objectstack's release PR gets no CI either (same changesets/action + GITHUB_TOKEN shape objectui#5397 just closed) — sweep release.yml, and cloud / objectos with it

[yinlianghui-tw]

Filed unassigned from objectui#5397 (PR objectstack-ai/objectui#6217), whose dispatch order asked for this card if the mechanism turned out to be generic rather than an objectui quirk. It is generic, and it is confirmed by reading this repository, not inferred from the sibling.

The mechanism, in this repository's own words

.github/workflows/lint.yml:988-991 already states it verbatim:

changeset version bumps packages/cli on a release PR that (per sync-template-versions.mjs's own header) gets NO CI because changesets/action opens it with the default GITHUB_TOKEN — so the bump merged green and the gate reddened on the NEXT ordinary PR, naming files that author never touched.

release.yml's Create or update the "chore: version packages" PR step uses changesets/action@v1 with the default GITHUB_TOKEN. GitHub does not start workflow runs from events raised by that token, so the version PR gets no pull_request build — and the bot force-pushes the branch, so there is no stable head for a human to re-run checks against either.

The consequence is the same one objectui measured: the release commit is the largest machine-generated diff of the release cycle and the only commit that reaches main without passing the gates.

Why this is worth a card rather than a shrug

This repository has already paid for it once and paid in the shape the objectui ruling explicitly rejected as non-generalising. #9064 exists because a check:docs-image-tag gate structurally could not fire on the release PR that breaks it, so a version-time rewriter (scripts/sync-docs-image-tags.mjs) had to be built for that one artifact — a per-artifact mechanical guarantee, which covers exactly the artifact it names and nothing else. sync-template-versions.mjs and sync-protocol-version are two more of the same kind. Each new version-time output needs its own rewriter and its own self-test, forever, because nothing validates the tree as a whole.

What the sweep should do

Maintainer ruling on the sibling card (2026-08-22, 「接受所有」) chose option A: validate the post-version tree inside the release workflow, after the version step and before changesets/action opens or updates the PR — rejecting a PAT / GitHub App token (widens the supply-chain trust surface, adds rotation obligations) and rejecting per-artifact guarantees (they do not generalise).

⚠️ Price it before choosing the shape here too. In objectui the price is what chose the implementation, and the naive reading was the wrong one: measured there, changeset version moves no source byte at all (411 paths: changeset deletions, the "version" key in 40 manifests, 40 generated CHANGELOG.md, one QUICK_REFERENCE.md), so a full post-version suite would have re-tested bytes CI had validated minutes earlier at ~40 min a go. The shipped shape validates only the surfaces the version step can move, at ~68 s per refresh. release.yml here runs pnpm run version = changeset version + sync-protocol-version + sync-template-versions (+ sync-docs-image-tags), so this repository's post-version diff is strictly larger than objectui's and has to be measured on its own — the scope conclusion does not transfer.

The two repositories' release workflows have deliberately diverged (this one's version lane carries no publish: input at all, per #6170), so this is a sweep of the same defect, not a port of the same patch.

Not audited here

cloud and objectos were named in objectui#5397's triage as plausibly carrying the identical changesets/action + GITHUB_TOKEN shape and have never been audited. Neither was in the sibling session's checkout, so no reading was taken. Whoever picks this up should check them the same way — one grep for changesets/action and the token it is handed — and either fold them in or file per-repo.

---

Generated by Claude Code

[claude]

Triage: lands in .github/workflows/release.yml (+ release tooling under scripts/); rationale: domain:devx (workflow/gate face). → pm:queue, Bug — the repo's own lint.yml:1249 comment already concedes the version PR merges with no CI; premise re-verified on origin/main (the version-PR step still runs changesets/action@v1 with the default GITHUB_TOKEN, and the deliberate absence of a publish: input per #6170 is an invariant to preserve, not part of the defect). Scope notes for dispatch: (a) objectui's fix (objectui#5397 / PR objectui#6217) is a sweep of the same defect, not a portable patch — the two version lanes have diverged; (b) cloud/objectos halves: one grep for changesets/action + the token it is handed, then file at destination — objectos has no changeset flow per its lane charter, so verify before filing rather than porting blind. Size/model suggestion: M, opus.

---

Generated by Claude Code

[os-steve]

Claim: PM dispatch (devx seat)

• Session: session_015ahemw8RcTgqtxrj15PEZx
• Branch: claude/issue-11945-release-pr-no-ci

⛔ Release-adjacent WORK, not a release ACT — the distinction is the whole reason this is dispatchable

AGENTS.md Prime Directive #15 reserves the release act: ⛔ changeset publish / pnpm run release, ⛔ pushing a version tag, ⛔ cutting a GitHub Release, ⛔ pushing a runtime image, ⛔ workflow_dispatch-ing release.yml, ⛔ approving a pending release environment deployment, and ⛔ merging — or queueing, or arming auto-merge on — the Version Packages PR.

Editing release.yml to add a validation step is none of those. The directive says release-adjacent work stays open to every seat. But the dev must not cross into the reserved list while working in that file, and in particular ⛔ must never touch the standing chore: version packages PR.

What is already ruled, and what is explicitly NOT inherited

The maintainer ruled option A on the sibling (objectui#5397, 2026-08-22, 「接受所有」): validate the post-version tree inside the release workflow, after the version step and before changesets/action opens or updates the PR. A PAT / GitHub App token was rejected (widens the supply-chain trust surface, adds rotation obligations); per-artifact guarantees were rejected (they do not generalise).

⚠️ The scope conclusion does NOT transfer, and this is the trap. In objectui the price chose the implementation, and the naive reading was wrong: changeset version there moves no source byte at all, so a full post-version suite would re-test what CI validated minutes earlier. But pnpm run version here is changeset version + sync-protocol-version + sync-template-versions (+ sync-docs-image-tags) — a strictly larger post-version diff. Measure this repo's own, and let that choose the shape. Copying objectui's ~68s surface list would be inheriting a number that was derived from a different workflow.

Triage adds two constraints I am carrying as binding: the deliberate absence of a publish: input (per #6170) is an invariant to preserve, not part of the defect; and for the cloud/objectos halves — one grep for changesets/action and the token it is handed, then file at destination, ⛔ never port blind, because objectos has no changeset flow per its lane charter.

The cost of leaving this is on the record: #9064 exists because a gate structurally could not fire on the release PR, so a per-artifact rewriter had to be built for one artifact. sync-template-versions.mjs and sync-protocol-version are two more of the same kind — each new version-time output needs its own rewriter and self-test forever, because nothing validates the tree as a whole.

Tier: opus — triage suggested it and I agree. Derived live, no path-derived mandate, so sonnet is the floor and this is a judgment call: the shape follows from a measurement nobody has taken yet, and the failure mode is a validation step that looks thorough while covering the wrong surface.

---

Generated by Claude Code

[claude]

{
 "issue": 11945,
 "status": "done",
 "branch": "claude/issue-11945-release-pr-no-ci",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/11964",
 "premise_still_valid": true,
 "summary": "Premise re-verified on current origin/main, not inherited: release.yml:313 is changesets/action@v1 and :342 hands it the default GITHUB_TOKEN. Three steps now sit in the version-pr job between the fixed-group gate and the action: render the post-version tree, validate it, restore it (if: always(), restoration asserted, because with .changeset consumed and no publish: input the action takes case !hasChangesets && !hasPublishScript and the refresh becomes a permanent silent no-op). Validation is two halves. SHAPE: every moved path must fall inside the reviewed surface, with the doc and template halves resolved AT RUN TIME from the declarations the rewriters themselves read (SURFACES in check-docs-image-tag.mjs, stampedPaths() in sync-template-versions.mjs), using cut-rc.yml's own predicate — so a fifth rewriter reddens the lane on the day it lands. CONTENT: the eight gates whose corpus is what the version step writes, 7 s. Measured here rather than inherited (2026-08-25, at 3689991d2, 158 changesets, cli 17.2.0 -> 17.3.0): 313 paths in four classes — 158 changeset deletions, 76 package.json (152 lines, every one \"version\":, no dependency range moved), 76 generated CHANGELOG.md, 3 doc surfaces (8 concrete pins). Two further classes are major-boundary only and dormant behind check-changeset-no-major.mjs (protocol-version.ts, a runtime .ts, plus the template stamps) and get their own refusal instead of silent acceptance. The card's citation lint.yml:988-991 has ROTTED — that range is now the doc-frontmatter gate's prose; triage's lint.yml:1249 is the live line and is quoted in the PR. Also corrected this job's own comment, which still called pnpm run version three rewriters after #9064 made it four (bounded in-place fix: same defect class, mechanical, pinned by package.json's version script, same file, named in the PR body). SIBLINGS NOT AUDITED: cloud and objectos are outside this session's repo allowlist (objectstack + objectui only) and add_repo for objectstack-ai/cloud was refused with 'you don't have access' — nothing filed for either, per the dispatch order.",
 "tests": "All commands run in worktree /home/user/objectstack-11945; heavy runs through scripts/pm/os-verify-lock.sh (one 99 queue-timeout mid-task, waited out with lock-free work, then re-acquired). Union run at final commit 7a29541a9, tree clean.\n\n(1) MEASUREMENT, with control. `pnpm run version` rendered under a restore trap: 313 paths (158 D + 155 M), verified twice; git status by class = 158 .changeset, 76 package.json, 76 CHANGELOG.md, 3 doc surfaces; 'changed lines in package.json files, by key' = 152 occurrences of \"version\": and nothing else. Restore verdict each time: 'post-restore dirty tracked: 0; post-restore pending changesets: 159'.\n\n(2) PRICE, with positive control. Full derived farm on the POST-version tree: TOTAL_postversion=117s, 44 green / 6 red. Identical sweep on the PRE-version tree: TOTAL_clean=117s, 44 green / the SAME 6 red — so the version step changes no gate's verdict on this train, and the 6 are environment (5 print 'Fix: pnpm build' / 'Nothing was measured'; check-engine-split-ratio refuses on a shallow clone). Named content set timed separately: 0+1+1+2+0+1+0+2 = 7 s.\n\n(3) END TO END, on the SHIPPED bytes. The three step scripts were extracted from .github/workflows/release.yml with a YAML parser (not retyped) and executed with the Actions context variables they read. At 7a29541a9: 'RENDER_EXIT=0' (158 consumed, 313 moved) · 'VALIDATE_EXIT=0' + 'Post-version tree validated.' + step summary '313 path(s), all inside the reviewed shape', 'content gates failed: 0' · 'RESTORE_EXIT=0' + 'Pre-version tree restored: 158 pending changeset(s), working tree clean.' Evidence the gates read the RENDERED tree and not main: check-release-section-coverage.mjs reported '@objectstack/spec 17.3.0 is published (it has a ## 17.3.0 section in packages/spec/CHANGELOG.md)' — a section that exists only after the render.\n\n(4) REVERSE VERIFICATION — three limbs, each mutating, proving the mutation on disk, running the shipped validate step, restoring under a trap. No build/dist is involved anywhere in this change (workflow bash plus node scripts; nothing under test resolves through a package's dist/), so there is no rebuild leg to state — the 'shipped bytes' guarantee comes from extracting the scripts from the YAML instead. Predicted direction: red, all three. Observed: red, all three. (a) stray path — on-disk proof 'injected-path count in the moved list = 1' -> '::error:: unexpected: packages/core/src/invented-version-output.ts'. (b) major surface — proof 'protocol-version.ts count in the moved list = 1' -> '::error:: unvalidated: … crossed a MAJOR boundary … which this lane has no gate for'. (c) stale doc pin — proof \"'objectstack:17.3.0' occurrences in docker/README.md before=2 after=1\" plus 'reverted-pin occurrences now = 1' -> '::error::the post-version tree fails 1 gate(s) …: pnpm check:docs-image-tag'. Limb (b) FAILED ITS FIRST RUN in the informative way: it hit the 'wrote outside the reviewed surface' branch — red for the right reason, wrong about why — which is what commit 7a29541a9 fixes; re-run after the fix gives the message above.\n\n(5) GATES FOR THIS DIFF, derived live at 7a29541a9 with 'node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack' (merge-base form, no paths passed), plus check:nul-bytes for any edit: 16/16 green, RED: 0 — check:workflow-status-functions, check:required-contexts, check:step-collectors, check:aggregator-roster, check:shard-attestation, check:pnpm-filter-targets, check:pnpm-acquisition, check:node-version, check:agent-test-spelling, check-whole-set-label-write, check-drift-comment, ci-failure --self-test, check:nul-bytes, check-self-test-wired. Exit codes captured before any pipe. Control-byte self-scan of the edited file: grep -naP over the control ranges exits 1 (no match). Diff scoped against the recorded BASE 3689991d2 and against merge-base — both give exactly one file, .github/workflows/release.yml, +365/-2 (the two-dot origin/main..HEAD form showed 10 files, the documented sibling-merge contamination).\n\nNOT RUN: CI's own gate farm on this PR — release.yml runs only on schedule/workflow_dispatch, so no CI run can exercise these steps here; that is why (3) and (4) exist. skip-changeset applied via the additive endpoint and READ BACK: 'labels read back: size/m, skip-changeset'.",
 "open_questions": [
 {
 "question": "Should the release lane SELECT its gates by derivation rather than by a written list? Feeding the 313-path change set to scripts/pm/dispatch-gates.mjs generalises perfectly — a new version-time output pulls in its surface's gates with nothing in the workflow to update — and it is affordable (113 s for the 44 build-free families, plus 18 s for the tool's own self-test, four times a day). It was drafted, measured, and withdrawn.",
 "options": [
 "A — ship the list, as this PR does. The shape assertion is what generalises: a new version-time output cannot pass unvalidated, it reddens the lane. Costs 7 s. Adding a gate for a NEW surface stays a human step.",
 "B — derive and run. Costs 131 s. Needs scripts/check-self-test-wired.mjs to grow a new ledger shape: the tool's --self-test cannot be wired directly, because that spelling makes the step a gate family declaring the bare repo root 'scripts' and dispatch-gates' own self-test refuses it as a FRESH escapable literal (measured — it did, on the first draft). It also sits against check-dispatch-gates.mjs's recorded position that 'there is no verdict in [the live derivation] for CI to hold'.",
 "C — B, but only after the ledger question is settled on its own card."
 ],
 "recommendation": "A now, with B available whenever you want it — both forms of the derivation name the same 49 families on this change set, so the measurement is already in hand. B asks a gate whose whole purpose is to stop phantom checks to grow a new exemption shape, and re-opens a position #8162 recorded deliberately; that is a maintainer's call, not a rider on this card. Real business need: the defect is closed either way, and the class this repo has actually PAID for three times (per-artifact rewriters) is closed by the shape half, which is in A. Long-term soundness: A reuses cut-rc.yml's reviewed idiom for the identical surface, so the two release lanes now state the same allowlist from the same two run-time declarations rather than diverging. AI-hard-to-get-wrong: the shape assertion is the structural half — a new output is refused by construction, not remembered; B adds automatic gate selection on top, which is better still but only once its two obligations are settled honestly rather than worked around. Startup scope: A adds no new load-bearing dependency; B promotes a PM dispatch aid into the release lane's critical path."
 }
 ],
 "out_of_scope_findings": [
 "NOT filed, already tracked: check-release-section-coverage.mjs reports two advisory findings on plain main (content/docs/releases/v17.mdx has no 17.2 section though @objectstack/spec 17.2.0 is published; content/docs/releases/index.mdx says 'current series: 17.1.0' while 17.2.0 is the newest released). Searched first — #11879 '[Release-coverage patrol] published-minor section coverage' is the standing anchor the patrol workflow rewrites in place for exactly these rows, so filing again would be a duplicate. Also out of bounds to fix here: content/docs/releases/ is never edited in a code PR.",
 "NOT filed, reported in the PR instead: the card's citation of lint.yml:988-991 has rotted (that range is now the doc-frontmatter gate's prose); triage's lint.yml:1249 is the live line.",
 "NOT filed, no access: cloud and objectos still need the one grep for changesets/action and the token it is handed. Both are outside this session's repository allowlist and add_repo for objectstack-ai/cloud was refused ('you don't have access'), so nothing was read and nothing was filed — per the dispatch order."
 ]
}

Generated by Claude Code

---

Generated by Claude Code