@ankhorage/devtools 1.15.5 → 1.15.7

package/README.md

@@ -3,7 +3,7 @@
 
 # @ankhorage/devtools
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v1.15.5](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v1.15.7](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Shared tooling, repository automation, runtime policies, and agent standards for Ankhorage TypeScript projects
 

package/dist/tools/workflows/files/release.yml

@@ -16,10 +16,16 @@ concurrency:
 jobs:
   release:
     runs-on: ubuntu-latest
+    outputs:
+      versioned: ${{ steps.release.outputs.versioned }}
+      package_name: ${{ steps.release.outputs.package_name }}
+      package_version: ${{ steps.release.outputs.package_version }}
+      release_sha: ${{ steps.release.outputs.release_sha }}
 
     steps:
       - name: Create the scoped release token
         id: release-token
+        continue-on-error: true
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.ANKHORAGE_RENOVATE_SYNC_CLIENT_ID }}
@@ -28,6 +34,12 @@ jobs:
           repositories: ${{ github.event.repository.name }}
           permission-contents: write
 
+      - name: Diagnose unavailable scoped release token
+        if: steps.release-token.outcome == 'failure'
+        run: |
+          echo "::error title=Renovate Sync App repository access required::Could not create the scoped Ankhorage release token for ${GITHUB_REPOSITORY}. Ensure the ankhorage-renovate-sync GitHub App is installed and authorized for this repository, then rerun Release. Bootstrap policy: https://github.com/ankhorage/renovate/issues/115"
+          exit 1
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
@@ -107,6 +119,7 @@ jobs:
             echo "versioned=true" >> "$GITHUB_OUTPUT"
             echo "package_name=$(node -p "require('./package.json').name")" >> "$GITHUB_OUTPUT"
             echo "package_version=$after_version" >> "$GITHUB_OUTPUT"
+            echo "release_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Publish unpublished packages
@@ -132,70 +145,128 @@ jobs:
             __ANKH_APM_RELEASE_COMMAND__ validate . --allow-owner-code --artifact "$artifact"
             npm publish "$artifact" --ignore-scripts
           fi
-          if ! git rev-parse -q --verify "refs/tags/v${package_version}" >/dev/null; then
-            git tag "v${package_version}"
-          fi
+      - name: Skip release tooling
+        if: hashFiles('.changeset/config.json') == ''
+        run: echo "No Changesets config found; skipping versioning and publishing."
 
-      - name: Verify published npm artifact
-        if: steps.release.outputs.versioned == 'true'
+  verify-publication:
+    needs: release
+    if: needs.release.outputs.versioned == 'true'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Setup Node for npm verification
+        uses: actions/setup-node@v4
+        with:
+          node-version: '__ANKH_NODE_VERSION__'
+          registry-url: https://registry.npmjs.org
+
+      - name: Update npm
+        run: npm install -g npm@latest
+
+      - name: Verify published npm artifact from a fresh runner
         env:
-          PUBLISHED_PACKAGE_NAME: ${{ steps.release.outputs.package_name }}
-          PUBLISHED_PACKAGE_VERSION: ${{ steps.release.outputs.package_version }}
+          PUBLISHED_PACKAGE_NAME: ${{ needs.release.outputs.package_name }}
+          PUBLISHED_PACKAGE_VERSION: ${{ needs.release.outputs.package_version }}
         run: |
           set -euo pipefail
           package_spec="${PUBLISHED_PACKAGE_NAME}@${PUBLISHED_PACKAGE_VERSION}"
           registry_evidence="${RUNNER_TEMP}/npm-publish-verification.json"
           artifact="${RUNNER_TEMP}/npm-publish-verification.tgz"
           pack_dir="${RUNNER_TEMP}/npm-pack-verification"
-          max_attempts=30
+          max_attempts=60
           retry_seconds=30
           mkdir -p "$pack_dir"
 
+          last_stage="registry-metadata"
           for attempt in $(seq 1 "$max_attempts"); do
             echo "Verifying ${package_spec} on npm (attempt ${attempt}/${max_attempts})..."
+            last_stage="registry-metadata"
+
             if npm view "$package_spec" version dist.tarball dist.integrity --json > "$registry_evidence"; then
               resolved_version="$(node -e "const p=require(process.argv[1]); process.stdout.write(p.version ?? '')" "$registry_evidence")"
               tarball="$(node -e "const p=require(process.argv[1]); process.stdout.write(p['dist.tarball'] ?? '')" "$registry_evidence")"
               integrity="$(node -e "const p=require(process.argv[1]); process.stdout.write(p['dist.integrity'] ?? '')" "$registry_evidence")"
 
               if [ "$resolved_version" = "$PUBLISHED_PACKAGE_VERSION" ] && [ -n "$tarball" ] && [ -n "$integrity" ]; then
+                last_stage="tarball-download"
                 if curl --fail --location --silent --show-error --output "$artifact" "$tarball"; then
+                  last_stage="integrity"
                   if EXPECTED_INTEGRITY="$integrity" ARTIFACT="$artifact" node -e "const { createHash }=require('node:crypto'); const { readFileSync }=require('node:fs'); const actual='sha512-'+createHash('sha512').update(readFileSync(process.env.ARTIFACT)).digest('base64'); if(actual!==process.env.EXPECTED_INTEGRITY){console.error('Downloaded npm tarball integrity mismatch.'); process.exit(1)}"; then
-                    npm pack "$package_spec" --pack-destination "$pack_dir" >/dev/null
-                    echo "Verified ${package_spec}: metadata, integrity, tarball download, and npm pack are available."
-                    exit 0
+                    last_stage="npm-pack"
+                    attempt_pack_dir="$pack_dir/attempt-${attempt}"
+                    mkdir -p "$attempt_pack_dir"
+                    if npm pack "$package_spec" --pack-destination "$attempt_pack_dir" >/dev/null; then
+                      echo "Verified ${package_spec}: metadata, integrity, tarball download, and npm pack are available."
+                      exit 0
+                    fi
                   fi
                 fi
               fi
             fi
 
+            echo "Published npm artifact not ready at stage: ${last_stage}."
             if [ "$attempt" -lt "$max_attempts" ]; then
               sleep "$retry_seconds"
             fi
           done
 
-          echo "Published npm artifact did not become retrievable after ${max_attempts} attempts."
+          echo "Published npm artifact did not become retrievable after ${max_attempts} attempts; last stage: ${last_stage}."
           cat "$registry_evidence" 2>/dev/null || true
           exit 1
 
-      - name: Finalize Changesets v3 tags and GitHub releases
-        if: hashFiles('.changeset/config.json') != ''
+  finalize:
+    needs:
+      - release
+      - verify-publication
+    if: needs.release.outputs.versioned == 'true' && needs.verify-publication.result == 'success'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Create the scoped release token
+        id: release-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ANKHORAGE_RENOVATE_SYNC_CLIENT_ID }}
+          private-key: ${{ secrets.ANKHORAGE_RENOVATE_SYNC_PRIVATE_KEY }}
+          owner: ankhorage
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+
+      - name: Checkout exact release commit
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.release.outputs.release_sha }}
+          token: ${{ steps.release-token.outputs.token }}
+
+      - name: Finalize Changesets v3 tag and GitHub release
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.release-token.outputs.token }}
+          PUBLISHED_PACKAGE_VERSION: ${{ needs.release.outputs.package_version }}
+          RELEASE_SHA: ${{ needs.release.outputs.release_sha }}
         run: |
-          git tag --points-at HEAD | while IFS= read -r tag; do
-            if [ -z "$tag" ]; then
-              continue
+          set -euo pipefail
+          tag="v${PUBLISHED_PACKAGE_VERSION}"
+          remote_sha="$(git ls-remote --tags origin "refs/tags/$tag" | cut -f1)"
+
+          if [ -n "$remote_sha" ]; then
+            if [ "$remote_sha" != "$RELEASE_SHA" ]; then
+              echo "Existing tag $tag points to $remote_sha, expected $RELEASE_SHA."
+              exit 1
             fi
+          else
+            git tag "$tag" "$RELEASE_SHA"
             git push origin "refs/tags/$tag"
-            if ! gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-              gh release create "$tag" --repo "$GITHUB_REPOSITORY" --generate-notes
-            fi
-          done
+          fi
+
+          if ! gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release create "$tag" --repo "$GITHUB_REPOSITORY" --generate-notes --target "$RELEASE_SHA"
+          fi
 
       - name: Create the scoped rollout token
         id: rollout-token
-        if: steps.release.outputs.versioned == 'true' && steps.release.outputs.package_name == '@ankhorage/devtools'
+        if: needs.release.outputs.package_name == '@ankhorage/devtools'
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.ANKHORAGE_RENOVATE_SYNC_CLIENT_ID }}
@@ -205,11 +276,11 @@ jobs:
           permission-contents: write
 
       - name: Trigger the Devtools consumer rollout
-        if: steps.release.outputs.versioned == 'true' && steps.release.outputs.package_name == '@ankhorage/devtools'
+        if: needs.release.outputs.package_name == '@ankhorage/devtools'
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
-          PUBLISHED_PACKAGE_NAME: ${{ steps.release.outputs.package_name }}
-          PUBLISHED_PACKAGE_VERSION: ${{ steps.release.outputs.package_version }}
+          PUBLISHED_PACKAGE_NAME: ${{ needs.release.outputs.package_name }}
+          PUBLISHED_PACKAGE_VERSION: ${{ needs.release.outputs.package_version }}
         with:
           github-token: ${{ steps.rollout-token.outputs.token }}
           script: |
@@ -230,7 +301,3 @@ jobs:
               event_type: 'devtools-release',
               client_payload: { version: release.version },
             });
-
-      - name: Skip release tooling
-        if: hashFiles('.changeset/config.json') == ''
-        run: echo "No Changesets config found; skipping versioning and publishing."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankhorage/devtools",
-  "version": "1.15.5",
+  "version": "1.15.7",
   "description": "Shared tooling, repository automation, runtime policies, and agent standards for Ankhorage TypeScript projects",
   "license": "MIT",
   "homepage": "https://github.com/ankhorage/devtools#readme",