Skip to content

gates: publish-check (deno publish --dry-run); release: JSR publish before the GH release - #116

Merged
lannbot merged 1 commit into
mainfrom
publish-check-gate
Aug 12, 2026
Merged

gates: publish-check (deno publish --dry-run); release: JSR publish before the GH release#116
lannbot merged 1 commit into
mainfrom
publish-check-gate

Conversation

@lannbot

@lannbot lannbot commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator

Fallout from the pre-3c8c0e9 release failure (run 31560192748).

publish-check — new required gate: deno publish --dry-run --allow-dirty (deps: shim). Covers the JSR publish checks (public-API type check, slow types, export/import analyzability, config validation) that no gate ran before — they only fired at publish time on main. Wired into just gates, gha::core, and the AGENTS.md gates block (which also gets the stale examples/test-translate lines restored). Bonus over the real publish: the dry run checks all five packages including protocol, which real publishes skip as already-published.

release.yml reorder — JSR publish now precedes GH release creation. The old order stranded a half-release behind the tag guard when JSR failed (release created, versions missing, re-runs no-op-by-failure). New order converges on re-run: tag guard passes while no release exists; deno publish skips already-published versions.

Not catchable pre-merge (for the record): the actual failure was JSR's default "actor must be a scope member" restriction — lannbot-armed auto-merges make the workflow actor lannbot (actorNotScopeMember). Fixed scope-side by disabling the restriction (publishing stays repo-linked and green-main-gated); documented in the release.yml step comment. The stranded pre-3c8c0e9 was repaired by delete + re-dispatch (run 31598707134, actor=lannbot, green — validating the setting change).

…efore the GH release

Fallout from the pre-3c8c0e9 release failure (run 31560192748):

- publish-check: new required gate running the JSR publish checks
  (public-API type check, slow types, export/import analyzability,
  config validation) with no upload. None of these were covered by
  gates before — they only fired at publish time on main. Wired into
  `just gates`, the core CI job, and the AGENTS.md gates block (also
  restoring the stale examples/test-translate lines there). Needs the
  shim: @deltic/translator statically imports translator_shim.wasm.
  --allow-dirty because pre-commit trees are dirty by definition.

- release.yml: publish to JSR before creating the GH release. The JSR
  step is the one most likely to fail, and the old order stranded a
  half-release behind the tag guard (GH release created, JSR versions
  missing, re-runs blocked). New order converges on re-run: the tag
  guard passes while no release exists, and deno publish skips
  already-published versions.

The actual pre-3c8c0e9 failure was not catchable by any gate: JSR's
default scope setting requires the workflow-triggering ACTOR to be a
scope member, and lannbot-armed auto-merges broke it
(actorNotScopeMember). Fixed scope-side (restriction disabled —
publishing stays repo-linked + green-main-gated); noted in the
release.yml step comment. Repaired by deleting the stranded release
and re-dispatching (run 31598707134, actor=lannbot, green).
@lannbot
lannbot enabled auto-merge August 12, 2026 13:08
@lannbot
lannbot merged commit 20565fd into main Aug 12, 2026
4 checks passed
@lannbot
lannbot deleted the publish-check-gate branch August 23, 2026 16:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants