Preserve the V44 compliance index reserved by PR #561 and renumber the unreleased identity migrations to V45-V48.
Refs #561
Refs #652
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Also add Python CodeQL coverage in the security workflow so repository-level script regression checks stay green when Python source exists.
Signed-off-by: dongmucat <1127093059@qq.com>
* refactor(cli): improve publish-cli script reliability
- Move version computation and pre-flight checks before build-and-test
to fail fast on conflicts (existing branch/tag) instead of wasting
minutes on lint/test/build
- Add INT/TERM signal handlers to cleanup trap so Ctrl+C during build
properly restores working tree state
- Update Makefile help text to reflect PR-based workflow
* fix(cli): use git checkout -f for robust cleanup
Address code review feedback from gemini-code-assist bot:
- Use `git checkout -f` in on-release and committed cleanup stages
to ensure reliable branch switching even when files are staged
but not committed (e.g., interrupted after `git add` but before
`git commit`)
- Remove redundant `git checkout -- <file>` in on-release stage
since `-f` already discards all local changes
This prevents cleanup failures when the script is interrupted
between staging and committing.
* fix(cli): address PR #441 review findings
- Fix ERR trap bypass: remove `if !` wrapper around `gh pr create` so
set -e triggers the trap and prints pushed-stage recovery instructions
- Fix command injection: all node -e/-p calls now use process.env
instead of interpolating shell variables into JS string literals
- Rewrite cli/RELEASE.md to document the new PR-based release flow
- Rewrite scripts/tests/publish-cli-test.sh with 10 tests covering
the new flow (stubs for bun/gh, pre-flight checks, happy path,
cleanup state machine stages)
* fix(cli): address PR #441 review findings from @dongmucat
- Bind release tag to origin/main: PR body, end-of-run hint, and
cli/RELEASE.md now use `git tag $TAG origin/main` so the tag is
always placed on the merged commit, regardless of local branch state
- Reject prerelease tags in version computation: if the latest cli-v*
tag contains non-X.Y.Z characters (e.g., -rc.1), exit with a clear
message instead of crashing in node parsing
- Add pr-scripts.yml workflow: runs publish-cli-test.sh on scripts/**
changes so the release script regression suite gates PRs
- Add Test 11 covering prerelease tag rejection
* fix(cli): compute publish baseline from origin tags only
A failed `git push origin cli-vX.Y.Z` after a successful local tag
leaves an orphan tag locally. The previous `git tag --list` baseline
would then treat it as the latest release, causing skipped versions or
publishes based on an unreleased tag.
Switch to `git ls-remote --tags --refs origin 'cli-v*' | sort -V` so
the baseline reflects only what is actually on origin. Local orphan
tags can still collide with the computed target tag, which fails fast
with a clear message as before.
Adds test 12 covering the orphan-tag scenario.
The `status="$(env ... printf | bash ... && echo 0 || echo $?)"` pattern
doesn't correctly capture the script's exit code because the command
substitution and pipe interact poorly. Use direct assignment with
`|| status=$?` instead.
The old approach (breaking origin URL) caused `git pull` to fail
before reaching the push step. Use a git wrapper that only fails
on `push` so the rest of the script runs normally.
Remove test 7 (remote tag race condition) — the scenario is nearly
impossible with the new baseline sync logic and too complex to
reliably simulate. Fix variable naming inconsistencies from the
renumbering.
Old test 7 used `--no-tags` config to prevent fetch from pulling the
remote tag, but that doesn't reflect any real-world scenario. With the
new baseline sync logic, a pre-existing remote tag would be synced
into the local version, eliminating the conflict path the test claimed
to cover.
Replace with a git wrapper that injects the conflicting tag into origin
right before the script's `ls-remote` check, which simulates a real
race between two developers attempting to release the same version.
Tests write stdout.log/stderr.log into the test repo root, which made
`git status --porcelain` non-empty and broke test 3 (non-main branch
abort) by tripping the dirty-tree check first.
Add a .gitignore to the test fixture repo to filter out these files.
1. npm version check: three-state logic (exists/missing/error) to prevent
silent skip on network failures, registry 5xx, or auth issues.
2. workflow_dispatch: checkout the specified tag and validate SHA matches,
preventing builds from wrong ref.
3. Atomic push: use `git push --atomic` and detect unpushed tags via
`git ls-remote` instead of `--no-merged` (catches branch-pushed-but-
tag-failed state).
Add pre-flight check in publish-cli.sh to detect unpushed commits and tags
from previous failed pushes. When detected, the script exits with clear
recovery instructions:
1. Retry push (for transient network failures)
2. Rollback and re-release (for clean restart)
This prevents the baseline sync logic from skipping failed versions when
local tags participate in version calculation after a push failure.
Addresses feedback from dongmucat in PR #422.
1. Update release-cli.yml to make create-release depend on publish-npm with proper skip_npm handling, preventing half-released state where GitHub Release exists but npm package is unavailable.
2. Rewrite publish-cli-test.sh to cover the new publish flow: main branch check, dirty tree detection, tag baseline sync, version bumping, tag conflict detection, user cancellation, and atomic push verification.
- Add release-cli.yml GitHub Actions workflow: build, test, npm publish,
and GitHub Release triggered by cli-v* tags
- Rewrite scripts/publish-cli.sh: local bump + commit + tag + push,
enforces main branch, idempotent tag checks
- Add concurrency group and release idempotency to workflow
- Add make publish-cli / publish-cli-minor / publish-cli-major targets
- Add cli/RELEASE.md documenting the full release process
