pi-pr-review 1.10.4 → 1.10.5

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.10.5](https://github.com/10ego/pi-pr-review/compare/v1.10.4...v1.10.5) (2026-07-17)
+
+
+### Miscellaneous Chores
+
+* **release:** harden Node 24 automation ([#32](https://github.com/10ego/pi-pr-review/issues/32)) ([6b670b3](https://github.com/10ego/pi-pr-review/commit/6b670b3a1e33f3f2392027ae79c159afd9738690))
+
 ## [1.10.4](https://github.com/10ego/pi-pr-review/compare/v1.10.3...v1.10.4) (2026-07-15)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-pr-review",
-  "version": "1.10.4",
+  "version": "1.10.5",
   "description": "Parallel AI code review for GitHub pull requests in the Pi coding agent, with model-agnostic tiered subagents, structured findings, optional verification, and safe COMMENT-only publishing.",
   "keywords": [
     "pi-package",
@@ -30,9 +30,31 @@
     "type": "git",
     "url": "git+https://github.com/10ego/pi-pr-review.git"
   },
+  "homepage": "https://github.com/10ego/pi-pr-review#readme",
+  "bugs": {
+    "url": "https://github.com/10ego/pi-pr-review/issues"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "README.md",
+    "CHANGELOG.md",
+    "extensions/",
+    "lib/",
+    "prompts/"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/",
+    "provenance": true
+  },
   "scripts": {
     "test": "bun test",
-    "verify:release-version": "node scripts/verify-release-version.mjs"
+    "test:tooling": "node --test tests/tooling/compare-semver.node.mjs tests/tooling/package-contents.node.mjs tests/tooling/workflows.node.mjs",
+    "verify:release-version": "node scripts/verify-release-version.mjs",
+    "verify:package": "node scripts/verify-package-contents.mjs",
+    "verify:workflows": "node scripts/verify-workflows.mjs"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",

package/.github/workflows/pull-request.yml

@@ -1,55 +0,0 @@
-name: Pull Request
-
-on:
-  pull_request:
-    types:
-      - opened
-      - edited
-      - synchronize
-      - reopened
-      - ready_for_review
-
-permissions:
-  contents: read
-
-jobs:
-  title:
-    name: Validate PR title
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Check Conventional Commit format
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-        run: |
-          node <<'NODE'
-          const title = process.env.PR_TITLE ?? "";
-          const conventionalTitle = /^(feat|fix|perf|revert|docs|style|refactor|test|chore|release)(\([a-z0-9][a-z0-9._/-]*\))?!?: \S.*$/;
-
-          if (!conventionalTitle.test(title)) {
-            console.error(`Invalid PR title: ${title}`);
-            console.error("Use: <type>(optional-scope): description");
-            console.error("Allowed types: feat, fix, perf, revert, docs, style, refactor, test, chore, release");
-            console.error("Add ! before : for a breaking change, for example feat!: description");
-            process.exit(1);
-          }
-          NODE
-
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Verify release version metadata
-        run: npm run verify:release-version
-
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.2.15
-
-      - name: Run tests
-        run: bun test

package/.github/workflows/release-please.yml

@@ -1,105 +0,0 @@
-name: Release Please
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-concurrency:
-  group: release-please-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  release:
-    name: Create release PR or GitHub release
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-    outputs:
-      release_created: ${{ steps.release.outputs.release_created }}
-      release_version: ${{ steps.release.outputs.version }}
-    steps:
-      - name: Create nerv-ops installation token
-        id: app-token
-        uses: actions/create-github-app-token@v2
-        with:
-          app-id: ${{ vars.NERV_OPS_APP_ID }}
-          private-key: ${{ secrets.NERV_OPS_PRIVATE_KEY }}
-
-      - name: Run Release Please
-        id: release
-        uses: googleapis/release-please-action@v4
-        with:
-          config-file: release-please-config.json
-          manifest-file: .release-please-manifest.json
-          token: ${{ steps.app-token.outputs.token }}
-
-      - name: Enable squash auto-merge for release PRs
-        if: ${{ steps.release.outputs.prs_created == 'true' }}
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          RELEASE_PRS: ${{ steps.release.outputs.prs }}
-        run: |
-          jq -r '.[].number' <<< "$RELEASE_PRS" | while read -r number; do
-            merge_method="$(gh pr view "$number" --repo "$GITHUB_REPOSITORY" --json autoMergeRequest --jq '.autoMergeRequest.mergeMethod // "NONE"')"
-            echo "Release PR #$number auto-merge method: $merge_method"
-
-            case "$merge_method" in
-              SQUASH)
-                echo "Squash auto-merge is already enabled for release PR #$number"
-                continue
-                ;;
-              MERGE|REBASE)
-                echo "Replacing $merge_method auto-merge for release PR #$number"
-                gh pr merge "$number" --repo "$GITHUB_REPOSITORY" --disable-auto
-                ;;
-              NONE)
-                ;;
-              *)
-                echo "Unexpected auto-merge method for release PR #$number: $merge_method" >&2
-                exit 1
-                ;;
-            esac
-
-            gh pr merge "$number" --repo "$GITHUB_REPOSITORY" --auto --squash
-          done
-
-  publish:
-    name: Test and publish to npm
-    needs: release
-    if: ${{ needs.release.outputs.release_created == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - name: Check out release commit
-        uses: actions/checkout@v4
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          registry-url: https://registry.npmjs.org
-
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.2.15
-
-      - name: Install npm with trusted publishing support
-        run: npm install --global npm@11.5.1
-
-      - name: Test
-        run: bun test
-
-      - name: Verify release version metadata
-        env:
-          EXPECTED_VERSION: ${{ needs.release.outputs.release_version }}
-        run: npm run verify:release-version -- --expected "$EXPECTED_VERSION"
-
-      - name: Publish to npm
-        run: npm publish --access public --provenance

package/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "1.10.4"
-}

package/RELEASING.md

@@ -1,29 +0,0 @@
-# Releasing
-
-[Release Please](https://github.com/googleapis/release-please) watches conventional commits merged into `main`. It opens or updates a release PR containing the calculated version change, `CHANGELOG.md`, and release manifest, then enables squash auto-merge for that PR. Required checks must pass before GitHub merges it. Its root Node strategy is the sole version writer: the generated PR keeps `package.json` and `.release-please-manifest.json` in sync. The generated PR title—and therefore its squash commit—uses `release(main): release <version>`. The merge creates a GitHub release and, after the test suite passes, publishes `pi-pr-review` to npm with signed provenance.
-
-Pull-request CI verifies both root version fields remain equal. The publish job repeats that read-only check against the version emitted by Release Please, so an inconsistent release commit cannot publish; no feature PR should manually set a release version.
-
-## Semver
-
-The squash-merged PR title becomes the commit Release Please evaluates:
-
-- `feat: ...` creates a minor release.
-- `feat!: ...`, `fix!: ...`, or a `BREAKING CHANGE:` footer creates a major release.
-- Every other allowed type—`fix:`, `perf:`, `revert:`, `chore:`, `docs:`, `refactor:`, `style:`, and `test:`—creates a patch release.
-
-All changes to `main` must go through a pull request and use squash merging. The required `Validate PR title` check enforces the conventional title, and the required `Test` check runs the Bun test suite. Direct pushes, force pushes, branch deletion, and administrator bypass are disabled.
-
-## One-time setup
-
-1. Install the private [`nerv-ops`](https://github.com/settings/apps/nerv-ops) GitHub App on this repository with **Contents: read and write** and **Pull requests: read and write** permissions.
-2. Under the repository's **Settings → General → Pull Requests**, enable **Allow auto-merge** and keep squash merging enabled.
-3. Add the App ID as the repository Actions variable `NERV_OPS_APP_ID`, and add a generated PEM private key as the repository Actions secret `NERV_OPS_PRIVATE_KEY`.
-4. In the npm settings for [`pi-pr-review`](https://www.npmjs.com/package/pi-pr-review), add a GitHub Actions trusted publisher with:
-   - organization/user: `10ego`
-   - repository: `pi-pr-review`
-   - workflow filename: `release-please.yml`
-   - environment: leave blank
-5. Use conventional titles for squash-merged PRs.
-
-No npm token is stored in GitHub. The workflow exchanges the App credentials for a short-lived repository installation token and uses npm trusted publishing through GitHub OIDC.

package/release-please-config.json

@@ -1,24 +0,0 @@
-{
-  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
-  "bootstrap-sha": "b9b62811aab72269b5f2bbb58d08d37b3c20ecff",
-  "packages": {
-    ".": {
-      "release-type": "node",
-      "package-name": "pi-pr-review",
-      "changelog-path": "CHANGELOG.md",
-      "pull-request-title-pattern": "release${scope}: release${component} ${version}",
-      "include-component-in-tag": false,
-      "changelog-sections": [
-        { "type": "feat", "section": "Features", "hidden": false },
-        { "type": "fix", "section": "Bug Fixes", "hidden": false },
-        { "type": "perf", "section": "Performance Improvements", "hidden": false },
-        { "type": "revert", "section": "Reverts", "hidden": false },
-        { "type": "docs", "section": "Documentation", "hidden": false },
-        { "type": "style", "section": "Styles", "hidden": false },
-        { "type": "refactor", "section": "Code Refactoring", "hidden": false },
-        { "type": "test", "section": "Tests", "hidden": false },
-        { "type": "chore", "section": "Miscellaneous Chores", "hidden": false }
-      ]
-    }
-  }
-}

package/scripts/verify-release-version.mjs

@@ -1,66 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { pathToFileURL } from "node:url";
-
-// SemVer numeric prerelease identifiers cannot contain leading zeroes.
-const NUMERIC_IDENTIFIER = "(?:0|[1-9]\\d*)";
-const PRERELEASE_IDENTIFIER = `(?:${NUMERIC_IDENTIFIER}|\\d*[A-Za-z-][0-9A-Za-z-]*)`;
-const SEMVER = new RegExp(`^${NUMERIC_IDENTIFIER}\\.${NUMERIC_IDENTIFIER}\\.${NUMERIC_IDENTIFIER}(?:-${PRERELEASE_IDENTIFIER}(?:\\.${PRERELEASE_IDENTIFIER})*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$`);
-
-function readJson(filePath) {
-	try {
-		return JSON.parse(fs.readFileSync(filePath, "utf8"));
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		throw new Error(`Could not read ${filePath}: ${message}`);
-	}
-}
-
-function assertVersion(location, value) {
-	if (typeof value !== "string" || !SEMVER.test(value)) {
-		throw new Error(`${location} must contain a valid semantic version; received ${JSON.stringify(value)}`);
-	}
-}
-
-/**
- * Verify the root package metadata that Release Please updates in one release PR.
- * This deliberately reads only: Release Please remains the sole version writer.
- */
-export function verifyRootReleaseVersion(rootDir = process.cwd(), expectedVersion) {
-	const manifest = readJson(path.join(rootDir, ".release-please-manifest.json"));
-	const packageJson = readJson(path.join(rootDir, "package.json"));
-	const versions = {
-		'.release-please-manifest.json["."]': manifest["."],
-		"package.json.version": packageJson.version,
-	};
-
-	for (const [location, version] of Object.entries(versions)) assertVersion(location, version);
-	if (expectedVersion !== undefined) assertVersion("expected release version", expectedVersion);
-
-	const [firstLocation, firstVersion] = Object.entries(versions)[0];
-	for (const [location, version] of Object.entries(versions).slice(1)) {
-		if (version !== firstVersion) {
-			throw new Error(`Root release version mismatch: ${firstLocation} is ${firstVersion}, but ${location} is ${version}`);
-		}
-	}
-	if (expectedVersion !== undefined && firstVersion !== expectedVersion) {
-		throw new Error(`Root release version mismatch: ${firstLocation} is ${firstVersion}, but expected release version is ${expectedVersion}`);
-	}
-	return firstVersion;
-}
-
-function main(args) {
-	if (args.length === 0) return verifyRootReleaseVersion();
-	if (args.length === 2 && args[0] === "--expected") return verifyRootReleaseVersion(process.cwd(), args[1]);
-	throw new Error("Usage: node scripts/verify-release-version.mjs [--expected <version>]");
-}
-
-if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
-	try {
-		const version = main(process.argv.slice(2));
-		console.log(`Verified root release version ${version}.`);
-	} catch (error) {
-		console.error(error instanceof Error ? error.message : String(error));
-		process.exitCode = 1;
-	}
-}

package/tests/pr-review-concurrency.test.ts

@@ -1,45 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { runWithConcurrency } from "../lib/pr-review-concurrency.ts";
-
-async function waitFor(condition: () => boolean): Promise<void> {
-	for (let attempts = 0; attempts < 50; attempts++) {
-		if (condition()) return;
-		await Promise.resolve();
-	}
-	throw new Error("condition was not reached");
-}
-
-describe("bounded review-pass scheduling", () => {
-	test("starts independent workers in parallel without exceeding the concurrency cap", async () => {
-		const started: number[] = [];
-		const releases = new Map<number, () => void>();
-		let active = 0;
-		let peakActive = 0;
-
-		const batch = runWithConcurrency([0, 1, 2, 3], 2, async (item) => {
-			started.push(item);
-			active++;
-			peakActive = Math.max(peakActive, active);
-			await new Promise<void>((resolve) => releases.set(item, resolve));
-			active--;
-			return item * 10;
-		});
-
-		expect(started).toEqual([0, 1]);
-		expect(peakActive).toBe(2);
-
-		releases.get(0)!();
-		await waitFor(() => started.length === 3);
-		expect(started).toEqual([0, 1, 2]);
-		expect(active).toBe(2);
-
-		releases.get(1)!();
-		await waitFor(() => started.length === 4);
-		expect(started).toEqual([0, 1, 2, 3]);
-		expect(peakActive).toBe(2);
-
-		releases.get(2)!();
-		releases.get(3)!();
-		expect(await batch).toEqual([0, 10, 20, 30]);
-	});
-});

package/tests/pr-review-context.test.ts

@@ -1,66 +0,0 @@
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { afterEach, describe, expect, test } from "bun:test";
-import { loadReviewContext, shardUnifiedDiff } from "../lib/pr-review-context.ts";
-
-const roots: string[] = [];
-afterEach(() => {
-	for (const root of roots.splice(0)) fs.rmSync(root, { recursive: true, force: true });
-});
-
-function fixture(): string {
-	const root = fs.mkdtempSync(path.join(os.tmpdir(), "pr-review-context-test-"));
-	roots.push(root);
-	return root;
-}
-
-describe("unified diff sharding", () => {
-	test("keeps file blocks whole and covers each block exactly once", () => {
-		const diff = [
-			"diff --git a/a.ts b/a.ts\n--- a/a.ts\n+++ b/a.ts\n@@ -1 +1 @@\n-old\n+new",
-			"diff --git a/b.ts b/b.ts\n--- a/b.ts\n+++ b/b.ts\n@@ -1 +1,3 @@\n-old\n+one\n+two\n+three",
-			"diff --git a/c.ts b/c.ts\n--- a/c.ts\n+++ b/c.ts\n@@ -1 +1 @@\n-old\n+new",
-		].join("\n");
-		const shards = shardUnifiedDiff(diff, 3);
-		expect(shards).toHaveLength(3);
-		for (const path of ["a.ts", "b.ts", "c.ts"]) {
-			expect(shards.filter((shard) => shard.includes(`a/${path} b/${path}`))).toHaveLength(1);
-		}
-	});
-
-	test("does not invent empty shards for a single changed file", () => {
-		const diff = "diff --git a/a.ts b/a.ts\n--- a/a.ts\n+++ b/a.ts\n@@ -1 +1 @@\n-old\n+new";
-		expect(shardUnifiedDiff(diff, 2)).toEqual([diff]);
-	});
-});
-
-describe("review context files", () => {
-	test("appends a relative complete diff to compact inline metadata", async () => {
-		const root = fixture();
-		fs.writeFileSync(path.join(root, "pr.diff"), "diff --git a/a.ts b/a.ts\n+added\n");
-		const loaded = await loadReviewContext(root, "PR #7 metadata", "pr.diff");
-		expect(loaded.context).toContain("PR #7 metadata");
-		expect(loaded.context).toContain("--- Complete PR diff from context_file ---");
-		expect(loaded.context).toContain("diff --git a/a.ts b/a.ts");
-		expect(loaded.contextFile).toBe(path.join(root, "pr.diff"));
-		expect(loaded.contextFileText).toContain("diff --git a/a.ts b/a.ts");
-		expect(loaded.contextFileBytes).toBeGreaterThan(0);
-	});
-
-	test("preserves inline-only compatibility", async () => {
-		expect(await loadReviewContext("/tmp", "  inline diff  ", undefined)).toEqual({
-			context: "inline diff",
-			contextFileBytes: 0,
-		});
-	});
-
-	test("rejects empty, non-file, and oversized inputs before dispatch", async () => {
-		const root = fixture();
-		fs.writeFileSync(path.join(root, "empty.diff"), "");
-		fs.writeFileSync(path.join(root, "large.diff"), "12345");
-		await expect(loadReviewContext(root, undefined, "empty.diff")).rejects.toThrow("is empty");
-		await expect(loadReviewContext(root, undefined, ".")).rejects.toThrow("not a regular file");
-		await expect(loadReviewContext(root, undefined, "large.diff", 4)).rejects.toThrow("exceeds 4 bytes");
-	});
-});