fix(ci): remove production handshake from publish gate

KH
2mo ago
+432-11

What changed

  • Routes every blocking broker lifecycle smoke in the publish flow through a loopback-only Relaycast registration stub:
    • pre-publish locally packed harness-driver and broker matrix
    • macOS standalone lifecycle verification
    • post-publish harness-driver registry matrix
  • Keeps the real artifact assertions intact: clean install/pack, platform optional-dependency selection, executable resolution, HarnessDriverClient.spawn, standalone node up/down, and shutdown must still pass.
  • Removes RELAY_CI_WORKSPACE_KEY from the publish workflow. Production registration is no longer verified by this blocking release gate; package-validation retains its dedicated production smoke.
  • Adds contract and workflow-wiring tests plus an Unreleased - Patch changelog entry.

This intentionally weakens one aspect of the release gate: it no longer proves the production authenticated write plane is healthy. That availability signal should be operational telemetry, not a prerequisite for shipping a repair. The artifact-integrity and local lifecycle checks remain blocking.

Why this design

Run 32195442556 attempt 1 failed after successful builds/publishes because five real artifacts all waited on the same live production registration path. Raising the 12-second timeout again would only move the failure threshold and make outages slower to surface. A local ephemeral handshake endpoint makes the gate deterministic while still executing the shipped CLI, harness driver, and broker binaries end to end.

Reference: https://github.com/AgentWorkforce/relay/actions/runs/32195442556

Version reconciliation

The repository changed while this work was starting: run 32195442556 was rerun successfully as attempt 2 and pushed release commit 286467e93 for v11.7.2. Current state is now reconciled:

  • agent-relay: repo 11.7.2, npm 11.7.2
  • @agent-relay/harness-driver: repo 11.7.2, npm 11.7.2
  • all 18 npm packages touched by the release flow report 11.7.2
  • the root plus every packages/* manifest and packages/sdk-py/pyproject.toml are 11.7.2 (20 manifests total)
  • all 23 internal @agent-relay dependency pins are 11.7.2

Therefore this PR does not manufacture another version bump: its resulting checked-in version remains 11.7.2, and the next patch publish will calculate 11.7.3 through the workflow's Version all packages step.

Verification

Passed locally:

  • npm ci
  • npm run typecheck
  • npm run build
  • npx vitest run packages/cli/src/cli/ci-relaycast-stub.test.ts packages/cli/src/cli/ci-standalone-smoke.test.ts (9/9)
  • Prettier checks for every changed source/workflow file
  • actionlint syntax checks for publish.yml and verify-publish-sdk.yml
  • YAML parse checks for both workflows and the composite action
  • exact composite-action shell body launched the stub and passed its health check
  • rebuilt CLI plus rebuilt broker passed scripts/ci-standalone-smoke.sh against the loopback endpoint
  • rebuilt HarnessDriverClient.spawn started the rebuilt broker against the loopback endpoint and shut it down successfully

The workflow only runs from main, so the exact GitHub-hosted win32/linux/darwin matrix cannot be executed from this unmerged change. The local proof exercises both lifecycle call paths; GitHub will provide the cross-platform proof on the next publish.

Full npm test is not green on current main-equivalent code for two unrelated failures outside this diff:

  • broker-lifecycle.test.ts expects the obsolete text Reflex log format, while the implementation emits structured JSON
  • integration-relayfile-contract.test.ts cannot replace a stale daemon because lsof is unavailable on this host

Result: 2,098 passed, 14 skipped, 2 unrelated failures.