Skip to content

fix(ci): release smoke resolves every workspace package - #28709

Open
only21mil wants to merge 1 commit into
pingdotgg:mainfrom
only21mil:fix/audit-m079
Open

only21mil wants to merge 1 commit into
pingdotgg:mainfrom
only21mil:fix/audit-m079

Conversation

@only21mil

Copy link
Copy Markdown
Contributor

Problem

Release Smoke checks lockfile resolution by copying the repo's manifests into a temp folder, deleting the lockfile and running vp install --lockfile-only. It copied a hand-kept list of manifests, and that list has drifted. evals and infra/task-cache are workspace packages with importers in pnpm-lock.yaml, but the smoke never copied them, so it never resolved them, and it still passed. Every new package also needs a second edit to that list, which is why #14693, #18694 and #24180 each add a line to it.

Change

The smoke now builds its fixture the way check:changed already does for its unused-patch check. Workspace manifests come from readWorkspace(), and mobile's file: module manifests come from apps/mobile/modules. The root manifest, workspace config, lockfile, apps/mobile/deps and patches are copied as before.

The smoke also compares the regenerated lockfile with the committed one and fails if any committed importer is missing. That uses pnpm's own output as the reference, so it also catches a workspace pattern readWorkspace() can't read, such as **.

Release behavior doesn't change. Only server, desktop, web and contracts get version bumps, and the updater manifest steps are untouched.

Scope and approval

This is a small, focused fix to a CI script, so it qualifies without a prior issue. #23988 lists it as an out-of-scope follow-up: "release-smoke's hard-coded workspace file list can drift from readWorkspace()."

The PRs that add a line to the list (#14693, #18694, #24180) would drop that line after this lands. #23700 edits a different part of the same file.

Verification

All runs used Node 26.12.1 and pnpm 12.14.0, the versions package.json pins, on Linux.

  • Base plus only the new importer check, node scripts/release-smoke.ts: fails with Release smoke did not resolve workspace packages: evals, infra/task-cache.
  • This branch: Release smoke checks passed. All 40 committed importers resolve, and the four release version targets are still bumped to 9.9.9-smoke.0.
  • New package: a temporary packages/release-smoke-probe with its lockfile importer, then removed. This branch passes and resolves it with no list edit. Base plus the check fails, naming evals, infra/task-cache, packages/release-smoke-probe.
  • vp run check:changed 82b10d546c1041d8eff40425f076d61f608d518f: format, lint, knip and typecheck pass.

Not checked:

  • The CI runner. Locally, pnpm resolved from cached registry metadata.
  • .pnpmfile.cjs. The smoke didn't copy it before and still doesn't; check:changed does. I left it out to keep this to one problem.
  • Native Windows or macOS. The smoke's updater-manifest steps only use YAML fixtures, and this change doesn't touch them.
  • UI. This is a CI script with no screen.

Prior PRs

Generated with Claude Opus 5.5 and GPT-6.1 Terra and GPT-6.1 Sol in T3 Code Nightly

Release smoke copied a hand-kept list of manifests into its lockfile
fixture. The list had drifted: evals and infra/task-cache were never
resolved, and each new package needed a second edit.

Build the fixture the way check:changed does: workspace manifests from
readWorkspace() and mobile's file: modules from their directory. The
smoke now fails when the regenerated lockfile lacks an importer the
committed lockfile has.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions github-actions Bot added vouch:unvouched PR author is not yet trusted in the VOUCHED list. size:M 30-99 changed lines (additions + deletions). labels Nov 1, 2026
@macroscopeapp

macroscopeapp Bot commented Nov 1, 2026

Copy link
Copy Markdown
Contributor

Approvability

Verdict: Approved at 39f99d5

Macroscope's review found this PR approvable — The release smoke now discovers workspace manifests automatically and checks that no committed lockfile importer is omitted. Changes are confined to temporary test fixtures and validation, without altering product defaults or release publishing.

You can add or adjust custom eligibility rules. Learn more.

@coderabbitai

coderabbitai Bot commented Nov 1, 2026

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review.

Recent review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between 80120b1 and 39f99d5.

Files selected for processing: 1
  • scripts/release-smoke.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The release smoke script now discovers workspace manifests dynamically. After regenerating a temporary lockfile, it checks that the lockfile contains every importer from the repository lockfile.

Changes: Release smoke checks

Layer / File(s) Summary
Discover workspace manifests
scripts/release-smoke.ts
The fixture manifest list now comes from workspace package directories and existing mobile module manifests instead of a fixed list.
Check regenerated lockfile importers
scripts/release-smoke.ts
A helper reads importer names from the lockfile’s top-level importers section. The smoke test reports any repository importers missing from the regenerated lockfile.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: yordis

Merge Risk: Minimal · up to 39f99

No actionable merge-blocking risk was identified.

Pre-merge checks: Passed 4
Check name Status Explanation
Title check Passed The title clearly and concisely describes the main change: updating CI release smoke checks to resolve every workspace package.
Description check Passed The description includes all required sections: Problem, Change, Scope and approval, and Verification. It explains the failure mode, implementation, scope rationale, test commands, observed results, a…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description includes all required sections: Problem, Change, Scope and approval, and Verification. It explains the failure mode, implementation, scope rationale, test commands, observed results, and limitations.

Finishing Touches
Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

@maria-rcks

Copy link
Copy Markdown
Collaborator

Note

Written by gpt-6.1-sol on behalf of Maria

Verified in a real dev environment

Verified the release-smoke script at exact head 39f99d599f46e2e267671200b6e0c92c94793419 against github/main at e925dd681904f8a1ead0502ecca3f65f5bc28146. Dependencies were installed with vp i; commands ran on Linux through blacksmith-check, using Node 24.22.2 and pnpm 12.14.0.

Ran the unchanged scripts/release-smoke.ts with an external observer that audits the generated lockfile immediately before temporary-directory cleanup:

main: Release smoke checks passed.
      expected=40 resolved=38 missing=[evals, infra/task-cache]
head: Release smoke checks passed.
      expected=40 resolved=40 missing=[]

Also temporarily added an importer without a workspace package, ran the script, and restored the lockfile. It correctly failed with Release smoke did not resolve workspace packages: packages/release-smoke-missing-probe.

The complete smoke run passed its six relay-state tests, four release-version assertions, nightly metadata assertions, and macOS/Windows updater-manifest checks, including Windows source cleanup and debug-manifest preservation. No source changes or pushes were needed.

Inspected command transcript

Not verified

This changes only a CI script. It has no app/client/provider path, so no dev server, browser interaction, or Codex turn was used as evidence. Native macOS/Windows updater execution and release publication were not exercised. The updater checks use the existing smoke-script YAML data.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:M 30-99 changed lines (additions + deletions). vouch:unvouched PR author is not yet trusted in the VOUCHED list.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants