@nanobpm/nano-workforce 0.178.2 → 0.178.3

package/.github/workflows/release.yml

@@ -7,6 +7,16 @@ on:
   workflow_run:
     workflows: ["CI", "Whole-repo invariants (merge-skew guard)"]
     types: [completed]
+  # Manual escape hatch. The automatic path above depends on the post-merge
+  # `push:main` event that normally follows a merge-queue landing. That event can
+  # go MISSING when an out-of-band bypass push to `main` (a `chore(release)
+  # [skip ci]` commit from the release App) races the queue's merge — the merged
+  # commit then lands with only its `merge_group` run and no `push` run, so the
+  # `workflow_run` trigger never sees `event == 'push'` and the release wedges
+  # with no way to retrigger. Dispatching runs the SAME green-gate against
+  # `main`'s HEAD (the merge_group checks are attached to that commit), so a
+  # manual recovery still never ships from a red `main`.
+  workflow_dispatch:
 
 # Prevent overlapping releases from racing on the same branch.
 concurrency:
@@ -26,9 +36,10 @@ jobs:
     name: release gate
     runs-on: ubuntu-latest
     if: >-
-      github.event.workflow_run.event == 'push' &&
-      github.event.workflow_run.head_branch == 'main' &&
-      github.event.workflow_run.conclusion == 'success'
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.event == 'push' &&
+       github.event.workflow_run.head_branch == 'main' &&
+       github.event.workflow_run.conclusion == 'success')
     permissions:
       checks: read
       contents: read
@@ -39,7 +50,7 @@ jobs:
         id: gate
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SHA: ${{ github.event.workflow_run.head_sha }}
+          SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
@@ -78,7 +89,7 @@ jobs:
       # done with the release App token below — it is the ruleset bypass actor. The
       # job's own GITHUB_TOKEN only needs OIDC for npm Trusted Publishing.
       contents: read
-      id-token: write # OIDC token for npm Trusted Publishing (no NPM_TOKEN)
+      id-token: write # OIDC for npm Trusted Publishing + provenance (the only auth path)
     steps:
       # Mint a short-lived token for the dedicated release GitHub App. This App is
       # the ruleset's bypass actor, so @semantic-release/git can push the version
@@ -96,7 +107,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.workflow_run.head_sha }} # release the exact gated commit
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }} # release the exact gated commit
           fetch-depth: 0 # semantic-release needs full history + tags
           persist-credentials: true # let @semantic-release/git push the release commit
           token: ${{ steps.app-token.outputs.token }} # push as the bypass-actor App
@@ -129,8 +140,63 @@ jobs:
         run: npm ci
 
       - name: Release
+        id: release
+        # OIDC Trusted Publishing is the ONLY automated auth path: npm has retired
+        # automation tokens that bypass 2FA, so there is no CI token fallback — it is
+        # OIDC or a human `npm publish` locally. OIDC is intermittently flaky, though:
+        # npm has returned `401 … Failed to generate Web Auth URLs … token is invalid`
+        # mid-publish. @semantic-release/git pushes the tag + release commit in the
+        # `prepare` step BEFORE @semantic-release/npm `publish`, so an OIDC publish
+        # failure orphans a git tag with no npm package (the v0.178.3 phantom).
+        # Don't fail the job here — let the OIDC publish-retry step below recover it.
+        continue-on-error: true
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} # bypass-actor App token
-          # No NPM_TOKEN / NODE_AUTH_TOKEN: publishing uses OIDC Trusted Publishing.
+          # No NPM_TOKEN / NODE_AUTH_TOKEN: publishing is OIDC Trusted Publishing only.
           NPM_CONFIG_PROVENANCE: "true"
         run: npx semantic-release
+
+      # Recovery: if the OIDC publish 401s, semantic-release has already bumped
+      # package.json + pushed the tag/release commit, but npm never got the tarball.
+      # The failure is INTERMITTENT (a prior version published fine), so retry the
+      # OIDC publish of the just-prepared version a few times with backoff — still no
+      # token, still OIDC + provenance via the job's id-token. This step is a NO-OP
+      # when the release step succeeded or when the version is already on npm, so it
+      # can never double-publish. If OIDC stays down through every retry, fail loudly:
+      # a human must `npm publish` the pushed tag locally (npm login with 2FA, then
+      # `git checkout vX.Y.Z && npm ci && npm publish --provenance --access public`).
+      - name: Retry OIDC publish if the release publish failed
+        if: steps.release.outcome == 'failure'
+        env:
+          NPM_CONFIG_PROVENANCE: "true"
+          GH_TOKEN: ${{ steps.app-token.outputs.token }} # to create the skipped GitHub Release
+        run: |
+          set -uo pipefail
+          PKG="$(node -p "require('./package.json').name")"
+          VERSION="$(node -p "require('./package.json').version")"
+          if npm view "${PKG}@${VERSION}" version >/dev/null 2>&1; then
+            echo "${PKG}@${VERSION} is already on npm — nothing to recover."
+            exit 0
+          fi
+          echo "semantic-release prepared + tagged ${PKG}@${VERSION} but the OIDC publish failed; retrying."
+          published=false
+          for attempt in 1 2 3; do
+            echo "OIDC publish attempt ${attempt}/3 for ${PKG}@${VERSION}"
+            if npm publish --provenance --access public; then
+              echo "Published ${PKG}@${VERSION} on retry ${attempt}."
+              published=true
+              break
+            fi
+            sleep $((attempt * 30))
+          done
+          if [ "$published" != true ]; then
+            echo "::error::OIDC publish of ${PKG}@${VERSION} still failing after retries. The git tag v${VERSION} is pushed but npm has no tarball. Publish it locally: 'git fetch --tags && git checkout v${VERSION} && npm ci && npm publish --provenance --access public' (npm login with 2FA first)."
+            exit 1
+          fi
+          # semantic-release aborts before @semantic-release/github when the npm
+          # publish throws, so the GitHub Release was never created — create it now.
+          if ! gh release view "v${VERSION}" >/dev/null 2>&1; then
+            echo "Creating the GitHub Release skipped by the aborted semantic-release run."
+            gh release create "v${VERSION}" --verify-tag --generate-notes --title "v${VERSION}" || \
+              echo "::warning::Published to npm but failed to create GitHub Release v${VERSION}; create it manually."
+          fi

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## [0.178.3](https://github.com/nanobpm/nano-workforce/compare/v0.178.2...v0.178.3) (2026-09-03)
+
+### Bug Fixes
+
+* **ci:** add manual workflow_dispatch escape hatch to the release pipeline ([#723](https://github.com/nanobpm/nano-workforce/issues/723)) ([4d06f25](https://github.com/nanobpm/nano-workforce/commit/4d06f259aee7a5689844ddd0dfe3f68253c9fc37))
+* **ci:** retry OIDC publish when the release publish 401s; reclaim v0.178.3 ([#722](https://github.com/nanobpm/nano-workforce/issues/722)) ([208c02d](https://github.com/nanobpm/nano-workforce/commit/208c02dd1936c70635a5108887f452143a8dbc26))
+
+### Documentation
+
+* refresh stale --version pin example in the upgrade guide ([#721](https://github.com/nanobpm/nano-workforce/issues/721)) ([75dbcec](https://github.com/nanobpm/nano-workforce/commit/75dbcecc93b4adef3bb4d6a05f6010ed44ea74dd))
+
 ## [0.178.2](https://github.com/nanobpm/nano-workforce/compare/v0.178.1...v0.178.2) (2026-09-03)
 
 ### Bug Fixes

package/README.md

@@ -185,7 +185,7 @@ and runs the review-ready poller.
 ```sh
 npm run upgrade                              # dry-run against @latest
 npm run upgrade -- --apply                   # apply the overlay, preserving app.db
-npm run upgrade -- --version 0.26.0 --apply  # pin a specific version
+npm run upgrade -- --version 0.178.2 --apply  # pin a specific version
 npm run upgrade -- --from ./pkg.tgz --apply  # from a local tarball (offline)
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.178.2",
+  "version": "0.178.3",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",