@ic-reactor/mcp 0.0.0-stage → 0.0.0

package/scripts/release-tag.test.mjs

@@ -0,0 +1,278 @@
+/**
+ * Tests of the release lane's version rules (scripts/release-tag.mjs): what
+ * release.yml publishes for a tag, and what scripts/release.js accepts.
+ *
+ * A stable 4.x version goes to `latest` and takes the GitHub "Latest" badge, a
+ * 4.x prerelease goes to `beta` and never to `latest`, and every other tag
+ * (3.x, 5.x, not semver) is refused. release.yml is read to check that it
+ * runs on 4.x tags and publishes with what release-tag.mjs decided, from the
+ * npm-release environment. release.js is run from a copy of
+ * scripts/ in a temporary repository, so a refusal that failed to stop it
+ * could only bump the copy's manifests.
+ *
+ * Run by `pnpm test:scripts`.
+ */
+import assert from "node:assert/strict"
+import { spawnSync } from "node:child_process"
+import {
+  cpSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs"
+import { tmpdir } from "node:os"
+import { dirname, join } from "node:path"
+import { after, describe, it } from "node:test"
+import { fileURLToPath } from "node:url"
+import { RELEASE_MAJOR, releaseFor } from "./release-tag.mjs"
+
+const scriptsDir = dirname(fileURLToPath(import.meta.url))
+
+const temps = []
+after(() => {
+  for (const dir of temps) rmSync(dir, { recursive: true, force: true })
+})
+
+describe("releaseFor", () => {
+  it("releases 4.x only", () => {
+    assert.equal(RELEASE_MAJOR, 4)
+  })
+
+  for (const tag of ["v4.0.0", "4.0.0", "v4.1.0", "v4.12.3"]) {
+    it(`publishes the stable ${tag} under latest, as the latest release`, () => {
+      assert.deepEqual(releaseFor(tag), {
+        version: tag.replace(/^v/, ""),
+        prerelease: false,
+        distTag: "latest",
+        makeLatest: true,
+      })
+    })
+  }
+
+  for (const tag of [
+    "v4.0.0-beta.2",
+    "4.0.0-rc.0",
+    "v4.1.0-alpha.1",
+    "v4.0.1-next",
+  ]) {
+    it(`publishes the prerelease ${tag} under beta, never latest`, () => {
+      const release = releaseFor(tag)
+      assert.equal(release.prerelease, true)
+      assert.equal(release.distTag, "beta")
+      assert.equal(release.makeLatest, false)
+    })
+  }
+
+  for (const tag of [
+    "v3.13.1",
+    "v3.0.0-beta.1",
+    "v5.0.0",
+    "v0.15.2",
+    "v40.0.0",
+  ]) {
+    it(`refuses ${tag}, which is not 4.x`, () => {
+      assert.throws(() => releaseFor(tag), /is not a 4\.x version/)
+    })
+  }
+
+  for (const tag of [
+    "",
+    undefined,
+    "v4",
+    "v4.0",
+    "4.0.0.0",
+    "v4.0.0+build.1",
+    "4.0.0-01",
+    "v4.0.0-",
+    "tools-v4.0.0",
+    "v4.0.0 ",
+  ]) {
+    it(`refuses ${JSON.stringify(tag)}, which is not a release version`, () => {
+      assert.throws(() => releaseFor(tag), /is not a release version/)
+    })
+  }
+})
+
+function runNode(args, cwd) {
+  return spawnSync(process.execPath, args, { cwd, encoding: "utf8" })
+}
+
+describe("release-tag.mjs as release.yml runs it", () => {
+  it("prints the GITHUB_OUTPUT lines of a stable tag", () => {
+    const result = runNode([join(scriptsDir, "release-tag.mjs"), "v4.0.0"])
+    assert.equal(result.status, 0, result.stderr)
+    assert.equal(
+      result.stdout,
+      "version=4.0.0\ndist_tag=latest\nprerelease=false\nmake_latest=true\n"
+    )
+  })
+
+  it("prints the GITHUB_OUTPUT lines of a prerelease tag", () => {
+    const result = runNode([
+      join(scriptsDir, "release-tag.mjs"),
+      "v4.0.0-beta.2",
+    ])
+    assert.equal(result.status, 0, result.stderr)
+    assert.equal(
+      result.stdout,
+      "version=4.0.0-beta.2\ndist_tag=beta\nprerelease=true\nmake_latest=false\n"
+    )
+  })
+
+  it("fails a 3.x tag with nothing on stdout", () => {
+    const result = runNode([join(scriptsDir, "release-tag.mjs"), "v3.13.1"])
+    assert.equal(result.status, 1)
+    assert.equal(result.stdout, "")
+    assert.match(result.stderr, /::error::v3\.13\.1 is not a 4\.x version/)
+  })
+})
+
+/**
+ * The workflow is read as text, a job at a time: the repository root has no
+ * YAML parser of its own, and these are the exact lines that must not drift.
+ */
+const workflow = readFileSync(
+  join(scriptsDir, "..", ".github", "workflows", "release.yml"),
+  "utf8"
+)
+
+function topLevel(key) {
+  const match = workflow.match(
+    new RegExp(`^${key}:\\n([\\s\\S]*?)(?=^\\S|(?![\\s\\S]))`, "m")
+  )
+  assert.ok(match, `release.yml has a top-level ${key}:`)
+  return match[1]
+}
+
+function job(name) {
+  const jobs = topLevel("jobs")
+  const match = jobs.match(
+    new RegExp(`^  ${name}:\\n([\\s\\S]*?)(?=^  [\\w-]+:\\n|(?![\\s\\S]))`, "m")
+  )
+  assert.ok(match, `release.yml has a ${name} job`)
+  return match[1]
+}
+
+const has = (text, line) => text.split("\n").some((l) => l.trim() === line)
+
+describe("release.yml as it uses release-tag.mjs", () => {
+  it("runs on 4.x tags only", () => {
+    const tags = [...topLevel("on").matchAll(/^\s+- (.+)$/gm)].map((m) => m[1])
+    assert.deepEqual(tags, ['"v4.*"'])
+  })
+
+  it("lets preflight check the tag against main and decide the dist-tag", () => {
+    const preflight = job("preflight")
+    assert.ok(
+      has(
+        preflight,
+        'if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then'
+      )
+    )
+    assert.ok(has(preflight, "id: tag"))
+    assert.ok(
+      has(
+        preflight,
+        'node scripts/release-tag.mjs "$GITHUB_REF_NAME" | tee -a "$GITHUB_OUTPUT"'
+      )
+    )
+    for (const output of ["dist_tag", "prerelease", "make_latest"]) {
+      assert.ok(
+        has(preflight, `${output}: \${{ steps.tag.outputs.${output} }}`),
+        output
+      )
+    }
+    // The v4 branch's "prereleases only" check would refuse every stable tag.
+    assert.doesNotMatch(preflight, /!= \*-\*/)
+  })
+
+  it("publishes under preflight's dist-tag, after CI and the approval", () => {
+    const publish = job("publish")
+    assert.ok(has(publish, "needs: [preflight, ci-passed, approve]"))
+    assert.ok(has(job("approve"), "needs: [preflight, ci-passed]"))
+    assert.ok(has(job("approve"), "environment: npm-publish"))
+    assert.ok(has(publish, "TAG: ${{ needs.preflight.outputs.dist_tag }}"))
+    assert.ok(
+      has(
+        publish,
+        'latest | beta) echo "Publishing under the $TAG dist-tag." ;;'
+      )
+    )
+    assert.ok(
+      has(publish, 'npm publish "$TARBALL" --access public --tag "$TAG"')
+    )
+    assert.equal(publish.match(/^\s*npm publish /gm).length, 1)
+    assert.doesNotMatch(publish, /!= \*-\*/)
+  })
+
+  it("publishes from the npm-release environment, which npm can require", () => {
+    assert.ok(has(job("publish"), "environment: npm-release"))
+  })
+
+  it("takes the GitHub Release's prerelease and Latest badge from preflight", () => {
+    const releaseNotes = job("release-notes")
+    assert.ok(
+      has(
+        releaseNotes,
+        "prerelease: ${{ needs.preflight.outputs.prerelease == 'true' }}"
+      )
+    )
+    assert.ok(
+      has(
+        releaseNotes,
+        "make_latest: ${{ needs.preflight.outputs.make_latest }}"
+      )
+    )
+  })
+
+  it("creates the GitHub Release only after every package has published", () => {
+    assert.ok(has(job("release-notes"), "needs: [preflight, publish]"))
+    assert.ok(!job("publish").includes("action-gh-release"))
+    assert.ok(!job("publish").includes("contents: write"))
+  })
+})
+
+describe("release.js", () => {
+  function repo() {
+    const root = mkdtempSync(join(tmpdir(), "release-js-"))
+    temps.push(root)
+    cpSync(scriptsDir, join(root, "scripts"), { recursive: true })
+    for (const pkg of ["core", "react", "vite-plugin"]) {
+      mkdirSync(join(root, "packages", pkg), { recursive: true })
+      writeFileSync(
+        join(root, "packages", pkg, "package.json"),
+        JSON.stringify({ name: `@ic-reactor/${pkg}`, version: "4.0.0-beta.2" })
+      )
+    }
+    writeFileSync(
+      join(root, "package.json"),
+      JSON.stringify({ name: "ic-reactor", version: "4.0.0-beta.2" })
+    )
+    return root
+  }
+
+  for (const version of ["3.13.1", "5.0.0", "4.0", "4.0.0+build.1"]) {
+    it(`refuses ${version} before it rewrites a manifest`, () => {
+      const root = repo()
+      const result = runNode(
+        [join(root, "scripts", "release.js"), version],
+        root
+      )
+      assert.equal(result.status, 1)
+      assert.match(
+        result.stderr,
+        new RegExp(
+          `Refusing ${version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}: `
+        )
+      )
+      for (const pkg of ["core", "react", "vite-plugin"]) {
+        const manifest = JSON.parse(
+          readFileSync(join(root, "packages", pkg, "package.json"), "utf8")
+        )
+        assert.equal(manifest.version, "4.0.0-beta.2")
+      }
+    })
+  }
+})

package/scripts/release-workflow.test.mjs

@@ -0,0 +1,98 @@
+/**
+ * Tests of what `.github/workflows/release.yml` hands to npm, which no
+ * workflow run checks before a release: the publish job runs only from a tag,
+ * after the npm-publish approval.
+ *
+ * Run by `pnpm test:scripts`.
+ */
+import assert from "node:assert/strict"
+import { readFileSync } from "node:fs"
+import { describe, it } from "node:test"
+import { LANE_PACKAGES } from "./release-tag.mjs"
+
+const workflow = readFileSync(
+  new URL("../.github/workflows/release.yml", import.meta.url),
+  "utf8"
+)
+
+/** Each `npm publish` argument, with a `"$VAR"` resolved to its assignments. */
+function publishedPaths(text) {
+  const paths = []
+  for (const [, arg] of text.matchAll(/\bnpm publish\s+(\S+)/g)) {
+    const variable = /^"?\$\{?(\w+)\}?"?$/.exec(arg)?.[1]
+    if (variable === undefined) {
+      paths.push(arg.replace(/^"|"$/g, ""))
+      continue
+    }
+    const assigned = [
+      ...text.matchAll(new RegExp(`\\b${variable}="([^"]*)"`, "g")),
+    ].map((match) => match[1])
+    assert.ok(assigned.length > 0, `npm publish names $${variable}, never set`)
+    paths.push(...assigned)
+  }
+  return paths
+}
+
+describe("release.yml's npm publish", () => {
+  it("publishes at least one tarball", () => {
+    assert.ok(publishedPaths(workflow).length > 0)
+  })
+
+  // npm reads `dir/file.tgz` as the GitHub repository `dir/file.tgz`, and
+  // the 4.0.0-beta.8 run failed on git ls-remote with nothing published. A
+  // path npm reads as a file starts with ./, ../ or /.
+  it("names every tarball by a path npm reads as a file", () => {
+    for (const path of publishedPaths(workflow)) {
+      assert.match(path, /^(?:\.\.?\/|\/)/, `${path} would be read as git`)
+    }
+  })
+
+  it("tells a repository shorthand from a file path", () => {
+    assert.deepEqual(
+      publishedPaths('T="tarballs/a.tgz"\nnpm publish "$T" --tag beta'),
+      ["tarballs/a.tgz"]
+    )
+    assert.deepEqual(publishedPaths("npm publish ./a.tgz"), ["./a.tgz"])
+  })
+})
+
+/**
+ * The words of each shell loop of `text` that runs over the packages: a
+ * `for <variable> in <words>; do` whose words name core, as `core` or
+ * `packages/core`.
+ */
+function packageLoops(text) {
+  return [...text.matchAll(/\bfor \w+ in ([^;\n]+); do/g)]
+    .map(([, words]) => words.trim().split(/\s+/))
+    .filter((words) => words.some((word) => /^(?:packages\/)?core$/.test(word)))
+}
+
+describe("release.yml's packages", () => {
+  // The publish job checks nothing out, so the workflow cannot read the lane
+  // from scripts/release-tag.mjs: it names the packages in four loops, and a
+  // package left out of one would be bumped by release.js and then never
+  // checked, packed or published.
+  it("names the lane of release-tag.mjs, in its order, in each of its four loops", () => {
+    const loops = packageLoops(workflow)
+    assert.equal(
+      loops.length,
+      4,
+      `loops over the packages: ${JSON.stringify(loops)}`
+    )
+    for (const words of loops) {
+      assert.deepEqual(
+        words.map((word) => word.replace(/^packages\//, "")),
+        [...LANE_PACKAGES]
+      )
+    }
+  })
+
+  it("finds a loop over the packages, and only such a loop", () => {
+    assert.deepEqual(
+      packageLoops(
+        "for workflow in ci.yml e2e.yml; do\nfor pkg in packages/core packages/react; do\nfor name in core; do"
+      ),
+      [["packages/core", "packages/react"], ["core"]]
+    )
+  })
+})

package/scripts/release.js

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync } from "fs"
+import { join, dirname } from "path"
+import { fileURLToPath } from "url"
+import { execFileSync } from "child_process"
+import {
+  AI_CONTEXT_FILES,
+  RUNTIME_PLUGIN_MANIFESTS,
+} from "./ai-context-files.js"
+import {
+  syncAiContextVersions,
+  syncPluginManifestVersions,
+} from "./sync-ai-context-versions.js"
+import { releasePrSteps } from "./lib/release-pr-steps.mjs"
+import { LANE_PACKAGES, releaseFor } from "./release-tag.mjs"
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const rootDir = join(__dirname, "..")
+
+// Get version from CLI arg
+const [requested, ...extraArgs] = process.argv.slice(2)
+
+if (!requested) {
+  console.error("Please provide a version: node scripts/release.js 4.0.0")
+  process.exit(1)
+}
+
+// The script used to take --dry-run and --publish. Refused before any file
+// changes: a release publishes only through release.yml, after its preflight
+// and the npm-publish approval, with provenance (#969).
+if (extraArgs.length > 0) {
+  console.error(
+    `Refusing ${extraArgs.join(" ")}: release.js takes only a version. It makes the release commit, and release.yml publishes from the tag on the release pull request's merge commit.`
+  )
+  process.exit(1)
+}
+
+// A 4.x version only, checked by the same rules as release.yml's preflight
+// (scripts/release-tag.mjs): a stable version publishes under `latest`, a
+// prerelease under `beta`. 3.x releases are made on the v3 branch.
+let release
+try {
+  release = releaseFor(requested)
+} catch (error) {
+  console.error(`Refusing ${requested}: ${error.message}`)
+  process.exit(1)
+}
+// Without a leading `v`: `v4.0.0` and `4.0.0` release the same version.
+const version = release.version
+
+function run(command, args, options = {}) {
+  execFileSync(command, args, { stdio: "inherit", cwd: rootDir, ...options })
+}
+
+function updatePackageJson(filePath, newVersion) {
+  try {
+    const fullPath = join(rootDir, filePath)
+    const pkg = JSON.parse(readFileSync(fullPath, "utf-8"))
+    pkg.version = newVersion
+    writeFileSync(fullPath, JSON.stringify(pkg, null, 2) + "\n")
+    console.log(`✅ Updated ${filePath} to ${newVersion}`)
+  } catch (err) {
+    console.error(`❌ Failed to update ${filePath}: ${err.message}`)
+    process.exit(1)
+  }
+}
+
+// The version being replaced. Captured before any file is rewritten so the
+// AI-context sync below can target exactly that string. The packages of
+// LANE_PACKAGES (core, react, vite-plugin and mcp) release in lockstep on this
+// line.
+const previousVersion = JSON.parse(
+  readFileSync(join(rootDir, "packages/core/package.json"), "utf-8")
+).version
+
+console.log(`\n🚀 Starting release process for v${version}...\n`)
+
+// 1. Update library versions
+updatePackageJson("package.json", version)
+for (const name of LANE_PACKAGES) {
+  updatePackageJson(`packages/${name}/package.json`, version)
+}
+
+// 2. Regenerate packages/core/src/version.ts from the bumped package.json.
+//    `version:sync` normally runs only as part of core's `build`, which a
+//    release never invokes, so without this the committed VERSION would keep
+//    reporting the previous release even though the path is staged below.
+console.log("\n🔢 Regenerating core version constant...")
+try {
+  run("pnpm", ["--filter", "@ic-reactor/core", "version:sync"])
+} catch (error) {
+  console.error("❌ Failed to regenerate packages/core/src/version.ts")
+  process.exit(1)
+}
+
+// 3. Sync every AI-context file the check:ai-context gate reads
+console.log("\n🧠 Syncing AI-context versions...")
+const syncedFiles = syncAiContextVersions(
+  rootDir,
+  previousVersion,
+  version,
+  LANE_PACKAGES.map((name) => `@ic-reactor/${name}`)
+)
+syncedFiles.forEach((f) => console.log(`✅ Synced ${f} to ${version}`))
+
+// The Claude Code plugin that installs the consumer skill carries the runtime
+// version; installed copies update only when it changes.
+syncPluginManifestVersions(rootDir, version).forEach((f) =>
+  console.log(`✅ Set ${f} to ${version}`)
+)
+
+// 4. Sync examples to literal version for the Git Commit (StackBlitz support)
+try {
+  console.log("\n📦 Syncing examples to literal version for StackBlitz...")
+  run("node", ["scripts/sync-example-versions.js", version])
+} catch (error) {
+  // An example the sync could not update keeps the previous release's ranges,
+  // and the commit below would ship them, so stop here as release-tools.js does.
+  console.error("❌ Failed to sync example versions.")
+  process.exit(1)
+}
+
+// 5. Update the lockfile LAST. Running it before the example sync leaves the
+//    lockfile describing the previous literal versions, and CI installs with
+//    --frozen-lockfile, so the release commit fails to install.
+console.log("\n🔗 Updating lockfile (pnpm install)...")
+try {
+  run("pnpm", ["install", "--no-frozen-lockfile"])
+} catch (error) {
+  console.error("❌ pnpm install failed.")
+  process.exit(1)
+}
+
+const RELEASE_PATHS = [
+  // Every file syncAiContextVersions() may rewrite; without them the bumps are
+  // left unstaged and check:ai-context fails on the released commit.
+  ...AI_CONTEXT_FILES,
+  ...RUNTIME_PLUGIN_MANIFESTS,
+  "package.json",
+  "pnpm-lock.yaml",
+  ...LANE_PACKAGES.map((name) => `packages/${name}/package.json`),
+  // Regenerated from package.json by core's `version:sync` at build time. It is
+  // committed, so without staging it here the repo keeps reporting the previous
+  // release's VERSION even though the published artifact is correct.
+  "packages/core/src/version.ts",
+  "examples",
+]
+
+// 6. Git commit. No tag: the release is tagged on the merge commit of its pull
+//    request, which is what release.yml publishes from.
+console.log("\n📂 Creating release commit...")
+try {
+  // `-u` stages modifications to already-tracked files only, so no untracked
+  // scratch file can be swept in -- `git add .` would have put one in the
+  // release, and in its packages, since core and react ship "src". It also
+  // keeps `examples` safe to pass as a directory: sync-example-versions.js only
+  // rewrites package.json files under it, at either workspace depth, but an
+  // untracked file sitting there must never ride along.
+  run("git", ["add", "-u", "--", ...RELEASE_PATHS])
+  run("git", ["commit", "-m", `chore: release v${version}`])
+} catch (error) {
+  console.error("❌ Git operations failed:", error.message)
+  process.exit(1)
+}
+
+console.log(`\n🎉 Prepared release v${version}.\n`)
+console.log(releasePrSteps(version))