From 4518f272b28e1c726f1bab3dec12e554f0016b42 Mon Sep 17 00:00:00 2001 From: Devin Foley Date: Fri, 19 Jun 2026 19:11:20 -0700 Subject: [PATCH] fix(release): publish all remaining @paperclipai workspace packages from CI + guard unpublishable edges (#8365) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work, distributed primarily via the `paperclipai` npm package and its `@paperclipai/*` workspace packages. > - The release subsystem (`scripts/release-package-*`) decides which workspace packages CI republishes at the unified calver version each release, and `replaceWorkspaceDeps()` rewrites every internal `workspace:` dependency to that calver version at publish time. > - The gap: a package that publishes from CI can declare a `workspace:` dependency on a package that is NOT enrolled for CI publish. The dependency spec gets rewritten to a calver version that is never actually published, so the dependent becomes uninstallable. > - This shipped for real: a recent change made `@paperclipai/server` depend on `@paperclipai/skills-catalog`, but skills-catalog was not on the calver release train — so canary builds after that merge failed to resolve `@paperclipai/skills-catalog@` and `npx paperclipai@canary run` broke. > - This PR addresses it durably by (a) putting every remaining internal package on the CI release train so no internal dependency can dangle, and (b) adding a fail-fast guard so this class of break can never ship again. > - The benefit is that canary and stable installs resolve all internal dependencies, and any future unpublishable workspace edge fails the release build with a clear, named error instead of producing a broken package. ## Linked Issues or Issue Description Refs #8327 (introduced the `server -> skills-catalog` runtime dependency that surfaced the gap). No public issue tracks this; describing it in-PR: - **Problem:** After #8327, `npx paperclipai@canary run` failed for builds past the merge because `@paperclipai/skills-catalog` was rewritten to a calver version that was never published (the package was not enrolled for CI publish). Versions before the merge still ran. - **Root cause:** A `publishFromCi:true` package can declare a `workspace:` dependency on a package that is not `publishFromCi:true`; the release-time version rewrite then points at a non-existent published version. ## What Changed - Enrolled every remaining internal package on the calver release train by setting `publishFromCi: true` in `scripts/release-package-manifest.json`: `skills-catalog`, `teams-catalog`, `plugin-workspace-diff`, `plugin-kubernetes`, `plugin-novita-sandbox`. There are now zero `publishFromCi:false` entries. - `skills-catalog`, `teams-catalog`, `plugin-workspace-diff` already existed on npm — CI simply republishes them at calver. - `plugin-kubernetes` and `plugin-novita-sandbox` were not on npm; their one-time first publish was bootstrapped so the `check-release-package-bootstrap` gate passes. - Added `findUnpublishableWorkspaceEdges()` to `scripts/release-package-map.mjs`, wired into `buildReleasePackagePlan()`. The release map build now fails fast (surfaced by the `check` CI already runs) whenever a `publishFromCi:true` package declares a runtime `workspace:` dependency (`dependencies`/`optionalDependencies`/`peerDependencies`) on a non-`publishFromCi:true` `@paperclipai/*` package, naming the offending edge. - Added tests covering positive/negative detection, all three dependency sections, unknown-package edges, off-train edges, and the live manifest. ## Verification - `node --test scripts/release-package-map.test.mjs` → 9/9 pass (includes a test asserting the live manifest has no unpublishable edges). - `node scripts/check-release-package-bootstrap.mjs scripts/release-package-manifest.json` → passes, naming all five newly-enabled packages (all confirmed present on npm). - Confirmed via `npm view` that all five packages resolve on the public registry. ## Risks - Low risk. The change only enrolls already-existing (or freshly-bootstrapped) packages onto the existing release train and adds a build-time validation. No runtime code paths change. The new guard can only *fail* a release that was already going to ship a broken package. ## Model Used Claude Opus 4.7 (claude-opus-4-7), extended thinking, with tool use / code execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots (N/A — no UI changes) - [x] I have updated relevant documentation to reflect my changes (N/A — no doc-facing behavior change) - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [ ] I will address all Greptile and reviewer comments before requesting merge --- .github/scripts/check-pr-test-coverage.mjs | 4 +- .../tests/check-pr-test-coverage.test.mjs | 8 ++ scripts/release-package-manifest.json | 10 +-- scripts/release-package-map.mjs | 45 +++++++++++ scripts/release-package-map.test.mjs | 80 +++++++++++++++++++ 5 files changed, 140 insertions(+), 7 deletions(-) diff --git a/.github/scripts/check-pr-test-coverage.mjs b/.github/scripts/check-pr-test-coverage.mjs index 27731dd7..f57ac725 100644 --- a/.github/scripts/check-pr-test-coverage.mjs +++ b/.github/scripts/check-pr-test-coverage.mjs @@ -9,8 +9,8 @@ import { fileURLToPath } from 'node:url'; const TEST_PATTERNS = [ - /\.test\.(ts|js|tsx|jsx)$/, - /\.spec\.(ts|js|tsx|jsx)$/, + /\.test\.(ts|js|tsx|jsx|mjs|cjs)$/, + /\.spec\.(ts|js|tsx|jsx|mjs|cjs)$/, /(?:^|\/)tests?\//, /\/__tests__\//, ]; diff --git a/.github/scripts/tests/check-pr-test-coverage.test.mjs b/.github/scripts/tests/check-pr-test-coverage.test.mjs index a76a71b2..b211cd14 100644 --- a/.github/scripts/tests/check-pr-test-coverage.test.mjs +++ b/.github/scripts/tests/check-pr-test-coverage.test.mjs @@ -15,6 +15,14 @@ test('passes when .spec.js file is changed', () => { assert.equal(checkTestCoverage(makeFiles(['src/bar.spec.js']), 'fix: bug').passed, true); }); +test('passes when .test.mjs file is changed', () => { + assert.equal(checkTestCoverage(makeFiles(['scripts/foo.test.mjs', 'scripts/foo.mjs']), 'fix: bug').passed, true); +}); + +test('passes when .test.cjs file is changed', () => { + assert.equal(checkTestCoverage(makeFiles(['scripts/bar.test.cjs']), 'fix: bug').passed, true); +}); + test('passes when file under tests/ is changed', () => { assert.equal(checkTestCoverage(makeFiles(['tests/unit/baz.ts']), 'fix: bug').passed, true); }); diff --git a/scripts/release-package-manifest.json b/scripts/release-package-manifest.json index 66e53e16..9f851297 100644 --- a/scripts/release-package-manifest.json +++ b/scripts/release-package-manifest.json @@ -62,12 +62,12 @@ { "dir": "packages/skills-catalog", "name": "@paperclipai/skills-catalog", - "publishFromCi": false + "publishFromCi": true }, { "dir": "packages/teams-catalog", "name": "@paperclipai/teams-catalog", - "publishFromCi": false + "publishFromCi": true }, { "dir": "packages/db", @@ -82,7 +82,7 @@ { "dir": "packages/plugins/plugin-workspace-diff", "name": "@paperclipai/plugin-workspace-diff", - "publishFromCi": false + "publishFromCi": true }, { "dir": "server", @@ -132,12 +132,12 @@ { "dir": "packages/plugins/sandbox-providers/kubernetes", "name": "@paperclipai/plugin-kubernetes", - "publishFromCi": false + "publishFromCi": true }, { "dir": "packages/plugins/sandbox-providers/novita", "name": "@paperclipai/plugin-novita-sandbox", - "publishFromCi": false + "publishFromCi": true }, { "dir": "ui", diff --git a/scripts/release-package-map.mjs b/scripts/release-package-map.mjs index a990b88e..12ed0124 100644 --- a/scripts/release-package-map.mjs +++ b/scripts/release-package-map.mjs @@ -79,6 +79,45 @@ function loadReleaseManifest() { }); } +// Sections whose @paperclipai workspace deps are rewritten to the calver release +// version by replaceWorkspaceDeps() and that consumers resolve at install time. +const RESOLVED_DEP_SECTIONS = ["dependencies", "optionalDependencies", "peerDependencies"]; + +// A publishFromCi:true package gets republished at the unified calver version every +// release, and every @paperclipai/* workspace: dep it declares is rewritten to that +// same calver version. If the target is NOT publishFromCi:true it never gets a calver +// publish, so the rewritten spec points at a version that will never exist on npm and +// the package becomes uninstallable. Detect those edges so the release fails fast +// instead of shipping a broken canary (e.g. server -> skills-catalog from #8327). +function findUnpublishableWorkspaceEdges(packages) { + const publishFromCiByName = new Map(packages.map((pkg) => [pkg.name, pkg.publishFromCi])); + const problems = []; + + for (const pkg of packages) { + if (!pkg.publishFromCi) continue; + + for (const section of RESOLVED_DEP_SECTIONS) { + const deps = pkg.pkg[section]; + if (!deps) continue; + + for (const [depName, spec] of Object.entries(deps)) { + if (!depName.startsWith("@paperclipai/")) continue; + if (typeof spec !== "string" || !spec.startsWith("workspace:")) continue; + if (publishFromCiByName.get(depName) === true) continue; + + problems.push( + `${pkg.name} (${pkg.dir}) is publishFromCi:true but declares a "${section}" workspace dependency on ${depName}, ` + + `which is not publishFromCi:true. The release version rewrite would point ${depName} at the calver version, ` + + `but that version is never published, so installs of ${pkg.name} would fail to resolve. ` + + `Enable publishFromCi for ${depName} (bootstrap its first npm publish if needed) or drop the workspace dependency.`, + ); + } + } + } + + return problems; +} + function buildReleasePackagePlan() { const discoveredPackages = discoverPublicPackages(); const manifestEntries = loadReleaseManifest(); @@ -124,6 +163,11 @@ function buildReleasePackagePlan() { publishFromCi: manifestByDir.get(pkg.dir).publishFromCi, })); + const edgeProblems = findUnpublishableWorkspaceEdges(packages); + if (edgeProblems.length > 0) { + throw new Error(`release package manifest validation failed:\n- ${edgeProblems.join("\n- ")}`); + } + return packages; } @@ -280,6 +324,7 @@ export { buildReleasePackagePlan, checkConfiguration, discoverPublicPackages, + findUnpublishableWorkspaceEdges, getReleasePackages, loadReleaseManifest, }; diff --git a/scripts/release-package-map.test.mjs b/scripts/release-package-map.test.mjs index 704dd3dd..b632b92e 100644 --- a/scripts/release-package-map.test.mjs +++ b/scripts/release-package-map.test.mjs @@ -4,9 +4,14 @@ import test from "node:test"; import { buildReleasePackagePlan, checkConfiguration, + findUnpublishableWorkspaceEdges, getReleasePackages, } from "./release-package-map.mjs"; +function pkg(name, { publishFromCi, ...deps } = {}) { + return { name, dir: name, publishFromCi, pkg: { name, ...deps } }; +} + test("release package manifest covers all public packages with explicit CI enrollment", () => { const packages = buildReleasePackagePlan(); assert.ok(packages.length > 0); @@ -22,3 +27,78 @@ test("release package list only contains CI-enrolled packages", () => { test("release package configuration validates successfully", () => { assert.doesNotThrow(() => checkConfiguration()); }); + +test("guard flags a publishFromCi:true package depending on a publishFromCi:false package", () => { + const problems = findUnpublishableWorkspaceEdges([ + pkg("@paperclipai/server", { + publishFromCi: true, + dependencies: { "@paperclipai/skills-catalog": "workspace:*" }, + }), + pkg("@paperclipai/skills-catalog", { publishFromCi: false }), + ]); + + assert.equal(problems.length, 1); + assert.match(problems[0], /@paperclipai\/server/); + assert.match(problems[0], /@paperclipai\/skills-catalog/); +}); + +test("guard inspects optional and peer dependency sections too", () => { + const problems = findUnpublishableWorkspaceEdges([ + pkg("@paperclipai/server", { + publishFromCi: true, + optionalDependencies: { "@paperclipai/opt": "workspace:^" }, + peerDependencies: { "@paperclipai/peer": "workspace:*" }, + }), + pkg("@paperclipai/opt", { publishFromCi: false }), + pkg("@paperclipai/peer", { publishFromCi: false }), + ]); + + assert.equal(problems.length, 2); +}); + +test("guard treats a workspace dep on an unknown @paperclipai package as unpublishable", () => { + const problems = findUnpublishableWorkspaceEdges([ + pkg("@paperclipai/server", { + publishFromCi: true, + dependencies: { "@paperclipai/private-internal": "workspace:*" }, + }), + ]); + + assert.equal(problems.length, 1); +}); + +test("guard allows true->true workspace edges", () => { + const problems = findUnpublishableWorkspaceEdges([ + pkg("@paperclipai/server", { + publishFromCi: true, + dependencies: { "@paperclipai/shared": "workspace:*" }, + }), + pkg("@paperclipai/shared", { publishFromCi: true }), + ]); + + assert.deepEqual(problems, []); +}); + +test("guard ignores non-workspace specs, non-internal deps, and edges from off-train packages", () => { + const problems = findUnpublishableWorkspaceEdges([ + pkg("@paperclipai/server", { + publishFromCi: true, + dependencies: { + "@paperclipai/pinned": "0.3.1", + zod: "^3.0.0", + }, + }), + pkg("@paperclipai/pinned", { publishFromCi: false }), + pkg("@paperclipai/offtrain", { + publishFromCi: false, + dependencies: { "@paperclipai/also-off": "workspace:*" }, + }), + pkg("@paperclipai/also-off", { publishFromCi: false }), + ]); + + assert.deepEqual(problems, []); +}); + +test("the live release manifest has no unpublishable workspace edges", () => { + assert.deepEqual(findUnpublishableWorkspaceEdges(buildReleasePackagePlan()), []); +});