@nanobpm/nano-workforce 0.178.1 → 0.178.3

package/.github/workflows/release.yml

@@ -7,6 +7,16 @@ on:
   workflow_run:
     workflows: ["CI", "Whole-repo invariants (merge-skew guard)"]
     types: [completed]
+  # Manual escape hatch. The automatic path above depends on the post-merge
+  # `push:main` event that normally follows a merge-queue landing. That event can
+  # go MISSING when an out-of-band bypass push to `main` (a `chore(release)
+  # [skip ci]` commit from the release App) races the queue's merge — the merged
+  # commit then lands with only its `merge_group` run and no `push` run, so the
+  # `workflow_run` trigger never sees `event == 'push'` and the release wedges
+  # with no way to retrigger. Dispatching runs the SAME green-gate against
+  # `main`'s HEAD (the merge_group checks are attached to that commit), so a
+  # manual recovery still never ships from a red `main`.
+  workflow_dispatch:
 
 # Prevent overlapping releases from racing on the same branch.
 concurrency:
@@ -26,9 +36,10 @@ jobs:
     name: release gate
     runs-on: ubuntu-latest
     if: >-
-      github.event.workflow_run.event == 'push' &&
-      github.event.workflow_run.head_branch == 'main' &&
-      github.event.workflow_run.conclusion == 'success'
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.event == 'push' &&
+       github.event.workflow_run.head_branch == 'main' &&
+       github.event.workflow_run.conclusion == 'success')
     permissions:
       checks: read
       contents: read
@@ -39,7 +50,7 @@ jobs:
         id: gate
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SHA: ${{ github.event.workflow_run.head_sha }}
+          SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
@@ -78,7 +89,7 @@ jobs:
       # done with the release App token below — it is the ruleset bypass actor. The
       # job's own GITHUB_TOKEN only needs OIDC for npm Trusted Publishing.
       contents: read
-      id-token: write # OIDC token for npm Trusted Publishing (no NPM_TOKEN)
+      id-token: write # OIDC for npm Trusted Publishing + provenance (the only auth path)
     steps:
       # Mint a short-lived token for the dedicated release GitHub App. This App is
       # the ruleset's bypass actor, so @semantic-release/git can push the version
@@ -96,7 +107,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.workflow_run.head_sha }} # release the exact gated commit
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }} # release the exact gated commit
           fetch-depth: 0 # semantic-release needs full history + tags
           persist-credentials: true # let @semantic-release/git push the release commit
           token: ${{ steps.app-token.outputs.token }} # push as the bypass-actor App
@@ -129,8 +140,63 @@ jobs:
         run: npm ci
 
       - name: Release
+        id: release
+        # OIDC Trusted Publishing is the ONLY automated auth path: npm has retired
+        # automation tokens that bypass 2FA, so there is no CI token fallback — it is
+        # OIDC or a human `npm publish` locally. OIDC is intermittently flaky, though:
+        # npm has returned `401 … Failed to generate Web Auth URLs … token is invalid`
+        # mid-publish. @semantic-release/git pushes the tag + release commit in the
+        # `prepare` step BEFORE @semantic-release/npm `publish`, so an OIDC publish
+        # failure orphans a git tag with no npm package (the v0.178.3 phantom).
+        # Don't fail the job here — let the OIDC publish-retry step below recover it.
+        continue-on-error: true
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} # bypass-actor App token
-          # No NPM_TOKEN / NODE_AUTH_TOKEN: publishing uses OIDC Trusted Publishing.
+          # No NPM_TOKEN / NODE_AUTH_TOKEN: publishing is OIDC Trusted Publishing only.
           NPM_CONFIG_PROVENANCE: "true"
         run: npx semantic-release
+
+      # Recovery: if the OIDC publish 401s, semantic-release has already bumped
+      # package.json + pushed the tag/release commit, but npm never got the tarball.
+      # The failure is INTERMITTENT (a prior version published fine), so retry the
+      # OIDC publish of the just-prepared version a few times with backoff — still no
+      # token, still OIDC + provenance via the job's id-token. This step is a NO-OP
+      # when the release step succeeded or when the version is already on npm, so it
+      # can never double-publish. If OIDC stays down through every retry, fail loudly:
+      # a human must `npm publish` the pushed tag locally (npm login with 2FA, then
+      # `git checkout vX.Y.Z && npm ci && npm publish --provenance --access public`).
+      - name: Retry OIDC publish if the release publish failed
+        if: steps.release.outcome == 'failure'
+        env:
+          NPM_CONFIG_PROVENANCE: "true"
+          GH_TOKEN: ${{ steps.app-token.outputs.token }} # to create the skipped GitHub Release
+        run: |
+          set -uo pipefail
+          PKG="$(node -p "require('./package.json').name")"
+          VERSION="$(node -p "require('./package.json').version")"
+          if npm view "${PKG}@${VERSION}" version >/dev/null 2>&1; then
+            echo "${PKG}@${VERSION} is already on npm — nothing to recover."
+            exit 0
+          fi
+          echo "semantic-release prepared + tagged ${PKG}@${VERSION} but the OIDC publish failed; retrying."
+          published=false
+          for attempt in 1 2 3; do
+            echo "OIDC publish attempt ${attempt}/3 for ${PKG}@${VERSION}"
+            if npm publish --provenance --access public; then
+              echo "Published ${PKG}@${VERSION} on retry ${attempt}."
+              published=true
+              break
+            fi
+            sleep $((attempt * 30))
+          done
+          if [ "$published" != true ]; then
+            echo "::error::OIDC publish of ${PKG}@${VERSION} still failing after retries. The git tag v${VERSION} is pushed but npm has no tarball. Publish it locally: 'git fetch --tags && git checkout v${VERSION} && npm ci && npm publish --provenance --access public' (npm login with 2FA first)."
+            exit 1
+          fi
+          # semantic-release aborts before @semantic-release/github when the npm
+          # publish throws, so the GitHub Release was never created — create it now.
+          if ! gh release view "v${VERSION}" >/dev/null 2>&1; then
+            echo "Creating the GitHub Release skipped by the aborted semantic-release run."
+            gh release create "v${VERSION}" --verify-tag --generate-notes --title "v${VERSION}" || \
+              echo "::warning::Published to npm but failed to create GitHub Release v${VERSION}; create it manually."
+          fi

package/.github/workflows/renovate.yml

@@ -3,17 +3,18 @@ name: Renovate
 # Self-hosted Renovate (issue #406). renovate.json declares the policy — auto-merge
 # non-major @nanobpm/* updates once CI is green, majors need a human — but nothing was
 # ever running it, so the config sat dormant and nwf stayed pinned to old @nanobpm/urban.
-# This workflow IS the runner: on a schedule (and on demand) it opens update PRs and, on a
-# later pass once the PR's CI is green, merges the automerge ones itself. We self-host via
-# GitHub Actions rather than the Mend hosted app so the whole capability is in-repo and
-# reproducible, with no external app-install state to drift.
+# This workflow IS the runner: on a schedule (and on demand) it opens update PRs and enables
+# GitHub-native auto-merge on the automerge ones, which ENQUEUES them into main's merge queue so
+# they land when the queue's speculative checks pass. We self-host via GitHub Actions rather than
+# the Mend hosted app so the whole capability is in-repo and reproducible, with no external
+# app-install state to drift.
 on:
   schedule:
-    # Every 3 hours. Renovate needs to run periodically not just to DISCOVER new versions,
-    # but to COME BACK and merge automerge PRs: renovate.json sets platformAutomerge:false
-    # (main is unprotected, so GitHub-native auto-merge is unavailable), which means Renovate
-    # performs the merge itself on a subsequent run once the PR's branch status is green.
-    # A few-hourly cadence keeps that merge latency low without burning Actions minutes.
+    # Every 3 hours. Renovate needs to run periodically to DISCOVER new versions and open/refresh
+    # update PRs. Once main went behind a merge queue, Renovate no longer self-merges; it enables
+    # GitHub-native auto-merge (platformAutomerge:true) which enqueues the PR, and the queue lands it
+    # when its checks pass. A few-hourly cadence keeps discovery latency low without burning Actions
+    # minutes.
     - cron: "0 */3 * * *"
   # On-demand runs for immediate pickup (e.g. right after a new urban publishes) and for
   # debugging with a raised log level.

package/CHANGELOG.md

@@ -1,3 +1,20 @@
+## [0.178.3](https://github.com/nanobpm/nano-workforce/compare/v0.178.2...v0.178.3) (2026-09-03)
+
+### Bug Fixes
+
+* **ci:** add manual workflow_dispatch escape hatch to the release pipeline ([#723](https://github.com/nanobpm/nano-workforce/issues/723)) ([4d06f25](https://github.com/nanobpm/nano-workforce/commit/4d06f259aee7a5689844ddd0dfe3f68253c9fc37))
+* **ci:** retry OIDC publish when the release publish 401s; reclaim v0.178.3 ([#722](https://github.com/nanobpm/nano-workforce/issues/722)) ([208c02d](https://github.com/nanobpm/nano-workforce/commit/208c02dd1936c70635a5108887f452143a8dbc26))
+
+### Documentation
+
+* refresh stale --version pin example in the upgrade guide ([#721](https://github.com/nanobpm/nano-workforce/issues/721)) ([75dbcec](https://github.com/nanobpm/nano-workforce/commit/75dbcecc93b4adef3bb4d6a05f6010ed44ea74dd))
+
+## [0.178.2](https://github.com/nanobpm/nano-workforce/compare/v0.178.1...v0.178.2) (2026-09-03)
+
+### Bug Fixes
+
+* **ci:** enqueue Renovate @nanobpm/* automerge via the merge queue ([#720](https://github.com/nanobpm/nano-workforce/issues/720)) ([a788c3c](https://github.com/nanobpm/nano-workforce/commit/a788c3cc664ee7324c0706bf5182d180b8a17c0e)), closes [#421](https://github.com/nanobpm/nano-workforce/issues/421)
+
 ## [0.178.1](https://github.com/nanobpm/nano-workforce/compare/v0.178.0...v0.178.1) (2026-09-03)
 
 ### Bug Fixes

package/README.md

@@ -185,7 +185,7 @@ and runs the review-ready poller.
 ```sh
 npm run upgrade                              # dry-run against @latest
 npm run upgrade -- --apply                   # apply the overlay, preserving app.db
-npm run upgrade -- --version 0.26.0 --apply  # pin a specific version
+npm run upgrade -- --version 0.178.2 --apply  # pin a specific version
 npm run upgrade -- --from ./pkg.tgz --apply  # from a local tarball (offline)
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.178.1",
+  "version": "0.178.3",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -64,7 +64,7 @@
     "lint:fix": "biome check --write app operations workers pages components scripts e2e main.ts"
   },
   "dependencies": {
-    "@nanobpm/agentic": "^0.11.0",
+    "@nanobpm/agentic": "^0.12.0",
     "@nanobpm/urban": "^0.90.0",
     "bpmn-auto-layout": "^2.0.0-alpha.2"
   },

package/renovate.json

@@ -3,11 +3,11 @@
   "extends": ["config:recommended"],
   "packageRules": [
     {
-      "description": "Auto-merge non-major @nanobpm/* updates once CI is green. These are first-party packages we publish from nano-ide; CI (typecheck + test) is the gate. For 0.x pins a caret range locks the minor, so Renovate's range bump is what actually pulls a new minor through; automerging it keeps nwf on the latest urban without manual PRs. platformAutomerge is off because main is unprotected, so Renovate waits for its own green branch status before merging.",
+      "description": "Auto-merge non-major @nanobpm/* updates once CI is green. These are first-party packages we publish from nano-ide; CI (typecheck + test) is the gate. For 0.x pins a caret range locks the minor, so Renovate's range bump is what actually pulls a new minor through; automerging it keeps nwf on the latest agentic/urban without manual PRs. platformAutomerge is ON because main is now protected by an active ruleset with a GitHub merge queue (merge_queue rule): a direct self-merge is rejected by the queue, so Renovate must enable GitHub-native auto-merge, which ENQUEUES the PR and lets it land when the queue's speculative checks pass. (Historically this was false when main was unprotected; leaving it false silently wedged green update PRs open — e.g. the agentic 0.11->0.12 bump sat unmerged for weeks.)",
       "matchPackageNames": ["/^@nanobpm//"],
       "matchUpdateTypes": ["minor", "patch"],
       "automerge": true,
-      "platformAutomerge": false
+      "platformAutomerge": true
     },
     {
       "description": "Major @nanobpm/* updates may be breaking - require a human to review and merge.",