Skip to content

chore(release): unblock 5.3.0 — version lockstep sync + npm-publish chaining #804

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Pedrovaleriolopez merged 1 commit into from
Jul 11, 2026
Merged

chore(release): unblock 5.3.0 — version lockstep sync + npm-publish chaining #804

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .aiox-core/install-manifest.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@
# - SHA256 hashes for change detection
# - File types for categorization
#
version: 5.2.9
generated_at: "2026-07-10T16:41:41.241Z"
version: 5.3.0
generated_at: "2026-07-11T16:43:33.419Z"
generator: scripts/generate-install-manifest.js
file_count: 1164
files:
Expand Down Expand Up @@ -3837,7 +3837,7 @@ files:
type: monitor
size: 818
- path: package.json
hash: sha256:d8dbe037240a366d545ca4259d2059e705b709706dcf2a18a5a52d9b543b7ed9
hash: sha256:b9b72ceb7aff3d535f0fbd573eb0f1e37872b115cf91ac5fae17188fea115a2c
type: other
size: 1445
- path: product/checklists/accessibility-wcag-checklist.md
Expand Down
2 changes: 1 addition & 1 deletion .aiox-core/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@aiox-squads/core-internal",
"version": "5.2.9",
"version": "5.3.0",
"description": "Internal package manifest for AIOX framework — declares runtime dependencies consumed by scripts under .aiox-core/. This is NOT published independently; it ships inside @aiox-squads/core (the top-level package). Kept name-distinct from the parent (`-internal` suffix) to avoid npm registry confusion. Version follows the parent package.",
"private": true,
"main": "index.js",
Expand Down
16 changes: 16 additions & 0 deletions .github/workflows/semantic-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ permissions:
issues: write
pull-requests: write
id-token: write
actions: write # chain npm-publish.yml via workflow_dispatch (legacy wrapper + workspace packages)

jobs:
# Release job - CI validation handled by branch protection rules
Expand Down Expand Up @@ -172,6 +173,21 @@ jobs:
npx semantic-release
fi

- name: Chain npm-publish (legacy wrapper + workspace packages)
if: inputs.dry_run != true
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
# The tag/release created by semantic-release uses GITHUB_TOKEN, which does
# NOT trigger npm-publish.yml's push/release triggers (GitHub Actions
# anti-recursion). workflow_dispatch via API is the documented exception —
# same pattern release.yml relies on in its trigger-npm-publish job.
# npm-publish.yml is idempotent (should_publish skips versions already in
# the registry), so dispatching after a no-release run is a safe no-op.
gh workflow run npm-publish.yml --ref main -f publish_mode=stable -f packages=all
echo "✅ npm-publish.yml dispatched (stable, all packages)"
echo "### 🔗 Chained npm-publish.yml (stable, all)" >> $GITHUB_STEP_SUMMARY

Comment on lines +176 to +190

@coderabbitai coderabbitai Bot Jul 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Inspect npm-publish.yml for how it resolves package versions to publish,
# and check for any commit/push step in this workflow that might persist
# the lockstep-synced manifests.
fd -H npm-publish.yml .github
cat .github/workflows/npm-publish.yml 2>/dev/null | rg -n -B2 -A5 'version|package\.json|ref'
rg -n 'git (add|commit|push)|`@semantic-release/git`' .github/workflows/semantic-release.yml .releaserc.json

Repository: SynkraAI/aiox-core

Length of output: 13729

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== semantic-release workflow around the chained dispatch =="
sed -n '1,260p' .github/workflows/semantic-release.yml | cat -n | sed -n '1,240p'

echo
echo "== releaserc =="
sed -n '1,220p' .releaserc.json | cat -n | sed -n '1,220p'

echo
echo "== lockstep sync script =="
sed -n '1,240p' scripts/sync-version-lockstep.js | cat -n | sed -n '1,240p'

Repository: SynkraAI/aiox-core

Length of output: 14867

Persist the lockstep manifests before dispatching npm-publish.yml
.github/workflows/semantic-release.yml:176-187 dispatches npm-publish.yml --ref main, but scripts/sync-version-lockstep.js only updates .aiox-core/package.json and compat/aiox-core/package.json in the semantic-release job’s working tree. The chained workflow checks out committed main and reads those package manifests directly, so future releases will publish against stale legacy versions unless the synced files are committed/pushed first or the publish workflow re-runs the sync itself.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/semantic-release.yml around lines 176 - 190, Before the
npm-publish dispatch in the semantic-release workflow, persist the version
changes produced by scripts/sync-version-lockstep.js by committing and pushing
the updated .aiox-core/package.json and compat/aiox-core/package.json to main.
Ensure the push completes before gh workflow run npm-publish.yml executes, while
preserving the existing dry-run guard and dispatch behavior.

- name: Release Summary
if: success()
run: |
Expand Down
3 changes: 3 additions & 0 deletions .releaserc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,9 @@
["@semantic-release/npm", {
"npmPublish": true
}],
["@semantic-release/exec", {
"prepareCmd": "node scripts/sync-version-lockstep.js ${nextRelease.version}"
}],
"@semantic-release/github"
]
}
4 changes: 2 additions & 2 deletions compat/aiox-core/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "aiox-core",
"version": "5.2.9",
"version": "5.3.0",
"description": "Compatibility wrapper for @aiox-squads/core.",
"license": "MIT",
"bin": {
Expand All @@ -15,7 +15,7 @@
"README.md"
],
"dependencies": {
"@aiox-squads/core": "5.2.9"
"@aiox-squads/core": "5.3.0"
},
"engines": {
"node": ">=18"
Expand Down
219 changes: 217 additions & 2 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 2 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@aiox-squads/core",
"version": "5.2.9",
"version": "5.3.0",
"description": "Synkra AIOX: AI-Orchestrated System for Full Stack Development - Core Framework",
"bin": {
"aiox": "bin/aiox.js",
Expand Down Expand Up @@ -171,6 +171,7 @@
},
"devDependencies": {
"@semantic-release/changelog": "^6.0.3",
"@semantic-release/exec": "^7.1.0",
"@semantic-release/git": "^10.0.1",
"@types/jest": "^30.0.0",
"@typescript-eslint/eslint-plugin": "^8.46.2",
Expand Down
Loading
Loading