fix(ci): unblock v1.6.0 release publishing path by jdx · Pull Request #460 · endevco/aube

jdx · 2026-05-01T20:34:14Z

Summary

The v1.6.0 release shipped to GitHub but only with darwin-arm64 and the two windows tarballs — all four Linux targets failed to upload, and the downstream npm/COPR/PPA publish jobs all failed too. Fixes the three independent root causes:

crates/aube-resolver/build.rs panics via .expect() when node is absent. The cross-rs Docker container that builds Linux release binaries and the Fedora COPR mock chroot that builds the SRPM both have scripts/generate-primer.mjs visible (mounted / bundled in the source tarball) but no node binary, so the existing "no script → empty primer" fallback (fix(resolver): ship empty primer when generator script unavailable #425) doesn't trigger. Fall back on ErrorKind::NotFound from Command::status() so the same empty-primer path covers all three "no node" environments. Verified locally with env -i + a node-less PATH: emits cargo:warning=node not found in PATH; shipping empty primer and builds clean.
publish-npm fails with Unsupported GitHub Actions runner environment: "self-hosted". Only "github-hosted" runners are supported when publishing with provenance. Move the job from the namespace runner to ubuntu-latest. Trusted Publishing requires a github-hosted OIDC identity; the publish job is otherwise light enough that the namespace runner saves nothing.
ppa-publish fails at dput with Connection failed, aborting. Check your network — namespace runners block outbound FTP (port 21) to ppa.launchpad.net. Move to ubuntu-latest which allows it.

After merge, re-run the failed jobs against v1.6.0 to backfill the missing Linux assets and complete the npm/COPR/PPA publishes.

Test plan

cargo build -p aube-resolver from a node-less PATH falls back to the empty primer with the new cargo:warning=
cargo build -p aube-resolver with node present still generates the primer and builds normally
cargo clippy -p aube-resolver --all-targets -- -D warnings clean
cargo fmt --check clean
Re-run release-plz upload-assets for v1.6.0 after merge → confirm Linux tarballs land on the GH release
Re-run publish-npm for v1.6.0 → confirm @endevco/aube* lands on npmjs.com with provenance
Re-run copr-publish for v1.6.0 → confirm Fedora 42/43/44/rawhide builds succeed
Re-run ppa-publish for v1.6.0 → confirm dput uploads the source package

🤖 Generated with Claude Code

Note

Medium Risk
Moderate risk because it changes release/publishing CI runners and alters aube-resolver build-time primer generation behavior (now falling back to an empty primer when node is unavailable), which could affect release packaging and runtime performance if mis-triggered.

Overview
Unblocks release publishing by switching the publish-npm and ppa-publish GitHub Actions jobs from the self-hosted namespace runner to ubuntu-latest to satisfy npm Trusted Publishing provenance requirements and allow outbound FTP for Launchpad dput uploads.

Makes crates/aube-resolver/build.rs resilient to environments where the primer generator script exists but node is not installed: generate() now returns a boolean and treats ErrorKind::NotFound as a non-fatal condition (emitting a cargo:warning=) so builds fall back to shipping an empty primer instead of panicking.

^{Reviewed by Cursor Bugbot for commit fa90723. Bugbot is set up for automated code reviews on this repo. Configure here.}

build.rs panics with `.expect()` when `node` is absent, taking down release-plz Linux upload-assets (cross-rs container) and copr-publish (Fedora COPR mock chroot). Fall back to the empty-primer path on ENOENT — same degradation already used for downstream crate consumers without the workspace generator script. publish-npm fails on the namespace runner because npm Trusted Publishing rejects self-hosted identities. Move the publish job to ubuntu-latest (the publish step is light enough that the namespace runner saves nothing). ppa-publish dput FTP to ppa.launchpad.net fails because the namespace runners block outbound port 21. Move to ubuntu-latest where it is allowed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

greptile-apps · 2026-05-01T20:35:58Z

Greptile Summary

This PR fixes three independent root causes that blocked the v1.6.0 Linux release assets and downstream publishes: the build.rs generate() function now gracefully handles a missing node binary (returning false to trigger the empty-primer fallback instead of panicking), and both the publish-npm and ppa-publish jobs are moved from a namespace self-hosted runner to ubuntu-latest to satisfy npm Trusted Publishing's OIDC requirement and unblock outbound FTP to Launchpad respectively. The logic changes are minimal and well-targeted, and the &&-chained bool return from generate() is a clean way to propagate the "no node" signal back to main().

Confidence Score: 5/5

Safe to merge — all three changes are narrow, well-justified fixes with no correctness or security concerns.

No P0 or P1 findings. The build.rs refactor correctly preserves the existing success path while adding a targeted NotFound fallback. The workflow runner changes are straightforward and well-explained. No new secrets, permissions, or logic complexity is introduced.

No files require special attention.

Important Files Changed

Filename	Overview
crates/aube-resolver/build.rs	Refactors `generate()` to return `bool`; adds `ErrorKind::NotFound` arm to fall back to empty primer when `node` is absent rather than panicking — fixes Linux cross-compilation and COPR builds.
.github/workflows/publish-npm.yml	Switches `runs-on` from `namespace-profile-endev-linux-amd64` to `ubuntu-latest` to satisfy npm Trusted Publishing's requirement for a GitHub-hosted OIDC identity.
.github/workflows/ppa-publish.yml	Switches `runs-on` to `ubuntu-latest` to unblock outbound FTP (port 21) needed by `dput` to upload to `ppa.launchpad.net`.

_{Reviews (1): Last reviewed commit: "fix(ci): unblock v1.6.0 release publishi..." | Re-trigger Greptile}

github-actions · 2026-05-01T20:48:08Z

Benchmark changes

Versions:

aube: 1.5.2 -> 1.6.0

Public ratios: warm installs vs Bun 6x -> 10x; warm installs vs pnpm 10x -> 14x.

Benchmark	aube	bun	pnpm
Fresh install (warm cache)	230ms -> 213ms (-7%)	1488ms -> 2136ms (+44%)	2367ms -> 3088ms (+30%)
CI install (warm cache, GVS disabled)	564ms -> 957ms (+70%)	1295ms -> 2293ms (+77%)	2361ms -> 2479ms (+5%)
CI install (cold cache, GVS disabled)	5800ms -> 4248ms (-27%)	4278ms -> 4405ms (+3%)	4823ms -> 5411ms (+12%)

## Summary The v1.6.1 release-plz macOS upload-assets job (https://github.com/endevco/aube/actions/runs/25232551216/job/73991667575) failed mid-primer-generation when a single `fetch(registry.npmjs.org/<pkg>)` hit a TLS socket close at package 786/2000: ``` [TypeError: fetch failed] { [cause]: SocketError: other side closed ... code: 'UND_ERR_SOCKET', } ``` The script had no retry, so a transient blip during a 2000-package run crashed the whole release. Wrap fetch with up-to-5-attempt exponential backoff (1s/2s/4s/8s) that retries network errors, 5xx, and 429, and propagates other 4xx as terminal. Linux upload-assets jobs in the same run already pass via the empty-primer fallback from #460 — only macOS (which has node and runs the script for real) was hitting the transient blip. Windows builds will benefit from the same retry. After merge, re-run the failed `Upload assets / upload-assets (aarch64-apple-darwin, ...)` job for v1.6.1 to backfill the macOS tarball. ## Test plan - [x] `node --check scripts/generate-primer.mjs` clean - [x] Smoke-test the retry helper with stubbed `fetch` that throws `UND_ERR_SOCKET` twice — third attempt returns 200, retries logged - [ ] Re-run the v1.6.1 macOS upload-assets job after merge → confirm the primer generates and the tarball lands on the GH release 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Low Risk** > Low risk: only changes the `scripts/generate-primer.mjs` fetch behavior by adding retries/backoff for transient network/HTTP failures, which may slightly increase run time but should reduce flaky CI failures. > > **Overview** > Improves primer generation robustness by wrapping registry/name-list `fetch` calls in a new `fetchWithRetry` helper with exponential backoff. > > The script now retries transient network errors plus HTTP `5xx` and `429`, while treating other `4xx` responses as terminal and preserving existing failure/skip behavior when the final attempt still fails. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 637800f. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

jdx merged commit 6f2054a into main May 1, 2026
19 checks passed

jdx deleted the fix-release-pipeline branch May 1, 2026 20:39

greptile-apps Bot mentioned this pull request May 1, 2026

chore: release v1.6.1 #461

Merged

jdx mentioned this pull request May 1, 2026

fix(ci): retry transient registry fetches in primer generator #462

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(ci): unblock v1.6.0 release publishing path#460

fix(ci): unblock v1.6.0 release publishing path#460
jdx merged 1 commit intomainfrom
fix-release-pipeline

jdx commented May 1, 2026 •

edited by cursor Bot

Loading

Uh oh!

greptile-apps Bot commented May 1, 2026

Uh oh!

Uh oh!

github-actions Bot commented May 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jdx commented May 1, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

greptile-apps Bot commented May 1, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

github-actions Bot commented May 1, 2026

Benchmark changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented May 1, 2026 •

edited by cursor Bot

Loading