.plan_preview.outputs.packages == 'false')
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- name: Confirm exact artifacts are visible
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.source_ref }}
|
|
REQUEST_ID: ${{ inputs.request_id }}
|
|
PREVIEW_MIGRATOR: ${{ inputs.preview_migrator }}
|
|
run: node scripts/preview-artifacts.mjs result "$SOURCE_SHA" "$REQUEST_ID"
|
|
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: stack-deploy-result
|
|
overwrite: true
|
|
path: stack-deploy-result/result.json
|
|
if-no-files-found: error
|
|
retention-days: 30
|
|
|
|
verify_canary:
|
|
name: Reuse exact-source verification
|
|
if: github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 50
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
- name: Require successful source checks for this exact master push
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
SOURCE_SHA: ${{ github.sha }}
|
|
run: node scripts/cloud-source-verification.mjs "$SOURCE_SHA"
|
|
|
|
release_runner_source:
|
|
needs: [verify_canary, select_nightly, select_beta, preflight_stable]
|
|
if: >-
|
|
!cancelled() && (
|
|
(github.event_name == 'push' && needs.verify_canary.result == 'success') ||
|
|
(needs.select_nightly.result == 'success' && needs.select_nightly.outputs.proceed == 'true') ||
|
|
needs.select_beta.result == 'success' || needs.preflight_stable.result == 'success')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
sha: ${{ steps.source.outputs.sha }}
|
|
required: ${{ steps.source.outputs.required }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
with:
|
|
ref: ${{ needs.preflight_stable.outputs.sha || needs.select_beta.outputs.sha || needs.select_nightly.outputs.sha || github.sha }}
|
|
persist-credentials: false
|
|
- name: Read the exact source packaging contract
|
|
id: source
|
|
env:
|
|
SOURCE_SHA: ${{ needs.preflight_stable.outputs.sha || needs.select_beta.outputs.sha || needs.select_nightly.outputs.sha || github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
[[ "$SOURCE_SHA" =~ ^[a-f0-9]{40}$ ]] || exit 1
|
|
[[ "$(git rev-parse HEAD)" == "$SOURCE_SHA" ]] || exit 1
|
|
echo "sha=$SOURCE_SHA" >> "$GITHUB_OUTPUT"
|
|
source_script="$(git show "$SOURCE_SHA:scripts/release.sh")" || exit 1
|
|
if printf '%s\n' "$source_script" | grep -F 'assemble-daemons "$PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR"' > /dev/null; then
|
|
echo "required=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "required=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
release_runner_binaries:
|
|
needs: release_runner_source
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
uses: ./.github/workflows/release-verify.yml
|
|
with:
|
|
ref: ${{ needs.release_runner_source.outputs.sha }}
|
|
runner_binaries_only: true
|
|
|
|
publish_canary:
|
|
if: ${{ !cancelled() && github.event_name == 'push' && needs.verify_canary.result == 'success' && needs.release_runner_source.result == 'success' && (needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') }}
|
|
needs: [verify_canary, release_runner_source, release_runner_binaries]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 150
|
|
environment: npm-canary
|
|
outputs:
|
|
canary_version: ${{ steps.canary_tag.outputs.version }}
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
# For the explicit docker.yml dispatch below.
|
|
actions: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
fetch-depth: 0
|
|
|
|
- name: Attach verified canary source to local master
|
|
env:
|
|
SOURCE_SHA: ${{ github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ "$GITHUB_REPOSITORY" != "paperclipai/paperclip" ] ||
|
|
[ "$GITHUB_EVENT_NAME" != "push" ] ||
|
|
[ "$GITHUB_REF" != "refs/heads/master" ]; then
|
|
echo "Error: canary branch attachment requires a trusted master push." >&2
|
|
exit 1
|
|
fi
|
|
if ! [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]] ||
|
|
[ "$(git rev-parse HEAD)" != "$SOURCE_SHA" ]; then
|
|
echo "Error: canary checkout does not match the pinned source SHA." >&2
|
|
exit 1
|
|
fi
|
|
git checkout -B master "$SOURCE_SHA"
|
|
test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
|
|
|
|
- name: Download exact-source release daemon receipts
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-runner-inputs
|
|
merge-multiple: true
|
|
- name: Bind daemon inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 9.15.4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: Validate release package manifest
|
|
run: node ./scripts/release-package-map.mjs check
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --no-frozen-lockfile
|
|
|
|
# Master can precede the separate lockfile-refresh PR. Preserve the
|
|
# resolution used for this build before release tooling restores the
|
|
# tracked lockfile or rewrites workspace versions.
|
|
- name: Save canary smoke lockfile
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: canary-smoke-lockfile-${{ github.sha }}
|
|
path: pnpm-lock.yaml
|
|
if-no-files-found: error
|
|
overwrite: true
|
|
retention-days: 14
|
|
|
|
- name: Restore tracked install-time changes
|
|
run: git checkout -- pnpm-lock.yaml
|
|
|
|
- name: Configure git author
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
|
|
- name: Publish canary
|
|
env:
|
|
GITHUB_ACTIONS: "true"
|
|
run: ./scripts/release.sh canary --skip-verify
|
|
|
|
- name: Dump npm debug logs
|
|
if: failure()
|
|
run: |
|
|
shopt -s nullglob
|
|
for f in "$HOME"/.npm/_logs/*.log; do
|
|
echo "===== $f ====="
|
|
tail -n 300 "$f" | sed -E \
|
|
-e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig'
|
|
done
|
|
|
|
- name: Push canary tag
|
|
id: canary_tag
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^canary/v' | head -1)"
|
|
if [ -z "$tag" ]; then
|
|
echo "Error: no canary tag points at HEAD after release." >&2
|
|
exit 1
|
|
fi
|
|
git push origin "refs/tags/${tag}"
|
|
echo "version=${tag#canary/v}" >> "$GITHUB_OUTPUT"
|
|
|
|
# Canary images previously relied on the master-push docker.yml run,
|
|
# whose single pending concurrency slot gets superseded by every
|
|
# newer push — on a busy day no canary image publishes at all (five
|
|
# consecutive canaries shipped npm packages with no cloud image on
|
|
# 2026-09-06, starving downstream managed deploys for ~18 hours).
|
|
# Tag pushes made with GITHUB_TOKEN do not fire docker.yml's
|
|
# triggers, so dispatch the image build at the canary tag
|
|
# explicitly, exactly like the nightly and beta lanes: the run keys
|
|
# its concurrency off the tag ref, so no master push can supersede
|
|
# it, and docker.yml's `type=sha` mapping publishes the
|
|
# standard sha-<short> images either way.
|
|
- name: Build Docker images for the canary tag
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
{
|
|
echo "## Canary published"
|
|
echo ""
|
|
echo "- Published canary: \`${{ steps.canary_tag.outputs.version }}\`"
|
|
echo "- Docker build dispatched at \`canary/v${{ steps.canary_tag.outputs.version }}\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
gh workflow run docker.yml --ref "refs/tags/canary/v${{ steps.canary_tag.outputs.version }}" --repo "$GITHUB_REPOSITORY"
|
|
|
|
# The package is already public when this gate runs. A red result leaves the
|
|
# immutable canary in npm, but makes the release workflow visibly fail before
|
|
# anyone mistakes an installable package for an onboardable one.
|
|
smoke_canary_onboarding:
|
|
needs: publish_canary
|
|
if: needs.publish_canary.result == 'success'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
PAPERCLIPAI_VERSION: ${{ needs.publish_canary.outputs.canary_version }}
|
|
PAPERCLIP_PLAYWRIGHT_CHANNEL: chrome
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
persist-credentials: false
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
|
|
with:
|
|
version: 9.15.4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: 24
|
|
|
|
# Default download scope is this workflow run, including job reruns.
|
|
# A missing artifact fails instead of resolving a different dependency set.
|
|
- name: Restore canary smoke lockfile
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
|
|
with:
|
|
name: canary-smoke-lockfile-${{ github.sha }}
|
|
|
|
- name: Install test dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Show browser version
|
|
run: google-chrome --version
|
|
|
|
- name: Smoke exact published canary through onboarding
|
|
env:
|
|
PAPERCLIP_CANARY_SMOKE_SERVER_LOG: ${{ runner.temp }}/canary-onboarding-server.log
|
|
run: pnpm run test:canary-onboarding-smoke
|
|
|
|
- name: Upload failed canary onboarding diagnostics
|
|
if: failure()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: canary-onboarding-smoke-${{ needs.publish_canary.outputs.canary_version }}
|
|
if-no-files-found: warn
|
|
retention-days: 14
|
|
path: |
|
|
${{ runner.temp }}/canary-onboarding-server.log
|
|
tests/canary-onboarding/playwright-report/
|
|
tests/canary-onboarding/test-results/
|
|
|
|
# ----- Nightly lane -----------------------------------------------------
|
|
# Once a night (or on a forced nightly dispatch), promote the newest master
|
|
# commit that already shipped a green canary: smoke-test that exact
|
|
# published canary first, then republish the same commit under the nightly
|
|
# identity. The candidate commit already passed release-verify during its
|
|
# canary publish, so the nightly publish skips re-verification.
|
|
|
|
select_nightly:
|
|
if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.channel == 'nightly')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
proceed: ${{ steps.select.outputs.proceed }}
|
|
sha: ${{ steps.select.outputs.sha }}
|
|
canary_version: ${{ steps.select.outputs.canary_version }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: master
|
|
fetch-depth: 0
|
|
|
|
- name: Select nightly candidate
|
|
id: select
|
|
env:
|
|
EXPLICIT_CANARY_VERSION: ${{ github.event_name == 'workflow_dispatch' && inputs.source_version || '' }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
git fetch origin --tags --prune --quiet
|
|
|
|
skip() {
|
|
echo "proceed=false" >> "$GITHUB_OUTPUT"
|
|
{
|
|
echo "## Nightly skipped"
|
|
echo ""
|
|
echo "$1"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
echo "Nightly skipped: $1"
|
|
}
|
|
|
|
if [ -n "${EXPLICIT_CANARY_VERSION:-}" ]; then
|
|
tag="canary/v${EXPLICIT_CANARY_VERSION}"
|
|
sha="$(git rev-list -n 1 "$tag" 2>/dev/null || true)"
|
|
if [ -z "$sha" ]; then
|
|
echo "Error: tag $tag does not exist." >&2
|
|
exit 1
|
|
fi
|
|
else
|
|
# Newest canary-tagged commit on master. Canary tags are pushed
|
|
# only after a successful canary publish, so tag presence is the
|
|
# green-publish signal. Walk master newest-first and stop at the
|
|
# first commit that carries a canary tag.
|
|
sha="$(grep -m1 -F \
|
|
-f <(git for-each-ref 'refs/tags/canary/v*' --format='%(objectname)') \
|
|
<(git rev-list origin/master -n 500) || true)"
|
|
|
|
if [ -z "$sha" ]; then
|
|
skip "No canary/v* tag found on the last 500 commits of master."
|
|
exit 0
|
|
fi
|
|
|
|
tag="$(git tag --points-at "$sha" | grep '^canary/v' | sort -V | tail -1)"
|
|
fi
|
|
|
|
canary_version="${tag#canary/v}"
|
|
|
|
existing_nightly="$(git tag --points-at "$sha" | grep '^nightly/v' | head -1 || true)"
|
|
if [ -n "$existing_nightly" ]; then
|
|
skip "Candidate \`$sha\` (canary \`$canary_version\`) already shipped as \`$existing_nightly\`."
|
|
exit 0
|
|
fi
|
|
|
|
# Promotions run the release tooling of the source commit, so the
|
|
# source must already understand the nightly channel. (Literal match
|
|
# of release.sh's channel case arm; if that line is reformatted this
|
|
# fails closed and should be updated alongside it.)
|
|
if ! git show "${sha}:scripts/release.sh" | grep -qF 'canary|nightly'; then
|
|
echo "Error: source commit $sha predates nightly release tooling; promote a newer canary." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "proceed=true" >> "$GITHUB_OUTPUT"
|
|
echo "sha=$sha" >> "$GITHUB_OUTPUT"
|
|
echo "canary_version=$canary_version" >> "$GITHUB_OUTPUT"
|
|
{
|
|
echo "## Nightly candidate"
|
|
echo ""
|
|
echo "- Source SHA: \`$sha\`"
|
|
echo "- Source canary: \`$canary_version\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
# Gate the promotion on the release smoke suite, run against the exact
|
|
# published canary artifact that would become tonight's nightly. Red smoke
|
|
# means no nightly tonight. Skipped for dry-run dispatches.
|
|
smoke_nightly:
|
|
needs: select_nightly
|
|
if: needs.select_nightly.outputs.proceed == 'true' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run)
|
|
uses: ./.github/workflows/release-smoke.yml
|
|
with:
|
|
paperclip_version: ${{ needs.select_nightly.outputs.canary_version }}
|
|
artifact_name: nightly-release-smoke
|
|
|
|
publish_nightly:
|
|
needs: [select_nightly, smoke_nightly, release_runner_source, release_runner_binaries]
|
|
# Publish when smoke passed, or when smoke was deliberately skipped by a
|
|
# dry-run dispatch (the publish itself is a dry-run in that case).
|
|
if: >-
|
|
!cancelled() &&
|
|
needs.select_nightly.outputs.proceed == 'true' &&
|
|
needs.release_runner_source.result == 'success' &&
|
|
(needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') &&
|
|
(needs.smoke_nightly.result == 'success' ||
|
|
(needs.smoke_nightly.result == 'skipped' && github.event_name == 'workflow_dispatch' && inputs.dry_run))
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 150
|
|
environment: npm-canary
|
|
# The workflow-level concurrency group is per event, so a forced dispatch
|
|
# nightly could otherwise overlap the scheduled one and race it to the
|
|
# same next -nightly.N version. Serialize actual nightly publishes across
|
|
# events here; release.sh additionally refuses to double-publish a commit
|
|
# that already carries a nightly tag.
|
|
concurrency:
|
|
group: release-publish-nightly
|
|
cancel-in-progress: false
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
actions: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ needs.select_nightly.outputs.sha }}
|
|
fetch-depth: 0
|
|
|
|
- name: Download exact-source release daemon receipts
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-runner-inputs
|
|
merge-multiple: true
|
|
- name: Bind daemon inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 9.15.4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: Validate release package manifest
|
|
run: node ./scripts/release-package-map.mjs check
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --no-frozen-lockfile
|
|
|
|
- name: Restore tracked install-time changes
|
|
run: git checkout -- pnpm-lock.yaml
|
|
|
|
- name: Configure git author
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
|
|
- name: Publish nightly
|
|
env:
|
|
GITHUB_ACTIONS: "true"
|
|
run: |
|
|
args=(nightly --skip-verify)
|
|
if [ "${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}" = "true" ]; then
|
|
args+=(--dry-run)
|
|
fi
|
|
./scripts/release.sh "${args[@]}"
|
|
|
|
- name: Dump npm debug logs
|
|
if: failure()
|
|
run: |
|
|
shopt -s nullglob
|
|
for f in "$HOME"/.npm/_logs/*.log; do
|
|
echo "===== $f ====="
|
|
tail -n 300 "$f" | sed -E \
|
|
-e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig'
|
|
done
|
|
|
|
- name: Push nightly tag
|
|
if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry_run) }}
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^nightly/v' | head -1)"
|
|
if [ -z "$tag" ]; then
|
|
echo "Error: no nightly tag points at HEAD after release." >&2
|
|
exit 1
|
|
fi
|
|
if ! git push origin "refs/tags/${tag}"; then
|
|
sha="$(git rev-parse HEAD)"
|
|
{
|
|
echo "## Tag push rejected"
|
|
echo ""
|
|
echo "The npm publish succeeded, but pushing \`${tag}\` was rejected."
|
|
echo "This usually means the tagged commit modifies workflow files,"
|
|
echo "which GITHUB_TOKEN may not reference when creating refs from"
|
|
echo "dispatch or scheduled runs. Recover with maintainer credentials:"
|
|
echo ""
|
|
echo '```'
|
|
echo "git tag ${tag} ${sha}"
|
|
echo "git push origin refs/tags/${tag}"
|
|
echo "gh workflow run docker.yml --ref refs/tags/${tag}"
|
|
echo '```'
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
echo "::error::Tag push rejected; see the job summary for recovery commands." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Tag pushes made with GITHUB_TOKEN do not fire docker.yml's tag
|
|
# trigger (GitHub suppresses workflow runs caused by GITHUB_TOKEN
|
|
# pushes), so dispatch the image build at the new tag explicitly.
|
|
- name: Build Docker images for the nightly tag
|
|
if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry_run) }}
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^nightly/v' | head -1)"
|
|
{
|
|
echo "## Nightly published"
|
|
echo ""
|
|
echo "- Source SHA: \`${{ needs.select_nightly.outputs.sha }}\`"
|
|
echo "- Source canary: \`${{ needs.select_nightly.outputs.canary_version }}\`"
|
|
echo "- Published nightly: \`${tag#nightly/v}\`"
|
|
echo "- Docker build dispatched at \`${tag}\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
gh workflow run docker.yml --ref "refs/tags/${tag}" --repo "$GITHUB_REPOSITORY"
|
|
|
|
# ----- Beta lane --------------------------------------------------------
|
|
# Beta is a manual, human-approved promotion of a nightly. Unlike the
|
|
# scheduled nightly lane, a beta dispatch is explicit operator intent, so
|
|
# selection problems fail the run loudly instead of skipping quietly. The
|
|
# publish runs behind the npm-beta environment, whose required reviewers
|
|
# are the approval gate.
|
|
|
|
select_beta:
|
|
if: github.event_name == 'workflow_dispatch' && inputs.channel == 'beta'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
sha: ${{ steps.select.outputs.sha }}
|
|
nightly_version: ${{ steps.select.outputs.nightly_version }}
|
|
mode: ${{ steps.select.outputs.mode }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: master
|
|
fetch-depth: 0
|
|
|
|
- name: Select beta candidate
|
|
id: select
|
|
env:
|
|
EXPLICIT_NIGHTLY_VERSION: ${{ inputs.source_version }}
|
|
CANDIDATE_BRANCH: ${{ inputs.candidate_branch }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
git fetch origin --tags --prune --quiet
|
|
|
|
# Candidate mode: build a cherry-picked beta from a short-lived
|
|
# candidate branch instead of promoting a nightly.
|
|
if [ -n "${CANDIDATE_BRANCH:-}" ]; then
|
|
if [ -n "${EXPLICIT_NIGHTLY_VERSION:-}" ]; then
|
|
echo "Error: candidate_branch and source_version are mutually exclusive." >&2
|
|
exit 1
|
|
fi
|
|
case "$CANDIDATE_BRANCH" in
|
|
candidate/beta-*) ;;
|
|
*)
|
|
echo "Error: candidate branches must be named candidate/beta-<target> (got: $CANDIDATE_BRANCH)." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
git fetch origin "$CANDIDATE_BRANCH" --quiet
|
|
sha="$(git rev-parse --verify "origin/${CANDIDATE_BRANCH}^{commit}" 2>/dev/null || true)"
|
|
if [ -z "$sha" ]; then
|
|
echo "Error: candidate branch $CANDIDATE_BRANCH does not exist on origin." >&2
|
|
exit 1
|
|
fi
|
|
|
|
existing_beta="$(git tag --points-at "$sha" | grep '^beta/v' | head -1 || true)"
|
|
if [ -n "$existing_beta" ]; then
|
|
echo "Error: candidate head $sha already shipped as $existing_beta." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! git show "${sha}:scripts/release.sh" | grep -qF -- '--from-candidate'; then
|
|
echo "Error: candidate head $sha predates candidate-build release tooling; rebase the candidate onto a newer base." >&2
|
|
exit 1
|
|
fi
|
|
|
|
merge_base="$(git merge-base origin/master "$sha")"
|
|
echo "mode=candidate" >> "$GITHUB_OUTPUT"
|
|
echo "sha=$sha" >> "$GITHUB_OUTPUT"
|
|
echo "nightly_version=" >> "$GITHUB_OUTPUT"
|
|
{
|
|
echo "## Beta candidate branch"
|
|
echo ""
|
|
echo "- Branch: \`$CANDIDATE_BRANCH\`"
|
|
echo "- Head: \`$sha\`"
|
|
echo "- Base (merge-base with master): \`$merge_base\`"
|
|
echo "- Cherry-picked commits:"
|
|
echo ""
|
|
echo '\`\`\`'
|
|
git log --oneline "${merge_base}..${sha}"
|
|
echo '\`\`\`'
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
|
|
echo "mode=promote" >> "$GITHUB_OUTPUT"
|
|
|
|
if [ -n "${EXPLICIT_NIGHTLY_VERSION:-}" ]; then
|
|
tag="nightly/v${EXPLICIT_NIGHTLY_VERSION}"
|
|
sha="$(git rev-list -n 1 "$tag" 2>/dev/null || true)"
|
|
if [ -z "$sha" ]; then
|
|
echo "Error: tag $tag does not exist." >&2
|
|
exit 1
|
|
fi
|
|
else
|
|
# Newest nightly-tagged commit on master.
|
|
sha="$(grep -m1 -F \
|
|
-f <(git for-each-ref 'refs/tags/nightly/v*' --format='%(objectname)') \
|
|
<(git rev-list origin/master -n 2000) || true)"
|
|
|
|
if [ -z "$sha" ]; then
|
|
echo "Error: no nightly/v* tag found on the last 2000 commits of master. Publish a nightly first, or pass source_version." >&2
|
|
exit 1
|
|
fi
|
|
|
|
tag="$(git tag --points-at "$sha" | grep '^nightly/v' | sort -V | tail -1)"
|
|
fi
|
|
|
|
nightly_version="${tag#nightly/v}"
|
|
|
|
existing_beta="$(git tag --points-at "$sha" | grep '^beta/v' | head -1 || true)"
|
|
if [ -n "$existing_beta" ]; then
|
|
echo "Error: candidate $sha (nightly $nightly_version) already shipped as $existing_beta." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Promotions run the release tooling of the source commit, so the
|
|
# source must already understand the beta channel. (Literal match of
|
|
# release.sh's channel case arm; if that line is reformatted this
|
|
# fails closed and should be updated alongside it.)
|
|
if ! git show "${sha}:scripts/release.sh" | grep -qF 'canary|nightly|beta|stable)'; then
|
|
echo "Error: source commit $sha predates beta release tooling; promote a newer nightly whose source contains the beta channel." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "sha=$sha" >> "$GITHUB_OUTPUT"
|
|
echo "nightly_version=$nightly_version" >> "$GITHUB_OUTPUT"
|
|
{
|
|
echo "## Beta candidate"
|
|
echo ""
|
|
echo "- Source SHA: \`$sha\`"
|
|
echo "- Source nightly: \`$nightly_version\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
# Candidate-branch heads are new commits that never went through a canary
|
|
# or nightly, so they must pass full verification before publishing.
|
|
# Promoted nightlies were already verified by their canary run and skip it.
|
|
verify_beta_candidate:
|
|
needs: select_beta
|
|
if: needs.select_beta.outputs.mode == 'candidate'
|
|
uses: ./.github/workflows/release-verify.yml
|
|
with:
|
|
ref: ${{ needs.select_beta.outputs.sha }}
|
|
|
|
publish_beta:
|
|
needs: [select_beta, verify_beta_candidate, release_runner_source, release_runner_binaries]
|
|
if: >-
|
|
!cancelled() &&
|
|
needs.select_beta.result == 'success' &&
|
|
needs.release_runner_source.result == 'success' &&
|
|
(needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') &&
|
|
(needs.verify_beta_candidate.result == 'success' ||
|
|
(needs.verify_beta_candidate.result == 'skipped' && needs.select_beta.outputs.mode == 'promote'))
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 150
|
|
environment: npm-beta
|
|
# Serialize beta publishes so two dispatches cannot race to the same next
|
|
# -beta.N version; release.sh additionally refuses to double-publish a
|
|
# commit that already carries a beta tag.
|
|
concurrency:
|
|
group: release-publish-beta
|
|
cancel-in-progress: false
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
actions: write
|
|
outputs:
|
|
beta_version: ${{ steps.result.outputs.beta_version }}
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ needs.select_beta.outputs.sha }}
|
|
fetch-depth: 0
|
|
|
|
- name: Download exact-source release daemon receipts
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-runner-inputs
|
|
merge-multiple: true
|
|
- name: Bind daemon inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 9.15.4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: Validate release package manifest
|
|
run: node ./scripts/release-package-map.mjs check
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --no-frozen-lockfile
|
|
|
|
- name: Restore tracked install-time changes
|
|
run: git checkout -- pnpm-lock.yaml
|
|
|
|
- name: Configure git author
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
|
|
- name: Publish beta
|
|
env:
|
|
GITHUB_ACTIONS: "true"
|
|
run: |
|
|
args=(beta --skip-verify)
|
|
if [ "${{ needs.select_beta.outputs.mode }}" = "candidate" ]; then
|
|
args+=(--from-candidate)
|
|
fi
|
|
if [ "${{ inputs.dry_run }}" = "true" ]; then
|
|
args+=(--dry-run)
|
|
fi
|
|
./scripts/release.sh "${args[@]}"
|
|
|
|
- name: Dump npm debug logs
|
|
if: failure()
|
|
run: |
|
|
shopt -s nullglob
|
|
for f in "$HOME"/.npm/_logs/*.log; do
|
|
echo "===== $f ====="
|
|
tail -n 300 "$f" | sed -E \
|
|
-e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig'
|
|
done
|
|
|
|
- name: Push beta tag
|
|
if: ${{ !inputs.dry_run }}
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^beta/v' | head -1)"
|
|
if [ -z "$tag" ]; then
|
|
echo "Error: no beta tag points at HEAD after release." >&2
|
|
exit 1
|
|
fi
|
|
if ! git push origin "refs/tags/${tag}"; then
|
|
sha="$(git rev-parse HEAD)"
|
|
{
|
|
echo "## Tag push rejected"
|
|
echo ""
|
|
echo "The npm publish succeeded, but pushing \`${tag}\` was rejected."
|
|
echo "This usually means the tagged commit modifies workflow files,"
|
|
echo "which GITHUB_TOKEN may not reference when creating refs from"
|
|
echo "dispatch or scheduled runs. Recover with maintainer credentials:"
|
|
echo ""
|
|
echo '```'
|
|
echo "git tag ${tag} ${sha}"
|
|
echo "git push origin refs/tags/${tag}"
|
|
echo "gh workflow run docker.yml --ref refs/tags/${tag}"
|
|
echo '```'
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
echo "::error::Tag push rejected; see the job summary for recovery commands." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Tag pushes made with GITHUB_TOKEN do not fire docker.yml's tag
|
|
# trigger (GitHub suppresses workflow runs caused by GITHUB_TOKEN
|
|
# pushes), so dispatch the image build at the new tag explicitly.
|
|
- name: Build Docker images for the beta tag
|
|
id: result
|
|
if: ${{ !inputs.dry_run }}
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^beta/v' | head -1)"
|
|
echo "beta_version=${tag#beta/v}" >> "$GITHUB_OUTPUT"
|
|
{
|
|
echo "## Beta published"
|
|
echo ""
|
|
echo "- Source SHA: \`${{ needs.select_beta.outputs.sha }}\`"
|
|
echo "- Source nightly: \`${{ needs.select_beta.outputs.nightly_version }}\`"
|
|
echo "- Published beta: \`${tag#beta/v}\`"
|
|
echo "- Docker build dispatched at \`${tag}\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
gh workflow run docker.yml --ref "refs/tags/${tag}" --repo "$GITHUB_REPOSITORY"
|
|
|
|
# Draft the eventual stable's release notes the moment the beta exists:
|
|
# the promoted bits are frozen now, and the 3-day soak is the natural
|
|
# review window. The draft lands on a machine-owned branch; a human opens
|
|
# and merges the PR, because a PR created with GITHUB_TOKEN would not
|
|
# trigger the pr.yml checks a merge requires.
|
|
draft_stable_notes:
|
|
needs: [select_beta, publish_beta]
|
|
if: ${{ !cancelled() && !inputs.dry_run && needs.publish_beta.result == 'success' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: write
|
|
# gh pr view needs PR read for the skeleton's nested summaries;
|
|
# without it the enrichment silently degrades to bare subjects.
|
|
pull-requests: read
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: master
|
|
fetch-depth: 0
|
|
|
|
- name: Configure git author
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
|
|
- name: Draft stable notes from the published beta
|
|
env:
|
|
# gh needs a token so the generator can nest each PR's summary
|
|
# under its subject line (best-effort thoroughness).
|
|
GH_TOKEN: ${{ github.token }}
|
|
BETA_VERSION: ${{ needs.publish_beta.outputs.beta_version }}
|
|
SOURCE_SHA: ${{ needs.select_beta.outputs.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
git fetch origin --tags --quiet
|
|
# A rejected beta tag push (the workflows-permission case) leaves
|
|
# the tag absent from origin while npm already has the beta;
|
|
# recreate it locally so drafting does not block on the manual
|
|
# tag recovery.
|
|
if ! git rev-parse --verify "refs/tags/beta/v${BETA_VERSION}" >/dev/null 2>&1; then
|
|
git tag "beta/v${BETA_VERSION}" "${SOURCE_SHA}"
|
|
fi
|
|
./scripts/draft-stable-notes.sh "${BETA_VERSION}"
|
|
|
|
- name: Push the draft branch
|
|
env:
|
|
BETA_VERSION: ${{ needs.publish_beta.outputs.beta_version }}
|
|
run: |
|
|
set -euo pipefail
|
|
branch="release-notes/v${BETA_VERSION}"
|
|
git checkout -B "$branch"
|
|
git add "releases/beta/v${BETA_VERSION}.md"
|
|
git commit -m "docs(release): draft stable notes for beta ${BETA_VERSION}"
|
|
# Machine-owned branch: force push so a re-run regenerates cleanly.
|
|
git push -f origin "$branch"
|
|
{
|
|
echo "## Stable notes draft pushed"
|
|
echo ""
|
|
echo "- Branch: \`${branch}\`"
|
|
echo "- Open the PR (a human opens it so CI runs):"
|
|
echo " https://github.com/${GITHUB_REPOSITORY}/compare/master...${branch}?expand=1"
|
|
echo "- Edit it during the soak. The stable promotion reads"
|
|
echo " \`releases/beta/v${BETA_VERSION}.md\` from master."
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
# Post-publish verification: run the release smoke suite against the exact
|
|
# beta version that was just published.
|
|
#
|
|
# The condition must carry an explicit status-check function: without one,
|
|
# GitHub attaches an implicit success(), which evaluates the needs chain
|
|
# transitively — and publish_beta's chain contains verify_beta_candidate,
|
|
# which is skipped on every promote-mode beta. The implicit form silently
|
|
# skipped this job on the first promote-mode beta after the candidate
|
|
# lane landed.
|
|
smoke_beta:
|
|
needs: publish_beta
|
|
if: ${{ !cancelled() && needs.publish_beta.result == 'success' && !inputs.dry_run }}
|
|
uses: ./.github/workflows/release-smoke.yml
|
|
with:
|
|
paperclip_version: ${{ needs.publish_beta.outputs.beta_version }}
|
|
artifact_name: beta-release-smoke
|
|
|
|
# ----- Stable lane ------------------------------------------------------
|
|
|
|
# Stable releases promote a soaked beta. The preflight enforces that the
|
|
# source commit shipped as a beta at least 3 days ago (measured from the
|
|
# npm publish time of that beta version), unless a written justification
|
|
# is provided. Dry runs report soak state without blocking.
|
|
# Resolves source_ref to an immutable commit exactly once; every downstream
|
|
# stable job consumes that SHA. Otherwise a branch or movable tag that
|
|
# advances mid-run could be soak-checked at one commit and verified or
|
|
# published at another.
|
|
preflight_stable:
|
|
if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
sha: ${{ steps.soak.outputs.sha }}
|
|
beta_version: ${{ steps.soak.outputs.beta_version }}
|
|
stable_version: ${{ steps.notes.outputs.stable_version }}
|
|
notes_mode: ${{ steps.notes.outputs.notes_mode }}
|
|
notes_path: ${{ steps.notes.outputs.notes_path }}
|
|
notes_ref: ${{ steps.notes.outputs.notes_ref }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: master
|
|
fetch-depth: 0
|
|
|
|
- name: Check beta soak
|
|
id: soak
|
|
env:
|
|
SOURCE_REF: ${{ inputs.source_ref }}
|
|
JUSTIFICATION: ${{ inputs.skip_soak_justification }}
|
|
DRY_RUN: ${{ inputs.dry_run }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
git fetch origin --tags --prune --quiet
|
|
|
|
sha="$(git rev-parse --verify "${SOURCE_REF}^{commit}" 2>/dev/null || true)"
|
|
if [ -z "$sha" ]; then
|
|
git fetch origin "$SOURCE_REF" --quiet || true
|
|
sha="$(git rev-parse --verify "FETCH_HEAD^{commit}" 2>/dev/null || true)"
|
|
fi
|
|
if [ -z "$sha" ]; then
|
|
echo "Error: could not resolve source_ref '$SOURCE_REF' to a commit." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "sha=$sha" >> "$GITHUB_OUTPUT"
|
|
{
|
|
echo "## Stable source pinned"
|
|
echo ""
|
|
echo "- source_ref: \`${SOURCE_REF}\` -> \`$sha\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
fail_or_justify() {
|
|
if [ -n "${JUSTIFICATION:-}" ]; then
|
|
{
|
|
echo "## Stable soak gate bypassed"
|
|
echo ""
|
|
echo "$1"
|
|
echo ""
|
|
echo "Justification: ${JUSTIFICATION}"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
echo "::warning::Soak gate bypassed: $1"
|
|
return 0
|
|
fi
|
|
if [ "${DRY_RUN}" = "true" ]; then
|
|
echo "::warning::Soak gate would block a real release: $1"
|
|
{
|
|
echo "## Stable soak gate (dry run)"
|
|
echo ""
|
|
echo "A real release would be blocked: $1"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
return 0
|
|
fi
|
|
echo "Error: $1" >&2
|
|
echo "Pass skip_soak_justification with a written reason to release anyway." >&2
|
|
exit 1
|
|
}
|
|
|
|
beta_tag="$(git tag --points-at "$sha" | grep '^beta/v' | sort -V | tail -1 || true)"
|
|
if [ -z "$beta_tag" ]; then
|
|
fail_or_justify "source commit $sha never shipped as a beta (no beta/v* tag)."
|
|
exit 0
|
|
fi
|
|
|
|
beta_version="${beta_tag#beta/v}"
|
|
echo "beta_version=${beta_version}" >> "$GITHUB_OUTPUT"
|
|
publish_time="$(npm view "paperclipai@${beta_version}" time --json 2>/dev/null \
|
|
| node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{const t=JSON.parse(d);process.stdout.write(typeof t === "string" ? t : (t[process.argv[1]] ?? ""))})' "$beta_version" || true)"
|
|
if [ -z "$publish_time" ]; then
|
|
fail_or_justify "could not determine the npm publish time of beta ${beta_version}."
|
|
exit 0
|
|
fi
|
|
|
|
age_seconds="$(node -e 'process.stdout.write(String(Math.floor((Date.now() - Date.parse(process.argv[1])) / 1000)))' "$publish_time")"
|
|
min_seconds=$((3 * 24 * 60 * 60))
|
|
age_days="$(node -e 'process.stdout.write((Number(process.argv[1]) / 86400).toFixed(1))' "$age_seconds")"
|
|
|
|
if [ "$age_seconds" -lt "$min_seconds" ]; then
|
|
fail_or_justify "beta ${beta_version} has only soaked ${age_days} days (minimum is 3)."
|
|
exit 0
|
|
fi
|
|
|
|
{
|
|
echo "## Stable soak gate passed"
|
|
echo ""
|
|
echo "- Source beta: \`${beta_version}\`"
|
|
echo "- Soak time: ${age_days} days"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
# The stable notes need not exist inside the promoted source commit:
|
|
# a promoted beta's notes are drafted on master (releases/beta/v*.md)
|
|
# at beta-publish time and edited during the soak. Resolve which copy
|
|
# publish_stable should read, and fail early — before the npm-stable
|
|
# approval gate — when none exists. Notes inside the source tree
|
|
# (the candidate fix path) take precedence.
|
|
- name: Resolve stable release notes
|
|
id: notes
|
|
env:
|
|
SHA: ${{ steps.soak.outputs.sha }}
|
|
BETA_VERSION: ${{ steps.soak.outputs.beta_version }}
|
|
STABLE_DATE: ${{ inputs.stable_date }}
|
|
DRY_RUN: ${{ inputs.dry_run }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# Pin the master revision the notes were resolved at, so the
|
|
# publish and canonicalization steps read the same content even
|
|
# when master advances during the approval delay.
|
|
echo "notes_ref=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
|
|
|
|
args=(stable --print-version)
|
|
if [ -n "${STABLE_DATE}" ]; then
|
|
args+=(--date "${STABLE_DATE}")
|
|
fi
|
|
version="$(./scripts/release.sh "${args[@]}")"
|
|
echo "stable_version=${version}" >> "$GITHUB_OUTPUT"
|
|
|
|
if git cat-file -e "${SHA}:releases/v${version}.md" 2>/dev/null; then
|
|
echo "notes_mode=source_tree" >> "$GITHUB_OUTPUT"
|
|
echo "notes_path=releases/v${version}.md" >> "$GITHUB_OUTPUT"
|
|
echo "- Stable notes: \`releases/v${version}.md\` at the source commit" >> "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
|
|
if [ -n "${BETA_VERSION}" ] && [ -f "releases/beta/v${BETA_VERSION}.md" ]; then
|
|
echo "notes_mode=master_beta" >> "$GITHUB_OUTPUT"
|
|
echo "notes_path=releases/beta/v${BETA_VERSION}.md" >> "$GITHUB_OUTPUT"
|
|
echo "- Stable notes: \`releases/beta/v${BETA_VERSION}.md\` on master" >> "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
|
|
msg="no release notes found for stable ${version}: neither releases/v${version}.md at the source commit nor releases/beta/v${BETA_VERSION:-<beta>}.md on master. Merge the notes PR from the beta's draft branch (release-notes/v<beta-version>), or add the file to the source ref."
|
|
if [ "${DRY_RUN}" = "true" ]; then
|
|
echo "::warning::${msg}"
|
|
echo "- Stable notes: MISSING (a real release would be blocked)" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "notes_mode=missing" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
echo "::error::${msg}"
|
|
exit 1
|
|
|
|
verify_stable:
|
|
if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable'
|
|
needs: preflight_stable
|
|
uses: ./.github/workflows/release-verify.yml
|
|
with:
|
|
ref: ${{ needs.preflight_stable.outputs.sha }}
|
|
|
|
preview_stable:
|
|
if: ${{ !cancelled() && github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && inputs.dry_run && needs.preflight_stable.result == 'success' && needs.verify_stable.result == 'success' && needs.release_runner_source.result == 'success' && (needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') }}
|
|
needs: [preflight_stable, verify_stable, release_runner_source, release_runner_binaries]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 0
|
|
ref: ${{ needs.preflight_stable.outputs.sha }}
|
|
|
|
- name: Download exact-source release daemon receipts
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-runner-inputs
|
|
merge-multiple: true
|
|
- name: Bind daemon inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 9.15.4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: Validate release package manifest
|
|
run: node ./scripts/release-package-map.mjs check
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --no-frozen-lockfile
|
|
|
|
- name: Dry-run stable release
|
|
env:
|
|
GITHUB_ACTIONS: "true"
|
|
run: |
|
|
args=(stable --skip-verify --dry-run)
|
|
if [ -n "${{ inputs.stable_date }}" ]; then
|
|
args+=(--date "${{ inputs.stable_date }}")
|
|
fi
|
|
./scripts/release.sh "${args[@]}"
|
|
|
|
publish_stable:
|
|
if: ${{ !cancelled() && github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && !inputs.dry_run && needs.preflight_stable.result == 'success' && needs.verify_stable.result == 'success' && needs.release_runner_source.result == 'success' && (needs.release_runner_source.outputs.required == 'false' || needs.release_runner_binaries.result == 'success') }}
|
|
needs: [preflight_stable, verify_stable, release_runner_source, release_runner_binaries]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 150
|
|
environment: npm-stable
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
actions: write
|
|
outputs:
|
|
stable_version: ${{ steps.tag.outputs.version }}
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 0
|
|
ref: ${{ needs.preflight_stable.outputs.sha }}
|
|
|
|
- name: Download exact-source release daemon receipts
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: ${{ needs.release_runner_binaries.outputs.runner_artifact_prefix }}-*
|
|
path: ${{ runner.temp }}/release-runner-inputs
|
|
merge-multiple: true
|
|
- name: Bind daemon inputs for release assembly
|
|
if: needs.release_runner_source.outputs.required == 'true'
|
|
run: echo "PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR=$RUNNER_TEMP/release-runner-inputs" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 9.15.4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --no-frozen-lockfile
|
|
|
|
- name: Restore tracked install-time changes
|
|
run: git checkout -- pnpm-lock.yaml
|
|
|
|
- name: Configure git author
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
|
|
# A promoted beta's notes live on master (drafted at beta publish,
|
|
# edited during the soak), not inside the promoted source commit — a
|
|
# commit cannot carry a file named for a promotion date that was
|
|
# unknown when it was created. Materialize them outside the worktree
|
|
# so release.sh still runs against a clean source checkout.
|
|
- name: Materialize stable release notes from master
|
|
if: needs.preflight_stable.outputs.notes_mode == 'master_beta'
|
|
env:
|
|
NOTES_REF: ${{ needs.preflight_stable.outputs.notes_ref }}
|
|
NOTES_PATH: ${{ needs.preflight_stable.outputs.notes_path }}
|
|
run: |
|
|
set -euo pipefail
|
|
git fetch origin master --quiet
|
|
git show "${NOTES_REF}:${NOTES_PATH}" > "$RUNNER_TEMP/stable-notes.md"
|
|
echo "STABLE_NOTES_FILE=$RUNNER_TEMP/stable-notes.md" >> "$GITHUB_ENV"
|
|
|
|
- name: Publish stable
|
|
env:
|
|
GITHUB_ACTIONS: "true"
|
|
run: |
|
|
args=(stable --skip-verify)
|
|
if [ -n "${{ inputs.stable_date }}" ]; then
|
|
args+=(--date "${{ inputs.stable_date }}")
|
|
fi
|
|
if [ -n "${STABLE_NOTES_FILE:-}" ]; then
|
|
args+=(--notes-file "$STABLE_NOTES_FILE")
|
|
fi
|
|
./scripts/release.sh "${args[@]}"
|
|
|
|
- name: Dump npm debug logs
|
|
if: failure()
|
|
run: |
|
|
shopt -s nullglob
|
|
for f in "$HOME"/.npm/_logs/*.log; do
|
|
echo "===== $f ====="
|
|
tail -n 300 "$f" | sed -E \
|
|
-e 's#((authorization|_authToken|_auth|node_auth_token|npm_token)"?[[:space:]]*[:=][[:space:]]*"?)(Bearer[[:space:]]+)?[^",[:space:]]+#\1***REDACTED***#Ig'
|
|
done
|
|
|
|
- name: Push stable tag
|
|
id: tag
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^v' | head -1)"
|
|
if [ -z "$tag" ]; then
|
|
echo "Error: no stable tag points at HEAD after release." >&2
|
|
exit 1
|
|
fi
|
|
echo "version=${tag#v}" >> "$GITHUB_OUTPUT"
|
|
if ! git push origin "refs/tags/${tag}"; then
|
|
sha="$(git rev-parse HEAD)"
|
|
{
|
|
echo "## Tag push rejected"
|
|
echo ""
|
|
echo "The npm publish succeeded, but pushing \`${tag}\` was rejected."
|
|
echo "This usually means the tagged commit modifies workflow files,"
|
|
echo "which GITHUB_TOKEN may not reference when creating refs from"
|
|
echo "dispatch or scheduled runs. Recover with maintainer credentials:"
|
|
echo ""
|
|
echo '```'
|
|
echo "git tag ${tag} ${sha}"
|
|
echo "git push origin refs/tags/${tag}"
|
|
echo "gh workflow run docker.yml --ref refs/tags/${tag}"
|
|
echo "./scripts/create-github-release.sh ${tag#v}"
|
|
echo '```'
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
echo "::error::Tag push rejected; see the job summary for recovery commands." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Tag pushes made with GITHUB_TOKEN do not fire docker.yml's tag
|
|
# trigger (GitHub suppresses workflow runs caused by GITHUB_TOKEN
|
|
# pushes), so dispatch the image build at the new tag explicitly. This
|
|
# is what moves Docker `:latest` and publishes the versioned stable
|
|
# image tags.
|
|
- name: Build Docker images for the stable tag
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
tag="$(git tag --points-at HEAD | grep '^v' | head -1)"
|
|
if gh workflow run docker.yml --ref "refs/tags/${tag}" --repo "$GITHUB_REPOSITORY"; then
|
|
echo "Dispatched docker.yml at ${tag}."
|
|
else
|
|
# Older source commits may predate docker.yml's workflow_dispatch
|
|
# trigger; the dispatch then fails while the npm release is
|
|
# already complete and correct.
|
|
echo "::warning::Could not dispatch docker.yml at ${tag}. Run docker.yml manually at that tag to publish the stable images."
|
|
fi
|
|
|
|
- name: Create GitHub Release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PUBLISH_REMOTE: origin
|
|
run: |
|
|
version="$(git tag --points-at HEAD | grep '^v' | head -1 | sed 's/^v//')"
|
|
if [ -z "$version" ]; then
|
|
echo "Error: no v* tag points at HEAD after stable release." >&2
|
|
exit 1
|
|
fi
|
|
args=("$version")
|
|
if [ -n "${STABLE_NOTES_FILE:-}" ]; then
|
|
args+=(--notes-file "$STABLE_NOTES_FILE")
|
|
fi
|
|
./scripts/create-github-release.sh "${args[@]}"
|
|
|
|
# After a stable ships from master-side beta notes, move the file to its
|
|
# canonical home (releases/vYYYY.MDD.P.md) so the stable-notes invariant
|
|
# holds durably. Machine-owned branch + human-opened PR, as with the
|
|
# draft job above.
|
|
canonicalize_stable_notes:
|
|
needs: [preflight_stable, publish_stable]
|
|
if: ${{ needs.preflight_stable.outputs.notes_mode == 'master_beta' && needs.publish_stable.result == 'success' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
with:
|
|
ref: master
|
|
fetch-depth: 0
|
|
|
|
- name: Configure git author
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
|
|
- name: Push the canonicalization branch
|
|
env:
|
|
STABLE_VERSION: ${{ needs.publish_stable.outputs.stable_version }}
|
|
NOTES_PATH: ${{ needs.preflight_stable.outputs.notes_path }}
|
|
NOTES_REF: ${{ needs.preflight_stable.outputs.notes_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
branch="release-notes/v${STABLE_VERSION}-canonicalize"
|
|
git checkout -B "$branch"
|
|
# Canonicalize exactly what shipped: take the notes at the pinned
|
|
# revision the release read them from, so a master edit made
|
|
# during the run surfaces as a reviewable diff in this PR instead
|
|
# of silently diverging from the published GitHub Release.
|
|
git show "${NOTES_REF}:${NOTES_PATH}" > "releases/v${STABLE_VERSION}.md"
|
|
git add "releases/v${STABLE_VERSION}.md"
|
|
if git ls-files --error-unmatch "${NOTES_PATH}" >/dev/null 2>&1; then
|
|
git rm -q "${NOTES_PATH}"
|
|
fi
|
|
git commit -m "docs(release): canonicalize stable notes for v${STABLE_VERSION}"
|
|
git push -f origin "$branch"
|
|
{
|
|
echo "## Stable notes canonicalization pushed"
|
|
echo ""
|
|
echo "- Branch: \`${branch}\`"
|
|
echo "- Open and merge the PR (a human opens it so CI runs):"
|
|
echo " https://github.com/${GITHUB_REPOSITORY}/compare/master...${branch}?expand=1"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|