feat(ci): add release-dry-run.yml — catch release.yml regressions at PR-time (A1)#353
Merged
Conversation
…PR-time A1 from .reviews/176-followup-prio-codex.md, originated from v1.75.1 post-mortem item (a). Runs 'npm publish --dry-run' on PRs touching release.yml, package.json, the cli/, hooks/, skills/, .claude-plugin/ trees, or related docs. Catches the class of bugs that would break release.yml at tag-time (npm/Node version drift, package.json.files dropping a shipped path, etc.) — visible at PR review instead of producing a half-published tag. Design constraints (each enforced by tests/test-release-dry-run-workflow.sh, 25 quality tests): - permissions: contents: read only. **NEVER** id-token: write. The npm CLI runs OIDC setup before the dry-run branch; with id-token: write present it may attempt token mint even though it never PUTs the package. Dry-run proves PACKAGING; publish auth stays in release.yml. - Temp version rewrite to 0.0.0-dry-run-<SHA> before publishing. Naive 'npm publish --dry-run' against the checked-in 1.x.y errors with 'cannot publish over previously published versions'. --force works but disables protections; Codex flagged this. - Node 24 + npm >=11.5.1 guard, parity-tested against release.yml. - No --force, no --provenance, no NODE_AUTH_TOKEN, no NPM_TOKEN. - Path filter covers every package.json.files entry; new test asserts this so a future entry can't silently bypass the dry-run. Wired into ci.yml so the test suite gates the workflow's shape too. TDD: 25/25 tests RED before workflow → 25/25 GREEN after. No regression in existing release-workflow tests (15/15) or doc-consistency (40/40). Per cross-model design review (.reviews/176-followup-prio-codex.md section 2.A1 + section 3 risks 1-3, 9).
…w dry-run test in CONTRIBUTING PR 353 CI caught two cross-cutting tests that need to know about the new release-dry-run.yml workflow: 1. test_no_unused_id_token_permission was matching the literal string 'id-token: write' in YAML comments. Workflows like release-dry-run.yml reference the permission in their explanatory comments to document WHY they DO NOT request it — that documentation should not trip the test. Anchored the grep to active code lines (same '^[[:space:]]*[^#[:space:]]' pattern used by test_no_node_auth_token in the new test file). 2. CONTRIBUTING.md test-script list rebuilt: added test-release-dry-run-workflow.sh between test-release-workflow.sh and test-domain-detection.sh. Both PASS locally now. Original 25/25 dry-run tests still pass.
BaseInfinity
force-pushed
the
feat/release-dry-run-ci
branch
from
6decf91 to
7f952fa
Compare
… keep both test suites)
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A1 from ROADMAP follow-up + v1.75.1 post-mortem. Runs `npm publish --dry-run` on every PR touching release.yml, package.json, or the shipped package surface. Catches MODULE_NOT_FOUND-class regressions, dropped shipped paths, npm/Node version drift — visible at PR review instead of producing a half-published tag.
What's in the box
Cross-model design (Codex gpt-5.5 xhigh, .reviews/176-followup-prio-codex.md)
Codex caught 3 things I missed:
Test plan
What this does NOT catch (honest scope)