pi-pr-review 1.6.4 → 1.6.5

package/.github/workflows/pull-request.yml

@@ -43,6 +43,9 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
+      - name: Verify release version metadata
+        run: npm run verify:release-version
+
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
         with:

package/.github/workflows/release-please.yml

@@ -19,6 +19,7 @@ jobs:
       contents: read
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
+      release_version: ${{ steps.release.outputs.version }}
     steps:
       - name: Create nerv-ops installation token
         id: app-token
@@ -65,5 +66,10 @@ jobs:
       - name: Test
         run: bun test
 
+      - name: Verify release version metadata
+        env:
+          EXPECTED_VERSION: ${{ needs.release.outputs.release_version }}
+        run: npm run verify:release-version -- --expected "$EXPECTED_VERSION"
+
       - name: Publish to npm
         run: npm publish --access public --provenance

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "1.6.4"
+  ".": "1.6.5"
 }

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.6.5](https://github.com/10ego/pi-pr-review/compare/v1.6.4...v1.6.5) (2026-07-13)
+
+
+### Bug Fixes
+
+* **release:** verify root version metadata ([#9](https://github.com/10ego/pi-pr-review/issues/9)) ([ce4e36f](https://github.com/10ego/pi-pr-review/commit/ce4e36f1d2c3aa11b60f5d37564d48a8783e192c))
+
 ## [1.6.4](https://github.com/10ego/pi-pr-review/compare/v1.6.3...v1.6.4) (2026-07-13)
 
 

package/RELEASING.md

@@ -1,6 +1,8 @@
 # Releasing
 
-[Release Please](https://github.com/googleapis/release-please) watches conventional commits merged into `main`. It opens or updates a release PR containing the calculated version change, `CHANGELOG.md`, and release manifest. The generated PR title—and therefore its squash commit—uses `release(main): release <version>`. Merging that release PR creates a GitHub release and, after the test suite passes, publishes `pi-pr-review` to npm with signed provenance.
+[Release Please](https://github.com/googleapis/release-please) watches conventional commits merged into `main`. It opens or updates a release PR containing the calculated version change, `CHANGELOG.md`, and release manifest. Its root Node strategy is the sole version writer: the generated PR keeps `package.json` and `.release-please-manifest.json` in sync. The generated PR title—and therefore its squash commit—uses `release(main): release <version>`. Merging that release PR creates a GitHub release and, after the test suite passes, publishes `pi-pr-review` to npm with signed provenance.
+
+Pull-request CI verifies both root version fields remain equal. The publish job repeats that read-only check against the version emitted by Release Please, so an inconsistent release commit cannot publish; no feature PR should manually set a release version.
 
 ## Semver
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-pr-review",
-  "version": "1.6.4",
+  "version": "1.6.5",
   "description": "Parallel AI code review for GitHub pull requests in the Pi coding agent, with model-agnostic tiered subagents, structured findings, optional verification, and safe COMMENT-only publishing.",
   "keywords": [
     "pi-package",
@@ -31,7 +31,8 @@
     "url": "git+https://github.com/10ego/pi-pr-review.git"
   },
   "scripts": {
-    "test": "bun test"
+    "test": "bun test",
+    "verify:release-version": "node scripts/verify-release-version.mjs"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",

package/scripts/verify-release-version.mjs

@@ -0,0 +1,66 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { pathToFileURL } from "node:url";
+
+// SemVer numeric prerelease identifiers cannot contain leading zeroes.
+const NUMERIC_IDENTIFIER = "(?:0|[1-9]\\d*)";
+const PRERELEASE_IDENTIFIER = `(?:${NUMERIC_IDENTIFIER}|\\d*[A-Za-z-][0-9A-Za-z-]*)`;
+const SEMVER = new RegExp(`^${NUMERIC_IDENTIFIER}\\.${NUMERIC_IDENTIFIER}\\.${NUMERIC_IDENTIFIER}(?:-${PRERELEASE_IDENTIFIER}(?:\\.${PRERELEASE_IDENTIFIER})*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$`);
+
+function readJson(filePath) {
+	try {
+		return JSON.parse(fs.readFileSync(filePath, "utf8"));
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		throw new Error(`Could not read ${filePath}: ${message}`);
+	}
+}
+
+function assertVersion(location, value) {
+	if (typeof value !== "string" || !SEMVER.test(value)) {
+		throw new Error(`${location} must contain a valid semantic version; received ${JSON.stringify(value)}`);
+	}
+}
+
+/**
+ * Verify the root package metadata that Release Please updates in one release PR.
+ * This deliberately reads only: Release Please remains the sole version writer.
+ */
+export function verifyRootReleaseVersion(rootDir = process.cwd(), expectedVersion) {
+	const manifest = readJson(path.join(rootDir, ".release-please-manifest.json"));
+	const packageJson = readJson(path.join(rootDir, "package.json"));
+	const versions = {
+		'.release-please-manifest.json["."]': manifest["."],
+		"package.json.version": packageJson.version,
+	};
+
+	for (const [location, version] of Object.entries(versions)) assertVersion(location, version);
+	if (expectedVersion !== undefined) assertVersion("expected release version", expectedVersion);
+
+	const [firstLocation, firstVersion] = Object.entries(versions)[0];
+	for (const [location, version] of Object.entries(versions).slice(1)) {
+		if (version !== firstVersion) {
+			throw new Error(`Root release version mismatch: ${firstLocation} is ${firstVersion}, but ${location} is ${version}`);
+		}
+	}
+	if (expectedVersion !== undefined && firstVersion !== expectedVersion) {
+		throw new Error(`Root release version mismatch: ${firstLocation} is ${firstVersion}, but expected release version is ${expectedVersion}`);
+	}
+	return firstVersion;
+}
+
+function main(args) {
+	if (args.length === 0) return verifyRootReleaseVersion();
+	if (args.length === 2 && args[0] === "--expected") return verifyRootReleaseVersion(process.cwd(), args[1]);
+	throw new Error("Usage: node scripts/verify-release-version.mjs [--expected <version>]");
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+	try {
+		const version = main(process.argv.slice(2));
+		console.log(`Verified root release version ${version}.`);
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : String(error));
+		process.exitCode = 1;
+	}
+}

package/tests/release-version.test.ts

@@ -0,0 +1,63 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { verifyRootReleaseVersion } from "../scripts/verify-release-version.mjs";
+
+type VersionFiles = {
+	manifest?: unknown;
+	packageJson?: unknown;
+};
+
+const tempDirs: string[] = [];
+
+function writeVersionFiles(versions: VersionFiles = {}): string {
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-pr-review-release-version-test-"));
+	tempDirs.push(dir);
+	fs.writeFileSync(path.join(dir, ".release-please-manifest.json"), JSON.stringify({ ".": versions.manifest ?? "1.2.3" }));
+	fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ version: versions.packageJson ?? "1.2.3" }));
+	return dir;
+}
+
+afterEach(() => {
+	for (const dir of tempDirs.splice(0)) fs.rmSync(dir, { recursive: true, force: true });
+});
+
+describe("root release-version invariant", () => {
+	test("accepts matching Release Please and npm metadata", () => {
+		expect(verifyRootReleaseVersion(writeVersionFiles())).toBe("1.2.3");
+		expect(verifyRootReleaseVersion(process.cwd())).toMatch(/^\d+\.\d+\.\d+$/);
+	});
+
+	for (const [location, versions] of [
+		["Release Please manifest", { manifest: "1.2.2" }],
+		["package manifest", { packageJson: "1.2.2" }],
+	] satisfies [string, VersionFiles][]) {
+		test(`rejects a stale ${location}`, () => {
+			expect(() => verifyRootReleaseVersion(writeVersionFiles(versions))).toThrow(/Root release version mismatch/);
+		});
+	}
+
+	test("rejects missing or malformed root versions", () => {
+		const missing = fs.mkdtempSync(path.join(os.tmpdir(), "pi-pr-review-release-version-test-"));
+		tempDirs.push(missing);
+		fs.writeFileSync(path.join(missing, ".release-please-manifest.json"), JSON.stringify({ ".": "1.2.3" }));
+		fs.writeFileSync(path.join(missing, "package.json"), JSON.stringify({}));
+		expect(() => verifyRootReleaseVersion(missing)).toThrow(/valid semantic version/);
+		expect(() => verifyRootReleaseVersion(writeVersionFiles({ packageJson: "not-a-version" }))).toThrow(/valid semantic version/);
+	});
+
+	test("rejects leading zeroes in numeric prerelease identifiers even when every field agrees", () => {
+		const invalidVersion = "1.2.3-01";
+		expect(() => verifyRootReleaseVersion(writeVersionFiles({
+			manifest: invalidVersion,
+			packageJson: invalidVersion,
+		}))).toThrow(/valid semantic version/);
+	});
+
+	test("binds publish verification to Release Please's emitted version", () => {
+		const dir = writeVersionFiles();
+		expect(verifyRootReleaseVersion(dir, "1.2.3")).toBe("1.2.3");
+		expect(() => verifyRootReleaseVersion(dir, "1.2.4")).toThrow(/expected release version/);
+	});
+});