Repository navigation
ci: stage v2 npm releases under the v2-legacy dist-tag - #1034
Conversation
v2 releases were published with the default `latest` tag, so 2.3.47 moved `latest` off v3 for every package name shared with master (api, guard, indexer, relayer, ...). Port master's staged publishing flow to v2: - Release workflow (same file name as master, so one npm trusted publisher covers both) stages under `v2-legacy` via OIDC; a maintainer approves with 2FA. Versioning runs `pnpm changeset:version`. - Release gates: typecheck, lint, build, release script tests. - Add repository.directory to every package (required for provenance), .nvmrc, changelog-github, changeset check on PRs into v2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014qDHk3SaPaDGpPTU1jjLpz
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014qDHk3SaPaDGpPTU1jjLpz
Same hardening as master (0xPolygon/pipelines fix for GHSA-rxhc-j8g6-h4jp): check out without persisted credentials, install with --ignore-scripts, run the release gates on release-PR merges before minting the scoped app token. `pnpm dev` replaces the skipped preconstruct postinstall so `changeset:version` can resolve workspace sources. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014qDHk3SaPaDGpPTU1jjLpz
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8861203823
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const stagedPackages = [] | ||
| for (const { releasePackage } of packagesToStage) { | ||
| const tarballPath = await packPackage(releasePackage, outputDirectory) | ||
| runChecked('npm', ['stage', 'publish', tarballPath, '--tag', distTag, '--access', 'public', '--provenance'], { |
There was a problem hiding this comment.
When staging multiple packages, a failure from any later npm stage publish aborts the custom publish command after earlier packages have already been staged. The pinned Changesets action then skips creating tags from the earlier New tag: lines—its documented partial-publish behavior—so a retry cannot recognize those packages: npm view does not expose pending stages, and npm states that a staged version occupies the same unique semver index and cannot be staged again. Consequently, one transient failure can wedge the entire release until maintainers manually reject the successful stages; persist each success independently or explicitly recognize already-staged versions on retry.
Useful? React with 👍 / 👎.
Port master's fixes: reject snapshot tags npm parses as semver ranges (semver.validRange), and list every unpublished version (including ones staged by an earlier, partially failed run) in the approval summary. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014qDHk3SaPaDGpPTU1jjLpz
1 participant
Summary
v2 releases were published with the default
latestdist-tag, so2.3.47(Oct 2) movedlatestoff v3 for every package name shared withmaster(api,builder,guard,indexer,marketplace,metadata,relayer,abi).npm i @0xsequence/indexercurrently installs v2.This ports the staged publishing flow from #1033 to
v2:v2keeps achangesets: Release / Deploy (v2)PR up to date; versioning runspnpm changeset:version(embedded version constant + network names doc).v2-legacyvia OIDC trusted publishing; a maintainer approves with 2FA.master(npm-release-trigger.yml), so one stage-only trusted publisher per package covers both branches.tests.ymlalready runs on every push tov2.pnpm devreplaces the preconstructpostinstallskipped by--ignore-scripts.repository.directoryon every package,.nvmrc, changelog-github,baseBranch: v2, changeset check on PRs intov2.Prerequisites
Same as #1033 (release bot app + secrets,
configure-npm-trust.shfrommaster, which already covers all v2 package names). Merge #1033 first.Notes
scripts/update-version.jswrites@0xsequence/core's version intoVERSION, which was stale at2.3.28. Sincelinkedonly aligns versions of packages that are bumped,VERSIONtrackscore, not necessarily the release. Not changed here.Test plan
pnpm test:release: 12 cases pass--ignore-scriptsinstall +pnpm dev+pnpm changeset:versionsucceeds (VERSIONupdated)ci:release-gatespasses (build, lint, release tests)npm stage: nothing staged at current versions (all on npm); after a test bump, packages stage under--tag v2-legacy🤖 Generated with Claude Code
https://claude.ai/code/session_014qDHk3SaPaDGpPTU1jjLpz