Skip to content

fix(ci): make releases resumable and stabilize Windows - #266

Merged
yansigit merged 1 commit into
devfrom
codex/cicd-postpublish-and-windows-hardening
Sep 5, 2026
Merged

fix(ci): make releases resumable and stabilize Windows#266
yansigit merged 1 commit into
devfrom
codex/cicd-postpublish-and-windows-hardening

Conversation

@yansigit

@yansigit yansigit commented Sep 5, 2026

Copy link
Copy Markdown
Owner

Summary

  • Make release post-publish recovery provenance-safe and resumable: npm gitHead, the Git tag, and the GitHub release must all resolve to the exact audited commit.
  • Create release tags through the authenticated GitHub API, handle concurrent recovery safely, and reject inconsistent partial-publication states instead of silently continuing.
  • Stabilize hosted Windows CI with six balanced shards, bounded subprocess lifecycles, explicit teardown, and actionable timeout diagnostics.
  • Treat stale pull-request links as recoverable only for confirmed 404 responses while preserving fail-closed behavior for permission, rate-limit, and service failures.

Verification

  • bun run prepush
  • Focused workflow contracts: 234 passing checks across the release, pull-request automation, and CI workflow suites.
  • Reproductions and adapted Windows lifecycle tests: 330 passed, 4 platform skips, 0 failed across 23 files.
  • Full suite: 18,583 passed, 9 skipped, 0 failed, followed by all serial lanes passing.
  • Independent workflow security review: PASS; permissions are narrowly scoped, provenance checks fail closed, and all mutations are authenticated and verified.

Checklist

  • Scope stays focused and avoids unrelated cleanup.
  • Added/updated tests for behavior changes under src/ or the application frontend, or obtained test-exception-approved (check: bun run check:hygiene).
  • Docs or release notes were updated when needed.
  • Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Adapts the applicable hosted-Windows lifecycle hardening from lidge-jun#3548, lidge-jun#3550, lidge-jun#3558, and lidge-jun#3572 while preserving this fork's flat test layout.

Recover exact-provenance partial releases, tolerate stale workflow-run PR associations, reduce Windows shard pressure, and carry bounded child-process lifecycle hardening into the fork's flat test layout.

Co-authored-by: JUN <bitkyc08@gmail.com>

Co-authored-by: t <a@b.com>

gate-status: exempt
@github-actions

github-actions Bot commented Sep 5, 2026

Copy link
Copy Markdown

Deterministic PR hygiene checks passed.

@github-actions github-actions Bot added the bug Something isn't working label Sep 5, 2026
@github-actions

github-actions Bot commented Sep 5, 2026

Copy link
Copy Markdown

PR automation (bot-owned)

  • Class: same-repo-human (same-repo-human)
  • Base: c290de8e73fd184572ce0c8989db5aaa611a99be
  • Head: dae590f349d90e2018246d4cc81301b449ea9792
  • Action: observed
  • Exact-head gate: BLOCKED (not-mergeable, check-missing)
  • Sensitive paths: .github/scripts/pr-automation-workflow.test.cjs, .github/scripts/pr-automation.cjs, .github/scripts/pr-automation.test.cjs, .github/scripts/release-postpublish.cjs, .github/scripts/release-postpublish.test.cjs, .github/workflows/ci.yml, .gi
  • Maintainer auto-merge approval: NO
  • Bot merge evidence: NO
  • Next action: wait for exact-head checks

@yansigit
yansigit merged commit 7e13626 into dev Sep 5, 2026
35 checks passed
@yansigit
yansigit deleted the codex/cicd-postpublish-and-windows-hardening branch September 5, 2026 09:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant