ci: add release-prepare and release-publish workflows for npm releases by tejaskash · Pull Request #2206 · aws/agentcore-cli

tejaskash · 2026-09-03T22:28:37Z

Summary

Two workflows give the refactor branch a PR-gated npm release process for @aws/agentcore, in the shape of the Python SDK's release-prepare and release-publish pair.

release-prepare.yml, workflow_dispatch with bump (major, minor, patch) and channel (rc, stable). Bumps package.json with bun pm version, refreshes the vended @aws/agentcore-cdk pin in the template, force-pushes release/v<version> and opens the PR as the automation App. The PR is the only release gate.
- Version arithmetic: 0.28.1 → 1.0.0-rc.1 → 1.0.0-rc.2 → 1.0.0 → 1.1.0-rc.1. bump is ignored while an rc series is open. Series boundaries set the version explicitly: Bun's prerelease counter starts at 0 and its pm version major on 1.0.0-rc.3 yields 2.0.0.
release-publish.yml, pull_request: closed into refactor for merged release/v* PRs. Runs check, build and unit-test on the merge commit, then on ubuntu-latest builds, packs, cross-compiles six binaries, npm publish --provenance under rc for prereleases or latest otherwise, and creates the GitHub release with generated notes, tarball and binaries. Publish is skipped if the version is already on npm, so a rerun after a failed release step completes.
scripts/sync-vended-cdk.ts, Bun port of feat(release): auto-bump the vended CDK pin during release prep #2118's pin sync. Dependency-free because it runs before bun install.
package.json renamed to @aws/agentcore, set to the last published version 0.28.1, with the repository field provenance requires.
Telemetry fix found by the first dry run: src/telemetry/shapes.tsx only accepted X.Y.Z, so a binary versioned 1.0.0-rc.1 printed its version and exited 1 at startup. Now accepts a prerelease suffix, length-capped like the other attributes, with a test.each for accepted and rejected shapes.

No GitHub environments and no concurrency groups. Publish runs on a GitHub-hosted runner because npm refuses provenance from self-hosted ones.

Verification

workflow_dispatch only lists workflow files that exist on main, and these two do not yet, so neither could be dispatched from this branch. Verified instead:

actionlint with shellcheck clean on both workflows.
Version bump shell simulated locally for all five transitions listed above, each producing the expected version.
scripts/sync-vended-cdk.ts run with node_modules absent: bumps alpha.45 → alpha.51, is a no-op on the second run, exits 1 on an unknown dist-tag.
The build, pack, cross-compile and artifact steps are unchanged from the earlier single-file version, which ran end to end in dry-run mode: https://github.com/aws/agentcore-cli/actions/runs/33810416086 (artifact held aws-agentcore-1.0.0-rc.0.tgz with the stamped version and six binaries). The release PR path also ran end to end then: https://github.com/aws/agentcore-cli/actions/runs/33810398072 opened chore(release): v1.0.0 #2203, and https://github.com/aws/agentcore-cli/actions/runs/33816972577 re-dispatched against an existing PR without failing.
After the telemetry fix, a local bundle stamped 1.0.0-rc.1 runs --version and exits 0.

Review fixes after the rebuild

Release notes only consider this workflow's own tags (vX.Y.Z and vX.Y.Z-rc.N). Without the filter, the first rc's notes would have started at main's v1.0.0-preview.29, which sorts just below 1.0.0-rc.1. Verified against the real tag list: 1.0.0-rc.1 and 1.0.0 start at v0.28.1, 1.0.0-rc.1 at v1.0.0-rc.0, 1.1.0-rc.0 at v1.0.0.
gh release create is rerun-safe: if the release already exists the step re-uploads assets with --clobber instead of failing on the tag.
The package rename is followed through: pr-automation.yml's PR tarball step and the README looked for agentcore-*.tgz, Bun names a scoped tarball aws-agentcore-*.tgz.

Per @AlexanderRichey's thread

check.yml, build.yml and unit-test.yml are merged into one reusable verify.yml with one job per platform: install Bun and deps once, then static checks (Linux only, they are platform-independent), bundle, package, compile, smoke test and unit tests. Three jobs and three installs instead of seven. ci.yml and release-publish.yml each call it once. Check names become verify / Linux, verify / Windows, verify / macOS. No ruleset requires status checks by name. The workflow_dispatch on release-publish is gone too, since it existed only for dry-run verification and cannot be used until the file is on main.

Further review findings addressed

First rc is rc.1, per Alex.
Bun is pinned to 1.4.0 through packageManager in package.json, which setup-bun reads in every workflow. The release scripts depend on bun pm version, bun pm view and bun pm pack --quiet output shapes.
verify's static checks all report even when one fails (!cancelled()), matching the old check.yml. Build and tests run only when they pass.
agentcore update now tracks the dist-tag named by its own prerelease identifier (rc, preview) and compares against that tag, instead of mapping every prerelease to preview and comparing against latest. Without this, an rc user running update after 1.0.0 reached latest would have installed main's preview build. Covered by a test.each.
README documents recovery when publish fails after the release PR merges: rerun release-publish, never re-dispatch release-prepare.
verify's bun pm pack skips prepublishOnly, which would have rebuilt right after bun run build.

Before the first real release

Add NPM_TOKEN as a repo secret (granular token with publish rights on @aws/agentcore). The Trusted Publisher stays bound to release-main-and-preview.yml on main.
release-prepare.yml becomes dispatchable once refactor lands on main, or once the file exists there. release-publish.yml has no dispatch and is unaffected.
latest contention with main needs a decision before the first stable: release-main-and-preview.yml on main also publishes --tag latest, so after refactor publishes 1.0.0, the next 0.28.x from main would move latest back down. Either main stops publishing latest once 1.0.0 is out, or its releases move to a different dist-tag.
Runner allowlisting for a dedicated release runner, if we want one, with @aidandaly24.

Follow-ups, not in this PR

src/handlers/update/index.tsx maps any prerelease to dist-tag preview and compares against latest, so rc users would not be offered a newer rc by agentcore update.
A telemetry attribute validation failure takes the whole CLI down. Telemetry should degrade, not crash.
The vended CDK pin bump lands in the release PR, so any template incompatibility with a newer @aws/agentcore-cdk surfaces as red CI on that PR.

- release.yml: workflow_dispatch (bump, channel, dry_run) publishes <next>-rc.N under the rc dist-tag after approval, or opens a release PR whose merge publishes under latest. rc numbers derive from tags, never commits. - package.json: publish as @aws/agentcore, version tracks the last stable release (0.28.1), repository field required for npm provenance. - update.test.ts: read the version from constants instead of a literal.

…other job

…ersion, drop redundant setup

…schema The rc dry run's binary printed its version and then exited 1: service.version was validated against ^\d+\.\d+\.\d+$, so any -rc.N build crashed at startup.

agentcore-devx-automation

AgentCore Harness Review

Verdict: Looks good

Reviewed the release workflow, the package.json rename to @aws/agentcore, and the update.test.ts refactor to use PACKAGE_VERSION. The design is clean: version resolution is centralized in one job, rc numbers are derived from tags (keeping package.json as the stable-only source of truth), the pull_request re-entry pattern properly gates stable publishes on human merge review, and packing happens before compile so the tarball never carries the platform binaries.

A few small things worth verifying before this workflow runs against main, but none block merging the PR:

The scaffolding assumes bun pm version <bump> --no-git-tag-version prints the new tag with a v prefix (${BASE#v} and refs/tags/$BASE both rely on that). Worth confirming on the first dry-run — if Bun ever drops the prefix, BASE="v..." becomes X.Y.Z, the tag-existence guard silently misses, and downstream tags/notes go out with a wrong prefix.
PREVIOUS="v$(git tag -l 'v*' | xargs bunx semver@7 --range \"<$VERSION\" | tail -1)" degenerates to PREVIOUS="v" if there are no matching prior tags (i.e. a truly-first stable release). gh api generate-notes and gh release create --notes-start-tag v would fail on that. Not reachable given 0.28.1 already exists, just something to be aware of.
release-pr uses gh pr create, which errors if a PR for release/vX.Y.Z is already open. The --force push updates the branch but won't refresh the PR title/body. Fine for the normal path; just means re-dispatching the same stable bump requires closing the old PR first.
if: github.event_name == 'workflow_dispatch' || ... on the version job doesn't restrict workflow_dispatch to any branch, so a stable dispatch from a non-refactor branch will open a release PR against that branch but the pull_request re-entry (branches: [refactor]) won't fire on merge. Presumably harmless during the refactor phase — worth tightening when the TODO to switch to main is picked up.

Telemetry guidance doesn't apply here (CI-only change), and the test change is a straightforward improvement over hardcoded "1.0.0".

agentcore-devx-automation · 2026-09-03T22:33:05Z

Claude Security Review: no high-confidence findings. (run)

agentcore-devx-automation · 2026-09-03T22:38:01Z

Claude Security Review: no high-confidence findings. (run)

codecov-commenter · 2026-09-03T22:38:38Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.09%. Comparing base (ef32ae3) to head (9000d63).
⚠️ Report is 22 commits behind head on refactor.

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2206   +/-   ##
=========================================
  Coverage     97.09%   97.09%           
=========================================
  Files           544      544           
  Lines         37794    37794           
=========================================
  Hits          36695    36695           
  Misses         1099     1099

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…lish job - concurrency keyed on the resolved version at the publish job, so a closed unrelated PR can no longer cancel a pending stable publish - skip npm publish when the version is already on npm, so a rerun after a failed release step completes instead of failing on the republish - re-dispatching stable edits the existing release PR instead of failing - cap service.version length like every other telemetry attribute

agentcore-devx-automation · 2026-09-03T23:19:24Z

Claude Security Review: no high-confidence findings. (run)

Hweinstock

I kind of like how the python sdk does this with two workflows. In this case, it might look something like:

prepare-release.yml takes in the versionBumpType and releaseChannel, and prepares a PR for the release on a branch with release/<channel>/<version> or some pattern so that we can extract it below.
release.yml triggers on closed PRs that follow release// from the GH bot. This could just run the build/check and release.

The main difference is we always get a PR to gate releases consistently, and the workflow triggers are much simpler.

Hweinstock · 2026-09-03T22:35:32Z

-  "name": "agentcore",
-  "version": "1.0.0",
+  "name": "@aws/agentcore",
+  "version": "0.28.1",


are we releasing under 1.0.0-rc or the previous version number?

I think we want to do 1.0.0-rc.1

1.0.0-rc.1. We will do release channel -> rc and bump type -> major that should give us 1.0.0-rc.1

Hweinstock · 2026-09-03T22:59:01Z

+        type: choice
+        options: [major, minor, patch]
+      channel:
+        description: rc publishes after approval, stable opens a release PR


would it be simpler to always open a PR? That also allows us to see the releases in the commit history and gives a consistent way to approve releases.

I agree about this. This pr would also update the cdk-contruct version on the project's agentcore.json using this pr like here

Hweinstock · 2026-09-03T23:05:30Z

+jobs:
+  version:
+    if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.merged && startsWith(github.head_ref, 'release/'))
+    runs-on: codebuild-agentcore-e2e-${{ github.run_id }}-${{ github.run_attempt }}


don't we need to do some allowlisting for this to work on the codebuild runners? I remember @aidandaly24 mentioning something recently.

Hweinstock · 2026-09-04T03:34:01Z

+    types: [closed]
+    # TODO: switch to main once the refactor lands there.
+    branches: [refactor]
+  workflow_dispatch:


why do we need workflow dispatch here?

This is only for the dryrun verification path

Hweinstock · 2026-09-04T04:00:35Z

+release-publish.yml (npm publish and GitHub release when a release PR merges)
+  |-- check.yml
+  |-- build.yml
+  `-- unit-test.yml


I think alex's comment is in reference to the check/build/unit-test workflows which are always run together, so I think the suggestion is to make it a single workflow containing check, build, and unit-test as jobs.

My understanding is that the runtime behavior would be the same, but we no longer need to manually wire in each job as a separate call. Instead, we call a single workflow that triggers all three, so it'd simplify some of the changes here.

ci.yml and release-publish.yml each call verify.yml once instead of wiring three workflows. Job bodies are unchanged. release-publish drops its workflow_dispatch, which only existed for dry-run verification.

agentcore-devx-automation · 2026-09-04T13:39:28Z

Claude Security Review: no high-confidence findings. (run)

AlexanderRichey · 2026-09-04T14:17:24Z

+      - run: bun run secrets:check
+        if: always()
+
+  build:


I meant to bring all three of these into one job to avoid installing bun and deps three times. We can just install bum, install deps, typecheck, build, and run tests all in one.

…pile, smoke test and test

agentcore-devx-automation · 2026-09-04T14:29:45Z

Claude Security Review: no high-confidence findings. (run)

…ry static check - release-prepare sets series boundaries explicitly so 0.28.1 -> 1.0.0-rc.1 -> 1.0.0-rc.2 -> 1.0.0 - package.json packageManager pins Bun 1.4.0, setup-bun reads it in every workflow - verify keeps reporting all static checks after one fails, pack skips prepublishOnly - update command tracks the dist-tag of its own prerelease identifier (rc, preview) instead of mapping every prerelease to preview and comparing against latest - README documents the recovery path when publish fails after the release PR merges

agentcore-devx-automation · 2026-09-04T15:44:49Z

Claude Security Review: no high-confidence findings. (run)

jariy17

Looks good.

tejaskash added 3 commits September 3, 2026 17:14

ci(release): run the approval job on the CodeBuild runner like every …

aadd9a6

…other job

ci(release): gate publish with the environment directly, use bun pm v…

126ddf9

…ersion, drop redundant setup

github-actions Bot added the size/m PR size: M label Sep 3, 2026

agentcore-devx-automation Bot added the agentcore-harness-reviewing AgentCore Harness review in progress label Sep 3, 2026

fix(telemetry): accept prerelease versions in the resource attribute …

c967ad3

…schema The rc dry run's binary printed its version and then exited 1: service.version was validated against ^\d+\.\d+\.\d+$, so any -rc.N build crashed at startup.

agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Sep 3, 2026

github-actions Bot added size/m PR size: M and removed size/m PR size: M labels Sep 3, 2026

agentcore-devx-automation Bot reviewed Sep 3, 2026

View reviewed changes

agentcore-devx-automation Bot removed the agentcore-harness-reviewing AgentCore Harness review in progress label Sep 3, 2026

agentcore-devx-automation Bot added claude-security-reviewing Claude Code /security-review in progress and removed claude-security-reviewing Claude Code /security-review in progress labels Sep 3, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Sep 3, 2026

tejaskash had a problem deploying to npm-publish-approval September 3, 2026 22:39 — with GitHub Actions Error

github-actions Bot added size/m PR size: M and removed size/m PR size: M labels Sep 3, 2026

agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Sep 3, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Sep 3, 2026

github-actions Bot added size/m PR size: M and removed size/m PR size: M labels Sep 3, 2026

tejaskash had a problem deploying to npm-publish-approval September 3, 2026 23:25 — with GitHub Actions Error

Hweinstock reviewed Sep 3, 2026

View reviewed changes

Hweinstock reviewed Sep 4, 2026

View reviewed changes

ci: merge check, build and unit-test into one reusable verify workflow

9b6adb4

ci.yml and release-publish.yml each call verify.yml once instead of wiring three workflows. Job bodies are unchanged. release-publish drops its workflow_dispatch, which only existed for dry-run verification.

github-actions Bot added size/l PR size: L and removed size/m PR size: M size/l PR size: L labels Sep 4, 2026

agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Sep 4, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Sep 4, 2026

AlexanderRichey reviewed Sep 4, 2026

View reviewed changes

ci(verify): one job per platform, install once then check, build, com…

a548bf1

…pile, smoke test and test

github-actions Bot added size/m PR size: M and removed size/l PR size: L labels Sep 4, 2026

agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Sep 4, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Sep 4, 2026

aidandaly24 mentioned this pull request Sep 4, 2026

ci(verify): give each CodeBuild job a unique runner label #2222

Closed

17 tasks

github-actions Bot added size/m PR size: M and removed size/m PR size: M labels Sep 4, 2026

agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Sep 4, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Sep 4, 2026

jariy17 approved these changes Sep 4, 2026

View reviewed changes

AlexanderRichey approved these changes Sep 4, 2026

View reviewed changes

tejaskash merged commit 8ee4126 into refactor Sep 4, 2026
22 checks passed

tejaskash deleted the feat/refactor-release-workflow branch September 4, 2026 17:57

tejaskash mentioned this pull request Sep 4, 2026

ci(release): placeholder release-prepare workflow so refactor's can be dispatched #2226

Open

Uh oh!

Conversation

tejaskash commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Review fixes after the rebuild

Per @AlexanderRichey's thread

Further review findings addressed

Before the first real release

Follow-ups, not in this PR

Uh oh!

agentcore-devx-automation Bot left a comment

Choose a reason for hiding this comment

AgentCore Harness Review

Uh oh!

agentcore-devx-automation Bot commented Sep 3, 2026

Uh oh!

agentcore-devx-automation Bot commented Sep 3, 2026

Uh oh!

codecov-commenter commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

agentcore-devx-automation Bot commented Sep 3, 2026

Uh oh!

Hweinstock left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Hweinstock Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

agentcore-devx-automation Bot commented Sep 4, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

agentcore-devx-automation Bot commented Sep 4, 2026

Uh oh!

agentcore-devx-automation Bot commented Sep 4, 2026

Uh oh!

jariy17 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

tejaskash commented Sep 3, 2026 •

edited

Loading

codecov-commenter commented Sep 3, 2026 •

edited

Loading

Hweinstock left a comment •

edited

Loading

Hweinstock Sep 3, 2026 •

edited

Loading