ci: publish versioned packages with verified tarballs and OIDC

[miyaontherelay]

Adds a dispatch-only npm release pipeline for the three packages moved by #205. The workflow follows relayfile's publish workflow: build/version once, pass artifacts to publishing, then commit release versions and create a GitHub Release after successful publication.

Stacked on #205 (refactor/packages-layout); this PR contains only the release workflow, its tooling/tests, and package repository-directory corrections.

• dry_run defaults to true. The six dispatch inputs are package, version, custom_version, preid, dry_run, and tag. As in the reference, real releases require package=all; individual selections support dry runs because every package's version advances together.
• SDK is the single version anchor. All four internal dependency types are rewritten to the exact new version. Surface is built and packed first, then installed into the SDK with --no-save --package-lock=false; the build asserts that the installed surface is not a symlink. Published manifests contain registry versions.
• Both jobs run actual npm pack, unpack the tarballs, and assert entrypoints, declarations, versions, internal dependencies, and executable bits. Runtime checks require both nonempty binaries and execute the unpacked daemon plus the compiled CLI against the deterministic fixture, including dry runs. All checks precede the first publish.
• Runtime uses cargo build --locked --release -p relayflowd and bun build packages/sdk/src/cli-executable.ts --compile --target=bun-linux-x64. Publication is sequential: surface, SDK, runtime.
• Publishing uses npm 11, contents: write, id-token: write, and npm publish --access public --provenance --ignore-scripts; no npm token. Configure each package's npm trusted publisher for AgentWorkforce/flows, workflow publish.yml before a real release. Release lockfile generation explicitly resolves the newly published surface and rejects a remaining local link.

Validation was run on macOS arm64. The Linux build/smoke steps and hosted OIDC authentication have not been executed here; Docker did not respond. No package was published, release created, or PR merged. The hash-pinned fixtures, historical records, SDK path-depth code, review-swarm workflow, and swarm scripts are unchanged.

Validation commands and captured output excerpts (full suites, no changes to their tests):

cd packages/sdk
PATH=/Users/khaliqgant/.bun/bin:$PATH RELAYFLOWS_ALLOW_ANALYZER_SKIP=1 ./node_modules/.bin/vitest run --maxWorkers=1 --minWorkers=1

 Test Files  32 passed | 1 skipped (33)
      Tests  662 passed | 3 skipped (665)
   Duration  148.33s (transform 1.18s, setup 0ms, collect 5.34s, tests 122.23s, environment 12ms, prepare 3.79s)

The initial default-worker run overlapped the kernel workload and failed two timing bounds. It is not being reported as green:

PATH=/Users/khaliqgant/.bun/bin:$PATH RELAYFLOWS_ALLOW_ANALYZER_SKIP=1 ./node_modules/.bin/vitest run

 Test Files  2 failed | 30 passed | 1 skipped (33)
      Tests  2 failed | 660 passed | 3 skipped (665)
AssertionError: expected 1663 to be less than 1000
"CLI \"/var/folders/_z/f_fpl8j533g_r63706k2xvp00000gn/T/flows-wrapper-FpcXK1/leaky-wrapper\" did not identify as relayflows-agent-cli-v1 within 2000ms."

The rerun changed only worker concurrency. The real Claude analyzer also ran successfully; the three skips are the existing real-CLI-adapter cases. RELAYFLOWS_ALLOW_ANALYZER_SKIP=1 permits unavailable-analyzer diagnostics and does not force that case to skip.

node --test scripts/publish.test.mjs

✔ one SDK anchor rewrites all internal dependency types and preserves external ranges (1658.117875ms)
✔ prerelease bumps use the SDK anchor and output the resolved version (1346.873625ms)
✔ invalid custom versions fail before any package changes (980.328667ms)
✔ actual npm tarballs reject missing dist and local dependencies, then accept built surface (5491.395167ms)
✔ runtime tarball refuses an unstaged binary package (1599.046625ms)
ℹ tests 5
ℹ suites 0
ℹ pass 5
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 11500.398667

node scripts/pack-release.mjs surface
node scripts/pack-release.mjs sdk

PACK_OK @relayflows/surface@2.0.0: package/dist/index.js, package/dist/index.d.ts, package/dist/runtime.js, package/dist/runtime.d.ts
PACK_OK @relayflows/sdk@2.0.0: package/dist/index.js, package/dist/index.d.ts, package/dist/cli.js

npm publish dist/publish/relayflows-surface-2.0.0.tgz --dry-run --access public --provenance --ignore-scripts --tag latest
npm publish dist/publish/relayflows-sdk-2.0.0.tgz --dry-run --access public --provenance --ignore-scripts --tag latest

npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access (dry-run)
+ @relayflows/surface@2.0.0
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access (dry-run)
+ @relayflows/sdk@2.0.0

actionlint .github/workflows/publish.yml exited 0 with no diagnostics; git diff --check exited 0 with no output.

Final kernel rerun at committed head 076727a06b3d700d0b85bf6473d0a8fbc014bd17: 165 passed, 0 failed across the workspace.

cd kernel
PATH=/Users/khaliqgant/.cargo/bin:$PATH sh ../ops/cargo.sh test --workspace

test result: ok. 35 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.70s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 34 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 38.79s
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.17s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.19s
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 14.77s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.28s
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.10s
test result: ok. 53 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.19s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.10s
test result: ok. 24 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.08s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: c8cd9339-89de-411c-81d5-a14df164ac45

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

3 issues found across 6 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="scripts/pack-release.mjs">

<violation number="1" location="scripts/pack-release.mjs:13">
P1: The `--ignore-scripts` option does not suppress npm's `prepare` hook during `npm pack`. This runs surface's Bun build and SDK's TypeScript build; the release-tooling fixture and publish job lack that build environment, so the workflow fails before validation or publication. Pack the already-built artifacts without lifecycle preparation, or remove the redundant repack.</violation>
</file>

<file name="scripts/version-packages.mjs">

<violation number="1" location="scripts/version-packages.mjs:6">
P2: Custom versions accepted by this regex can be silently normalized by `npm version`, so the workflow publishes and tags a version different from the requested `custom_version`. Reject noncanonical inputs or verify that npm's resolved version exactly matches the requested value before propagating it.</violation>
</file>

<file name=".github/workflows/publish.yml">

<violation number="1" location=".github/workflows/publish.yml:217">
P1: When the selected branch advances after dispatch, this push rejects because the job publishes artifacts built from stale `github.sha`. That failure occurs after npm publish, leaving immutable package versions without the commit, tag, or GitHub Release. Reserve or verify the branch ref before publishing and use a release-specific ref to prevent this partial release.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: The --ignore-scripts option does not suppress npm's prepare hook during npm pack. This runs surface's Bun build and SDK's TypeScript build; the release-tooling fixture and publish job lack that build environment, so the workflow fails before validation or publication. Pack the already-built artifacts without lifecycle preparation, or remove the redundant repack.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/pack-release.mjs, line 13:

<comment>The `--ignore-scripts` option does not suppress npm's `prepare` hook during `npm pack`. This runs surface's Bun build and SDK's TypeScript build; the release-tooling fixture and publish job lack that build environment, so the workflow fails before validation or publication. Pack the already-built artifacts without lifecycle preparation, or remove the redundant repack.</comment>

<file context>
@@ -0,0 +1,60 @@
+const destination = resolve(output);
+mkdirSync(destination, { recursive: true });
+const [packed] = JSON.parse(execFileSync('npm', [
+  'pack', '--ignore-scripts', '--json', '--pack-destination', destination,
+], { cwd: directory, encoding: 'utf8' }));
+const archive = join(destination, packed.filename);
</file context>

[cubic-dev-ai]

P1: When the selected branch advances after dispatch, this push rejects because the job publishes artifacts built from stale github.sha. That failure occurs after npm publish, leaving immutable package versions without the commit, tag, or GitHub Release. Reserve or verify the branch ref before publishing and use a release-specific ref to prevent this partial release.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/publish.yml, line 217:

<comment>When the selected branch advances after dispatch, this push rejects because the job publishes artifacts built from stale `github.sha`. That failure occurs after npm publish, leaving immutable package versions without the commit, tag, or GitHub Release. Reserve or verify the branch ref before publishing and use a release-specific ref to prevent this partial release.</comment>

<file context>
@@ -0,0 +1,242 @@
+            git commit -m "chore(release): v${NEW_VERSION}"
+          fi
+          git tag -a "v${NEW_VERSION}" -m "Release v${NEW_VERSION}"
+          git push --atomic origin "HEAD:refs/heads/${RELEASE_BRANCH}" "refs/tags/v${NEW_VERSION}"
+      - name: Create GitHub Release
+        if: ${{ !inputs.dry_run }}
</file context>

[cubic-dev-ai]

P2: Custom versions accepted by this regex can be silently normalized by npm version, so the workflow publishes and tags a version different from the requested custom_version. Reject noncanonical inputs or verify that npm's resolved version exactly matches the requested value before propagating it.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/version-packages.mjs, line 6:

<comment>Custom versions accepted by this regex can be silently normalized by `npm version`, so the workflow publishes and tags a version different from the requested `custom_version`. Reject noncanonical inputs or verify that npm's resolved version exactly matches the requested value before propagating it.</comment>

<file context>
@@ -0,0 +1,32 @@
+
+// The SDK is the version anchor; no package independently computes a bump.
+const paths = ['surface', 'sdk', 'runtime-linux-x64'].map((name) => `packages/${name}/package.json`);
+if (process.env.CUSTOM_VERSION && !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(process.env.CUSTOM_VERSION)) {
+  throw new Error('custom_version must be a semantic version');
+}
</file context>

[kjgbot]

Reviewed. This is good work, and it solves the problem I had hacked around.

Disclosure: I wrote the brief this was built from, and I wrote the interim workflow it replaces. So I have reviewed it against the requirements rather than against my own earlier attempt, which was worse.

The thing I most wanted to see, and it is here

My discarded version built the surface and symlinked it so the SDK could compile against a sibling whose manifest pointed at the registry. That is a workaround. This does it properly:

• Build SDK against packed surface — the SDK is compiled against the actual tarball, so what is verified is the artifact that gets published, not a working tree that happens to be adjacent.
• Regenerate release lockfiles, asserting !surface.link and "release lockfile must resolve the published surface" — that directly guards the failure mode my hack would have papered over. A published SDK that silently resolved a local link would have shipped broken and nobody would have known until a consumer installed it.

version-packages.mjs is the relayfile mechanism done correctly: sdk as the single anchor, semver validation on custom_version, --no-git-tag-version --ignore-scripts --package-lock=false, then a name-set pass that rewrites dependencies/devDependencies/optionalDependencies/peerDependencies to the new version for any sibling package. That is exactly why the manifests must not ship file: deps, and it removes the need for the linking entirely.

Requirements check

required	status
six dispatch inputs, dry_run default true	present
contents: write + id-token: write, no npm token	present, zero token references
provenance publish	present
version anchor + internal dep rewrite	version-packages.mjs
publish in dependency order	Publish to NPM (surface before SDK), for package in surface sdk runtime-linux-x64
pack and assert tarball contents	asserted in both build and publish-packages
runtime binaries built AND executed	Pack and assert runtime (executes both unpacked binaries)

Beyond the brief: Validate release mode, a Test release tooling step that exercises the release scripts themselves, lockfile regeneration with assertions, tag + GitHub Release, and a summary. I asked for a pipeline and got one with its own tests.

I was wrong in one of my own notes about this PR. I recorded it as "a single job where relayfile uses ordered ones" from a grep of the file. It is two jobs — build then publish-packages — with the ordering inside the publish step. I counted jobs with a pattern instead of parsing the workflow.

What is actually blocking it

Its three red checks are inherited from my bug, not from this work. #206 is stacked on #205, and #205 had stale paths that failed linux-x64-artifact and packed-consumer. Those are fixed now (5cdab76, 235b948) and #205 is green on everything except the repo-wide review gate.

This needs a rebase onto current #205 for its CI to say anything meaningful. I have not rebased it myself — it is your branch and I have already caused one collision today by having two agents on this task.

One question, not a blocker

Commit version bump and create tag pushes to the repo during a release. Worth confirming that lands on the intended branch when the workflow is dispatched from a non-default ref, since dry_run: false is the only guard in front of it.