release.yml 的 version-pr 车道改为「定时 + 按需」刷新——终结 Version Packages PR 被每次 main push 强刷、CI 永不收敛的合并竞态

[os-zhuang]

维护者 2026-08-23 拍板:「立卡派发 release.yml 的定时化改造」。skills 席 session 757f0dc0-5dae-51d7-9053-c15c57ebfe3b 立卡并派发。

问题(实测,非推断)

release.yml 的 version-pr job 在每次 main push 上运行,changesets action 每次 reset --hard 到当前 sha 重算并 force-push changeset-release/main。在 ~18 合并/日的 main 上,#10183 的分支 CI 永不收敛、入队即被踢(docs/releases-maintenance.md 记录过 rc.6 被追四圈、估算需冻结两仓 ~40 分钟)。已核实:升级 @changesets/cli 3.0 不解决(本仓已在 ^3.0.0,行为如故——churn 是 action 算法 × 触发器,与 CLI 版本无关);cut-rc 快照道维护者明确不想再养。社区成熟解法即本卡:changesets 官方 automating 文档的 schedule 模式。

改造(单文件为主:.github/workflows/release.yml)

1. on: 增加 schedule(建议 0 */6 * * *,cron 只对默认分支生效);version-pr job 的 if: 从 github.event_name == 'push' 改为 schedule/按需——push 不再刷新 version PR。两次刷新之间 chore: version packages #10183 静止:分支 CI 可收敛,可正常走队列合并。
2. release-integrity 与 publish 两个 job 原样留在 push 上。ADR-0125 的不变量一个都不许动:publish 仍只在「main 版本不在 npm」时启动、仍整体挂 environment: release 等人批;⛔ version-pr 仍不得获得任何 publish 能力(action 不带 publish: script 的结构性保证保留)。
3. ⚠️ 按需刷新与修复道的 dispatch 冲突必须显式设计:现有 workflow_dispatch 是 publish 修复道(带 force input)。若直接让 version-pr 也吃 dispatch,一次「刷新」会同时把 publish 审计拉起并在 environment 门挂一个待批部署(噪音),反之亦然。可行形状(dev 定夺,PR 正文论证):dispatch 增加 refresh_version_pr boolean input,version-pr 走 schedule || (dispatch && inputs.refresh_version_pr),publish 走 push || (dispatch && !inputs.refresh_version_pr)——一个文件内分流,不新增 lane。
4. version-pr 现有的 per-job concurrency(release-version-pr-…,cancel-in-progress: false)保留;release.yml 头部那段车道叙事(force-refresh 相关句子)与 docs/releases-maintenance.md 中「The standing Version Packages PR is force-refreshed on every main push」的前提句同步更新——文档描述的是机制,机制变了描述必须跟。
5. 发版操作流从此收敛为:(需要时 dispatch 刷新)→ 合并 chore: version packages #10183 → 批准 release 环境。

验证要求

• node scripts/pm/dispatch-gates.mjs 派生并跑全族(至少 check-ci-filter-parity、check:workflow-status-functions、check:required-contexts 这类读 workflows 的门);
• workflow 语法静态校验(仓内既有手段,勿引新依赖);
• check-governed-merges --test 判落地类(.github/workflows/** 不在 governed 名录,预期普通队列,核实勿假设);
• ⛔ 本卡不碰 publish/release-integrity 的任何步骤体、不碰 cut-rc.yml、不碰 environment 配置;release.yml 头部 2026-08-07「版本发布必须是人工的」裁决叙事一字保留。

参考:changesets automating 文档(schedule 模式)· changesets/action#215(auto-merge,⛔ 与 08-07 裁决冲突,不采)。

[os-zhuang]

CLAIM — session 757f0dc0-5dae-51d7-9053-c15c57ebfe3b(skills 席),branch claude/issue-11233-version-pr-schedule。维护者 2026-08-23 当面拍板「立卡派发 release.yml 的定时化改造」,立卡即派发。

---

Generated by Claude Code

[os-zhuang]

{
 "issue": 11233,
 "status": "done",
 "branch": "claude/issue-11233-version-pr-schedule",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/11238",
 "premise_still_valid": true,
 "summary": "version-pr moved off push onto schedule (cron 0 */6 * * *) plus an on-demand workflow_dispatch input refresh_version_pr; between refreshes changeset-release/main is static so its CI converges and it merges through the ordinary queue. Dispatch collision resolved inside the one file by that boolean: version-pr runs on schedule || (dispatch && refresh_version_pr); release-integrity gains an if: of push || (dispatch && !refresh_version_pr) — it previously had NO if:, so the new schedule event would otherwise have run a full release audit and parked a waiting deployment at the release environment on every routine refresh; publish's force branch gains && !inputs.refresh_version_pr. ADR-0125 invariants untouched: publish is still the only publishing job, still unreachable from schedule and from a refresh dispatch, still held whole at environment: release, steps unmodified; version-pr still takes no publish: script (structural, not if:-based); the 2026-08-07 ruling narrative is verbatim. docker needed no condition change (unset outputs already compare false) — only its 'exactly one upstream job runs' comment became 'at most one'. Prose synced in the same PR at 4 sites in release.yml's header and 4 in docs/releases-maintenance.md.",
 "tests": "All gates re-run AFTER the final commit, at d3b9dc67f3 (git rev-parse --short HEAD from that run). Exit codes captured before any pipe (cmd > file 2>&1; EXIT=$?); verdicts quoted are each gate's own printed line, never $?. Families derived by `node scripts/pm/dispatch-gates.mjs` with NO path arguments (script takes the change set from the merge base itself; it reported 'committed 2, working tree 0, untracked 0') — 11 matched, all green: check:doc-authoring '389 files clean'; check:doc-formula-expressions '22 record-scoped formula example(s) across 416 files / 1447 TS blocks judged clean'; check:node-version 'OK (32 setup-node step(s) across 26 workflow(s), all on Node 22)'; check:pnpm-filter-targets '121/149 --filter occurrence(s) across 25 file(s) resolve'; check:required-contexts '6 required context name(s) pinned across 2 workflow(s)'; check:shard-attestation '2 aggregate gate(s) count 3 declared leg(s)'; check:workflow-status-functions 'OK (scanned 26 workflow file(s), 49 job(s), 25 job-level if: expression(s); 10 read needs.*.outputs.*, all naming a status function)'; check-aggregator-roster 'roster == needs: in both directions'; check-required-contexts (patrol); check-shard-attestation '--self-test: 103 assertions'; check-step-collectors '354 run: steps across 26 workflow(s)'. Also run though NOT derived for these paths: check-ci-filter-parity 'OK: all 88 declared cross-package glob(s)'. check:nul-bytes 'OK (scanned 6519 text file(s) ... no raw ASCII control bytes)' plus a manual control-byte grep over both changed files (no hits). YAML validated with in-repo means, no new dependency: parsed with the workspace's own `yaml` package, dumping the trigger block and all four job guards (parse exit 0), reading both key spellings ('on' / YAML-1.1 true) as check-required-contexts does; the four job guards read back exactly as designed. Toolchain note: check:doc-formula-expressions first failed ERR_MODULE_NOT_FOUND on @objectstack/formula/dist — dependency closure not built; fixed by `pnpm --workspace-concurrency=2 --filter '@objectstack/lint^...' build` (flag BEFORE the filter — placing --concurrency after it forwarded the flag to tsup and broke sdui-parser), then green. All heavy commands ran through scripts/pm/os-verify-lock.sh. DECLARED NARROWING: repo-wide `pnpm lint` was not run; narrowing measured rather than assumed — `npx eslint --format json` over both changed paths reports 2 files / 0 errors, each 'File ignored because no matching configuration was supplied', so the population comes from eslint's own config resolution and both changed files fall outside it entirely; config invariance holds because this diff changes no eslint config and no TypeScript. dispatch-gates residue examined rather than treated as clearance: the 2 silent families whose roster sits under .github/workflows are both check:single-claim-paths, whose SINGLE_CLAIM_PATHS declares exactly one entry (.objectui-sha), so that silence is correct. Card-named scripts checked for trigger-shape assertions: scripts/pm/check-half-states.mjs and scripts/pm/check-release-page-status.mjs assert nothing on release.yml's triggers (grep for version-pr/event_name returns empty; half-states' only release.yml reference is a card-body string). Landing class on the FINAL file list: `node scripts/pm/check-governed-merges.mjs --test .github/workflows/release.yml docs/releases-maintenance.md` → 'governed-surface predicate: 0 of 2 path(s) hit the register (5 surfaces, repo-agnostic). NOT governed — ordinary queue landing applies to a PR with exactly this file list.' Opened as DRAFT regardless, per dispatch. skip-changeset applied as a union with the bot labels then READ BACK: labels are now [documentation, ci/cd, size/m, skip-changeset]. CI convergence not awaited — reporting at draft-PR time per the 2026-08-10 ruling; gate status on the PR is in_progress.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #11239: docs/releases-maintenance.md still describes the pre-ADR-0125 publish lane in three sentences — 'Both lanes are workflow_dispatch ... neither can be started by a push', the GA table's 'then dispatch' Trigger cell, and the GA step telling a releaser to Run workflow 'with the version main now carries' (the typed version ADR-0125 D2 removed). Pre-existing, not caused by this card; left untouched because one sits inside the 2026-08-07 ruling narrative and correcting them is a separate reading of ADR-0125.",
 "NOT filed, needs PM triage: #10850 is OPEN and pm:queue for substantially this same goal ('switch the changesets version workflow from every-merge-to-main to manual dispatch before a release'). It is not assigned or dispatched, so there was no in-flight race, but #11238 implements it. No closing keyword was written for it anywhere in the PR body or commit message; #10850 remains open for the PM to decide."
 ]
}

---

Generated by Claude Code

[os-zhuang]

os-dev-report

(Re-post of the comment above: the HTML-comment marker was stripped by GitHub's body sanitizer after the write landed, so that copy is invisible to the PM's scan. Same report, literal-text marker. Content identical.)

{
 "issue": 11233,
 "status": "done",
 "branch": "claude/issue-11233-version-pr-schedule",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/11238",
 "premise_still_valid": true,
 "summary": "version-pr moved off push onto schedule (cron 0 */6 * * *) plus an on-demand workflow_dispatch input refresh_version_pr; between refreshes changeset-release/main is static so its CI converges and it merges through the ordinary queue. Dispatch collision resolved inside the one file by that boolean: version-pr runs on schedule OR (dispatch AND refresh_version_pr); release-integrity gains an if: of push OR (dispatch AND NOT refresh_version_pr) — it previously had NO if:, so the new schedule event would otherwise have run a full release audit and parked a waiting deployment at the release environment on every routine refresh; publish's force branch gains AND NOT inputs.refresh_version_pr. ADR-0125 invariants untouched: publish is still the only publishing job, still unreachable from schedule and from a refresh dispatch, still held whole at environment: release, steps unmodified; version-pr still takes no publish: script (structural, not if:-based); the 2026-08-07 ruling narrative is verbatim. docker needed no condition change (unset outputs already compare false) — only its 'exactly one upstream job runs' comment became 'at most one'. Prose synced in the same PR at 4 sites in release.yml's header and 4 in docs/releases-maintenance.md.",
 "tests": "All gates re-run AFTER the final commit, at d3b9dc67f3 (git rev-parse --short HEAD from that run). Exit codes captured before any pipe (cmd redirected to a file, then EXIT=$?); verdicts quoted are each gate's own printed line, never $?. Families derived by `node scripts/pm/dispatch-gates.mjs` with NO path arguments (script takes the change set from the merge base itself; it reported 'committed 2, working tree 0, untracked 0') — 11 matched, all green: check:doc-authoring '389 files clean'; check:doc-formula-expressions '22 record-scoped formula example(s) across 416 files / 1447 TS blocks judged clean'; check:node-version 'OK (32 setup-node step(s) across 26 workflow(s), all on Node 22)'; check:pnpm-filter-targets '121/149 --filter occurrence(s) across 25 file(s) resolve'; check:required-contexts '6 required context name(s) pinned across 2 workflow(s)'; check:shard-attestation '2 aggregate gate(s) count 3 declared leg(s)'; check:workflow-status-functions 'OK (scanned 26 workflow file(s), 49 job(s), 25 job-level if: expression(s); 10 read needs outputs, all naming a status function)'; check-aggregator-roster 'roster == needs: in both directions'; check-required-contexts (patrol); check-shard-attestation '--self-test: 103 assertions'; check-step-collectors '354 run: steps across 26 workflow(s)'. Also run though NOT derived for these paths: check-ci-filter-parity 'OK: all 88 declared cross-package glob(s)'. check:nul-bytes 'OK (scanned 6519 text file(s) ... no raw ASCII control bytes)' plus a manual control-byte grep over both changed files (no hits). YAML validated with in-repo means, no new dependency: parsed with the workspace's own `yaml` package, dumping the trigger block and all four job guards (parse exit 0), reading both key spellings ('on' / YAML-1.1 true) as check-required-contexts does; the four job guards read back exactly as designed. Toolchain note: check:doc-formula-expressions first failed ERR_MODULE_NOT_FOUND on @objectstack/formula/dist — dependency closure not built; fixed by `pnpm --workspace-concurrency=2 --filter '@objectstack/lint^...' build` (flag BEFORE the filter — placing --concurrency after it forwarded the flag to tsup and broke sdui-parser), then green. All heavy commands ran through scripts/pm/os-verify-lock.sh. DECLARED NARROWING: repo-wide `pnpm lint` was not run; narrowing measured rather than assumed — `npx eslint --format json` over both changed paths reports 2 files / 0 errors, each 'File ignored because no matching configuration was supplied', so the population comes from eslint's own config resolution and both changed files fall outside it entirely; config invariance holds because this diff changes no eslint config and no TypeScript. dispatch-gates residue examined rather than treated as clearance: the 2 silent families whose roster sits under .github/workflows are both check:single-claim-paths, whose SINGLE_CLAIM_PATHS declares exactly one entry (.objectui-sha), so that silence is correct. Card-named scripts checked for trigger-shape assertions: scripts/pm/check-half-states.mjs and scripts/pm/check-release-page-status.mjs assert nothing on release.yml's triggers (grep for version-pr/event_name returns empty; half-states' only release.yml reference is a card-body string). Landing class on the FINAL file list: `node scripts/pm/check-governed-merges.mjs --test .github/workflows/release.yml docs/releases-maintenance.md` gives 'governed-surface predicate: 0 of 2 path(s) hit the register (5 surfaces, repo-agnostic). NOT governed — ordinary queue landing applies to a PR with exactly this file list.' Opened as DRAFT regardless, per dispatch. skip-changeset applied as a union with the bot labels then READ BACK: labels are now [documentation, ci/cd, size/m, skip-changeset]. CI convergence not awaited — reporting at draft-PR time per the 2026-08-10 ruling; gate status on the PR is in_progress.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #11239: docs/releases-maintenance.md still describes the pre-ADR-0125 publish lane in three sentences — 'Both lanes are workflow_dispatch ... neither can be started by a push', the GA table's 'then dispatch' Trigger cell, and the GA step telling a releaser to Run workflow 'with the version main now carries' (the typed version ADR-0125 D2 removed). Pre-existing, not caused by this card; left untouched because one sits inside the 2026-08-07 ruling narrative and correcting them is a separate reading of ADR-0125.",
 "NOT filed, needs PM triage: #10850 is OPEN and pm:queue for substantially this same goal ('switch the changesets version workflow from every-merge-to-main to manual dispatch before a release'). It is not assigned or dispatched, so there was no in-flight race, but #11238 implements it. No closing keyword was written for it anywhere in the PR body or commit message; #10850 remains open for the PM to decide."
 ]
}

---

Generated by Claude Code