ci: fail verify:stackblitz once the release is published - #59
Conversation
The live-lab gate already rejected a pin more than one release behind, but it accepted the immediate predecessor unconditionally. That allowance exists for a narrow reason: a release PR must merge before its target version can be published, and the lab installs from the public registry with a frozen lockfile, so it cannot pin an unpublished version. Nothing closed the window afterwards. beta.9 shipped, the post-release sync PR never landed, and every run kept passing while printing both versions side by side, so the public lab served beta.8 for four days. verify:stackblitz now asks the registry whether the repository version exists. If it does, the predecessor is no longer allowed and the failure names the fix. If the registry cannot be reached the window stays open, because an npm outage must not fail an unrelated build; the lockfile install downstream already reports that case far more clearly. The success line now states which rule applied instead of printing two version numbers and leaving the reader to compare them. RELEASING.md said the sync "must merge before another release can pass"; it is now required immediately, which is what the gate enforces. Verified by reverting the pin to beta.8 locally: the run exits 1 with "[email protected] is already published on npm". Co-Authored-By: Claude Opus 5 <[email protected]>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aace228723
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Review caught a real regression in the previous commit. release.yml runs `pnpm check` before the step that detects an already-published version, so holding a tagged run to the published pin breaks the documented recovery path: when npm publication succeeds but GitHub release creation fails, rerunning the same tag would now fail in `pnpm check` before it could skip republishing. The rule is incoherent there anyway. A tagged commit is immutable, so the lab pin inside it cannot be changed; the failure would name a fix that is impossible to apply. Branch and pull-request runs are always fixable by the post-release synchronization PR, so they keep enforcing it. Verified against the exact pre-synchronization state (lab and lockfile on beta.8, beta.9 published): a tag run passes, a branch run exits 1. Co-Authored-By: Claude Opus 5 <[email protected]>
|
Confirmed and fixed in d03c19e — this was a real regression, thanks. Verified the mechanism: The rule was also incoherent there: a tagged commit is immutable, so the pin inside it cannot be changed — the error would name a fix that is impossible to apply. Branch and pull-request runs are always fixable by the post-release synchronization PR, so those keep enforcing it.
Verified against the exact pre-synchronization state (lab and lockfile on beta.8, beta.9 published on npm):
RELEASING.md now documents both exemptions (tagged runs, unreachable registry). |
1 participant
Closes the gap that let the public StackBlitz lab serve
[email protected]for four days afterbeta.9shipped.What was actually wrong
My earlier description of this ("
verify:stackblitzdoesn't fail on drift") was wrong.assertLiveLabVersionalready rejects a pin more than one release behind. The predecessor allowance is deliberate and necessary: a release PR must merge before its target version can be published, and the lab installs from the public registry with--frozen-lockfile, so during that window it cannot pin the target.The real defect is that nothing ever closed the window. Once
beta.9was published the justification disappeared, but the gate kept acceptingbeta.8indefinitely — and printed both versions in the success line, which reads as confirmation rather than as a warning:RELEASING.md:71only required the sync "before another release can pass", so no gate fired in between.Change
verify:stackblitznow asks the registry whether the repository version exists, and passes that into the policy:--frozen-lockfileinstall downstream already reports that case far more clearly.The success line now states which rule applied rather than printing two version numbers side by side:
Verification
Reverting the pin to
beta.8locally now exits 1:Restored,
pnpm verify:stackblitzpasses with a real dev transform and clean production build.verify:release(14 policy tests, up from 11) andverify:linkspass.One note for reviewers
The first version of this used
Accept: application/vnd.npm.install-v1+json. That abbreviated type is only valid on the packument root — the single-version endpoint answers it with 406, which mycatch-all mapped to "unknown" and left the window open. The gate looked correct and enforced nothing. Caught by testing the failure path rather than the success path; it now sendsapplication/json, verified 200 for a published version and 404 for an absent one.🤖 Generated with Claude Code