Merge pull request #1057 from karrioapi/hotfix-2026.1.27

[patch] 2026.1.27

Author: danh91

.github/workflows/mcp-publish.yml

@@ -0,0 +1,47 @@
+name: mcp-publish
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to publish (e.g. 1.0.1) — must match package.json'
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
+    defaults:
+      run:
+        working-directory: packages/mcp
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: false
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+          registry-url: 'https://registry.npmjs.org'
+          cache: 'npm'
+          cache-dependency-path: package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Run unit tests before publish
+        run: npm run test:unit
+
+      - name: Publish to npm
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/tests.yml

@@ -17,6 +17,9 @@ name: karrio-tests
 
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   sdk-tests:
     runs-on: ubuntu-latest
@@ -189,3 +192,35 @@ jobs:
         run: |
           npm ci
           npm run build -w apps/dashboard
+
+  mcp-ci:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: false
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+          cache: 'npm'
+          cache-dependency-path: package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        working-directory: packages/mcp
+        run: npx tsc --noEmit
+
+      - name: Run unit tests
+        working-directory: packages/mcp
+        run: npm run test:unit
+
+      # Integration tests are skipped in CI — they require a live Karrio API instance.
+      # Run locally with: npm run test:integration -w packages/mcp
+
+      - name: Build
+        working-directory: packages/mcp
+        run: npm run build

.gitignore

@@ -48,8 +48,8 @@ coverage.xml
 .pytest_cache/
 
 # Translations
-*.mo
 *.pot
+!**/locale/**/*.mo
 
 # Django stuff:
 *.log

AGENTS.md

@@ -615,7 +615,7 @@ try {
 - Reference issues: `refs #123` or `fixes #123`
 - Keep commits focused and atomic
 - Rebase on `main` before PR
-- Run lint/test before pushing
+- **Run tests locally before every push — no exceptions** (see pre-push checklist below)
 - Fill out PR template, link discussions, enable "Allow edits from maintainers"
 
 ---
@@ -629,6 +629,30 @@ try {
 
 ---
 
+## 🚨 Pre-Push Checklist — Mandatory Before Every `git push`
+
+**Never push without running tests first. CI runs are not a substitute for local testing.**
+
+1. `source bin/activate` — ensure venv is active
+2. Run tests for every module you touched:
+   ```bash
+   LOG_LEVEL=30 python -m karrio test karrio.server.<changed_module>.tests
+   ```
+3. Run the SDK test suite if you touched SDK or connector code:
+   ```bash
+   LOG_LEVEL=30 python -m unittest discover -s modules/sdk/tests -p "test_*.py" -v
+   ```
+4. Zero failures, zero errors → then push
+5. If a test fails: fix it before pushing. "CI will catch it" is not acceptable.
+
+**Common gotchas:**
+- New settings guards must be reflected in `@override_settings` in the relevant tests
+- Submodule pointers (`ee/platform`, `ee/insiders`, `community`) must match the expected SHAs — never leave them dirty or pointing to unreachable commits
+- Signal handlers: check for N+1 before committing (use `assertNumQueries`)
+- Carrier credentials: never hardcode — always from `settings`/env; tests must use `pending()`/`test.skip` when credentials absent
+
+---
+
 ## Before Making Changes
 
 1. **Search for existing code** that does what you need

CHANGELOG.md

@@ -1,3 +1,45 @@
+# Karrio 2026.1.27
+
+## Changes
+
+### Feat
+
+- feat: cancel by request_id + resource archiving (soft-delete)
+- feat(smartkargo): add partner tracking API support
+- feat(charts): add production Helm chart for Kubernetes deployment
+- feat(mcp): npm publish workflow, CI test job, and bin/dev up integration
+- feat(tracking): retire aged trackers (#1023)
+- fix(return): fix/return shipments (#1016)
+
+### Fix
+
+- fix(landmark): reclassify early fulfillment events as pending to allow cancellation
+- fix(smartkargo): extract validation errors from nested shipments[]
+- fix(smartkargo): ensure trace_as records for all proxy ops (#1019)
+- fix(dhl_express): remove LocalProductCode from XML API requests
+- fix(dhl_express): move SoftwareName to connection config
+- fix(sdk): redact API key headers (#1023)
+- fix: information exposure through an exception (code scanning alert #98)
+
+### Security
+
+- security: pin axios to 1.13.2 — block compromised 1.14.1 and 0.30.4
+
+### Performance
+
+- perf: eliminate N+1 queries in tenant middleware, rate sheets, and constance settings
+
+### Chores
+
+- chore(deps): bump next from 16.1.5 to 16.1.7 in /apps/web
+- chore(deps): bump next from 16.1.5 to 16.1.7 in /packages/core
+
+### Docs
+
+- docs(self-hosting): add Kubernetes deployment guide
+
+---
+
 # Karrio 2026.1.26
 
 ## Changes