chore(skills): add release-widget skill by yordan-st · Pull Request #2370 · mendix/web-widgets

yordan-st · 2026-08-03T12:27:55Z

Summary

Adds `.agents/skills/release-widget/SKILL.md` — automates widget/module release pipeline (version bump → GitHub draft release → OSS clearance → Marketplace publish)
Previously ran as private trial (untracked); opening as draft for team feedback before promoting to shared skill set

Test plan

Used successfully for image-web v1.6.0 and charts-web v6.3.2 releases

r0b1n · 2026-09-07T13:37:19Z

+- **Running `rui-package-info` / `rui-bump-version` without `cd`-ing into the widget/module dir first** — they read `process.cwd()`, not a path argument.
+- **Treating `appNumber` presence via grep instead of reading the schema** — a module-wrapped widget's package.json simply omits the `marketplace.appNumber` key; check for `null`/undefined/`-1` via `rui-package-info`, don't grep for the string `"appNumber"` (unreliable — the field can exist with value `-1` too, which also means "not independently published").
+- **Publishing before the asset gate passes** — this is the exact mistake pattern that caused the 409 double-trigger risk. Never call `gh release edit --draft=false` without first confirming both MPK and READMEOSS assets are attached.
+- **Escalating a 409 without checking run history first** — many past "failures" are actually the second of two triggers for an already-successful publish. Always check `gh run list` history for the tag before treating a 409 as a real incident.


many past "failures" are actually the second of two triggers for an already-successful publish

How would this happen?

r0b1n · 2026-09-07T15:05:57Z

+
+Find the run matching this tag/branch.
+
+- `conclusion: success` → the workflow succeeded, but that only means the API call didn't error — it's not proof the version is live. There's no packaged helper to query the Marketplace programmatically (`createDraft`/`publishDraft` are write-only, no idempotency or read-back check), so confirm manually: ask the user to open Marketplace → package page → Manage Versions, and check `<version>` is listed. Don't declare the release done until they confirm.


There is marketplace-mcp that we can use for this.

r0b1n · 2026-09-08T13:13:28Z


 ```bash
 cd $RELEASE_PATH
 pnpm exec rui-bump-version <version>


Maybe we can use global pnpm exec rui-bump-version <npm-package-name> <version>. And this script should check if the package is releasable by its own, and should give an error if not. Bump should be from the containing package.

Possibly extracting changelogs can use the same principle, by package name. This gives less room for error. maybe the same guard for usage on releasable packages only

r0b1n · 2026-09-08T13:15:41Z

-        await bumpXml(path, version);
-    } catch {
-        xmlBumped = false; // modules have no package.xml
+    if (info.mxpackage.type === "module") {


Charts widgets is a widget but still has dependencies.

Automates widget/module release pipeline: version bump, GitHub draft release, OSS clearance SBOM, Marketplace publish. Sharing for team feedback before promoting out of private trial.

… CLI helpers

… helpers

…s in lockstep

…ling

…ment

r0b1n · 2026-09-08T15:28:22Z

    hasUnreleasedLogs(): boolean {
-        return this.changelog.content[0].sections.length !== 0;
+        const [unreleased] = this.changelog.content;
+        // Module changelogs usually carry their entries under subcomponents
+        // (per wrapped widget), with no module level sections at all.
+        return unreleased.sections.length !== 0 || unreleased.subcomponents.length !== 0;
    }


This never happens, subcomponents entries added during release. So it is never a case where there is an unreleased section with subcomponents.

r0b1n · 2026-09-08T15:37:38Z

+        const dependencyPath = await resolvePackagePath(dependencyName);
+
+        await bumpPackage(dependencyPath, version);
+        bumpedPackages.push(shortName(dependencyName));


Why do we strip @mendix here? If we get package name with @mendix, we should also return back the same format.

r0b1n · 2026-09-08T15:45:59Z

+}
+
+function resolveVersion(bumpType: string, previousVersion: string): string {
+    const version = getNewVersion(bumpType, previousVersion);


Looks like getNewVersion already does what Version class is capable of. We should use Version math instead of using manual math done in getNewVersion.

r0b1n · 2026-09-08T15:58:45Z

+
+`appName` is the Marketplace display name (e.g. `Maps`). The draft release is titled `<appName> v<version>`, which is what the OSS helpers match SBOM/READMEOSS filenames against — they derive it from the tag themselves.
+
+- `appNumber` is a positive number → **standalone release** (a widget, or a module published directly). Keep this `info`, Phase 2 and 3 reuse it — no re-fetching.


appNumber is not used in Phase 2 as far as I can tell.

r0b1n · 2026-09-08T16:01:23Z

+- `appNumber` is a positive number → **standalone release** (a widget, or a module published directly). Keep this `info`, Phase 2 and 3 reuse it — no re-fetching.
+- `appNumber` is `null`/absent/`-1` → widget is module-wrapped, not published on its own. Find the owning module:
+    ```bash
+    grep -l "\"@mendix/<widget>\"" packages/modules/*/package.json


Will fail for charts widget, this doesn't live in modules folder.

r0b1n · 2026-09-08T16:04:01Z

+
+```bash
+echo "== SBOM jar =="; ls "${SBOM_GENERATOR_JAR:-$HOME/SBOM_Generator.jar}" 2>&1
+echo "== rui helpers =="; pnpm exec which rui-package-info 2>&1 | tail -1


Why do we need to check for that?

r0b1n · 2026-09-08T16:05:50Z

+
+If the SBOM jar is missing, say what's missing and how to fix it (where to get `SBOM_Generator.jar`, or point `SBOM_GENERATOR_JAR` at it) — don't proceed past a missing prereq.
+
+If a helper doesn't resolve (`Command "rui-package-info" not found`), the bins aren't linked yet — `pnpm install` at the repo root, then re-check. Don't work around it by calling `ts-node bin/<helper>.ts` all run.


This is a misconfigured local setup, no need to check for it.

r0b1n · 2026-09-08T16:12:27Z

+It refuses to run and exits non-zero when:
+
+- `<npm-package-name>` isn't independently releasable (no positive `marketplace.appNumber`) — Phase 0 pointed at the wrong package, go back and recheck.
+- the argument is neither a bump type nor an `x.y.z` version.


We should not make it possible to pass bump type, only version in the first place.

yordan-st marked this pull request as ready for review August 4, 2026 09:30

yordan-st requested a review from a team as a code owner August 4, 2026 09:30

This comment has been minimized.

Sign in to view

r0b1n reviewed Aug 4, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

r0b1n reviewed Aug 4, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

yordan-st force-pushed the skill/release-widget branch 2 times, most recently from fbe06a0 to 7773a8b Compare August 21, 2026 13:57

github-actions Bot added the automation label Aug 21, 2026

This comment has been minimized.

Sign in to view

yordan-st force-pushed the skill/release-widget branch from 74a8e99 to cce0a0d Compare September 7, 2026 12:36

This comment has been minimized.

Sign in to view

r0b1n reviewed Sep 7, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

r0b1n reviewed Sep 7, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

r0b1n reviewed Sep 7, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

r0b1n reviewed Sep 7, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

r0b1n reviewed Sep 7, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

r0b1n reviewed Sep 7, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

r0b1n reviewed Sep 7, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

r0b1n reviewed Sep 7, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

r0b1n reviewed Sep 7, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

r0b1n reviewed Sep 7, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

r0b1n reviewed Sep 7, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

r0b1n reviewed Sep 7, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

r0b1n reviewed Sep 7, 2026

View reviewed changes

r0b1n reviewed Sep 8, 2026

View reviewed changes

Comment thread .agents/skills/release-widget/SKILL.md Outdated

This comment has been minimized.

Sign in to view

r0b1n reviewed Sep 8, 2026

View reviewed changes

chore(skills): add release-widget skill

d628af5

Automates widget/module release pipeline: version bump, GitHub draft release, OSS clearance SBOM, Marketplace publish. Sharing for team feedback before promoting out of private trial.

yordan-st added 5 commits September 8, 2026 15:33

refactor(automation-utils): extract release-widget skill scripts into…

adae4af

… CLI helpers

fix(skills): extract changelog read into rui-changelog CLI helper

83421ce

fix(release-widget): address all review feedback

e896d93

fix(release-widget): address remaining review feedback

fd2129d

fix(release-widget): derive release title inside OSS scripts

1ac50b0

yordan-st force-pushed the skill/release-widget branch from 50fbf1e to 1ac50b0 Compare September 8, 2026 13:34

This comment has been minimized.

Sign in to view

yordan-st added 8 commits September 8, 2026 16:41

feat(automation-utils): add package path resolution and releasability…

5850809

… helpers

fix(automation-utils): resolve releases by tag for drafts too

b7d006c

fix(automation-utils): count module subcomponent entries as unreleased

6b709d5

fix(automation-utils): validate version bumps and bump wrapped widget…

a6eb882

…s in lockstep

fix(automation-utils): name SBOM zip after the real MPK hash

3e2efd2

fix(automation-utils): report existing READMEOSS asset instead of fai…

1bf2eef

…ling

docs(automation-utils): correct rui-create-jira-version exit code com…

16ff628

…ment

docs(release-widget): align skill with helper behaviour and trim prose

48d9b8a

r0b1n reviewed Sep 8, 2026

View reviewed changes


		Find the run matching this tag/branch.

		- `conclusion: success` → the workflow succeeded, but that only means the API call didn't error — it's not proof the version is live. There's no packaged helper to query the Marketplace programmatically (`createDraft`/`publishDraft` are write-only, no idempotency or read-back check), so confirm manually: ask the user to open Marketplace → package page → Manage Versions, and check `<version>` is listed. Don't declare the release done until they confirm.


		`appName` is the Marketplace display name (e.g. `Maps`). The draft release is titled `<appName> v<version>`, which is what the OSS helpers match SBOM/READMEOSS filenames against — they derive it from the tag themselves.

		- `appNumber` is a positive number → standalone release (a widget, or a module published directly). Keep this `info`, Phase 2 and 3 reuse it — no re-fetching.


		If the SBOM jar is missing, say what's missing and how to fix it (where to get `SBOM_Generator.jar`, or point `SBOM_GENERATOR_JAR` at it) — don't proceed past a missing prereq.

		If a helper doesn't resolve (`Command "rui-package-info" not found`), the bins aren't linked yet — `pnpm install` at the repo root, then re-check. Don't work around it by calling `ts-node bin/<helper>.ts` all run.

Uh oh!

Conversation

yordan-st commented Aug 3, 2026

Summary

Test plan

Uh oh!

This comment has been minimized.

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants