feat(spec)!: remove the orphaned FeatureFlagSchema module (kernel/fea… #3827
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| concurrency: ${{ github.workflow }}-${{ github.ref }} | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| outputs: | |
| published: ${{ steps.changesets.outputs.published }} | |
| cli-version: ${{ steps.cli-version.outputs.version }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| # 22 (not 20 like the other workflows): the downstream hotcrm smoke | |
| # below clones hotcrm@v1.2.0, whose manifest pins engines.node >=22. | |
| # pnpm install aborts with ERR_PNPM_UNSUPPORTED_ENGINE on Node 20. | |
| node-version: '22' | |
| - name: Enable Corepack | |
| run: corepack enable | |
| - name: Verify pnpm version | |
| run: pnpm --version | |
| - name: Get pnpm store directory | |
| shell: bash | |
| run: | | |
| echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV | |
| - name: Setup pnpm cache | |
| uses: actions/cache@v6 | |
| with: | |
| path: ${{ env.STORE_PATH }} | |
| key: ${{ runner.os }}-pnpm-store-v3-${{ hashFiles('**/pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pnpm-store-v3- | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Verify Changesets "fixed" group covers every public package | |
| run: node scripts/check-changeset-fixed.mjs | |
| - name: Build | |
| run: pnpm run build | |
| - name: Build vendored @objectstack/console SPA | |
| # Clones objectstack-ai/objectui at the SHA pinned in .objectui-sha, | |
| # builds @object-ui/console, and copies dist/ into | |
| # packages/console/dist/. Must run before publish so the | |
| # prepublishOnly guard in @objectstack/console passes. | |
| run: bash scripts/build-console.sh | |
| - name: Downstream backward-compat smoke (live hotcrm) | |
| # Pre-publish gate (#2035): the about-to-publish @objectstack/spec must | |
| # not break a real third-party consumer pinned to a published release. | |
| # Clones objectstack-ai/hotcrm@${HOTCRM_REF}, installs it (published | |
| # deps), overlays the freshly-built spec dist, and runs hotcrm's own | |
| # typecheck + `objectstack validate`. A red here blocks the publish. | |
| # The deterministic in-repo floor is @objectstack/downstream-contract; | |
| # this is the live ceiling. | |
| # | |
| # RC pre-mode amendment (#3600): while .changeset/pre.json says | |
| # mode:"pre", the smoke still runs and reports but does NOT block. A | |
| # major train exists precisely to ship deliberate surface removals, and | |
| # a hotcrm release migrated off them cannot exist until the rc.N | |
| # artifacts it would migrate against are published — blocking here | |
| # deadlocks the train (observed 2026-07-27: every Release run red on | |
| # the v17 window's removals, so the changesets step never even created | |
| # the Version Packages PR). The gate re-arms by itself the moment | |
| # `changeset pre exit` lands (mode flips / pre.json is consumed) — | |
| # exactly when a migrated hotcrm must exist and HOTCRM_REF gets bumped | |
| # per the note below. | |
| env: | |
| # v2.1.0: hotcrm upgraded to ObjectStack 14.7 (hotcrm#448) and | |
| # dropped the agent `visibility` field that spec 15 removes as | |
| # unenforced surface (ADR-0056 D8, #3216). | |
| # Bump this ref whenever a deliberate spec surface removal ships a | |
| # matching hotcrm release. | |
| HOTCRM_REF: v2.1.0 | |
| run: | | |
| if [ "$(jq -r '.mode // empty' .changeset/pre.json 2>/dev/null)" = "pre" ]; then | |
| echo "::notice::Changesets pre-mode active — the hotcrm smoke is advisory (reported, non-blocking) until 'changeset pre exit'." | |
| if bash scripts/downstream-smoke.sh; then | |
| echo "::notice::hotcrm@${HOTCRM_REF} is still compatible with the pre-release train." | |
| else | |
| echo "::warning::hotcrm@${HOTCRM_REF} is incompatible with the pre-release train — expected for the window's deliberate removals. Ship a migrated hotcrm release and bump HOTCRM_REF before 'changeset pre exit' re-arms this gate." | |
| fi | |
| else | |
| bash scripts/downstream-smoke.sh | |
| fi | |
| - name: Create Release Pull Request or Publish to npm | |
| id: changesets | |
| uses: changesets/action@v1 | |
| with: | |
| # publish (pnpm run release) ends in scripts/release-publish.sh, | |
| # which pushes all new version tags in ONE atomic git push. This | |
| # pre-empts changesets/action's own concurrent per-tag pushes, which | |
| # otherwise race GitHub's ref backend (remote: fatal error in | |
| # commit_refs) and reject ~half the tags on a large fixed-group bump (#2191). | |
| publish: pnpm run release | |
| version: pnpm run version | |
| commit: 'chore: version packages' | |
| title: 'chore: version packages' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Attach spec-changes.json to the GitHub Release (ADR-0087 D4) | |
| # Rebuilds the change manifest with the api-surface diff against the | |
| # previously PUBLISHED spec (reusing the ADR-0059 §3 gate artifact) and | |
| # uploads it to the @objectstack/spec release the changesets action | |
| # just created. The npm artifact carries the registry-derived copy. | |
| if: steps.changesets.outputs.published == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PUBLISHED: ${{ steps.changesets.outputs.publishedPackages }} | |
| run: bash scripts/release-spec-changes.sh | |
| - name: Extract published @objectstack/cli version | |
| id: cli-version | |
| if: steps.changesets.outputs.published == 'true' | |
| # The fixed group bumps every public package in lockstep, so the CLI | |
| # is always in publishedPackages when a publish happened. Passed via | |
| # env (not inline interpolation) to avoid shell-quoting the JSON. | |
| env: | |
| PUBLISHED: ${{ steps.changesets.outputs.publishedPackages }} | |
| run: | | |
| version=$(jq -r '.[] | select(.name=="@objectstack/cli") | .version' <<<"$PUBLISHED") | |
| if [ -z "$version" ]; then | |
| echo "::error::publish succeeded but @objectstack/cli is missing from publishedPackages" | |
| exit 1 | |
| fi | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| docker: | |
| name: Docker image | |
| needs: release | |
| # Publish the official runtime image (ghcr.io/objectstack-ai/objectstack) | |
| # for every npm release. Called as a reusable workflow so the same build | |
| # can be re-run manually via workflow_dispatch (e.g. base-image CVE | |
| # rebuilds) — see docker-publish.yml. | |
| if: needs.release.outputs.published == 'true' | |
| permissions: | |
| contents: read | |
| packages: write | |
| uses: ./.github/workflows/docker-publish.yml | |
| with: | |
| version: ${{ needs.release.outputs.cli-version }} |