fix(release): publish in dependency order, fail closed on unpublished internal deps

Merged
KH
3d ago
+374-24

Root cause

In Publish Package run 37396747701 (attempt 1, 2026-10-06), publish-packages ran all 17 packages as one parallel matrix (publish.yml publish-packages strategy.matrix, max-parallel: 10) with no ordering between them. Publish core failed at 01:09:20Z (post-publish verification failed for @relayfile/core@0.10.73: registry still reports the package as absent) while sdk, client, local-mount and cli-* succeeded and stayed published; core was only published by a rerun at 01:13Z, leaving @relayfile/sdk@0.10.73 -> @relayfile/core@0.10.73 uninstallable (ETARGET) in between.

Fix

  • New scripts/release/assert-internal-deps.mjs: before a package is reconciled/published, every internal @relayfile/* dependency (dependencies/optional/peer) must resolve via npm view, or be produced by this release, in which case the job waits (bounded, 20 min) for it to appear; otherwise it fails closed. Dry runs do not wait.
  • Run in both publish-packages and publish-single as step "Assert internal dependencies are published", before "Reconcile package with NPM".
  • Matrix reordered into dependency order (core, mount-, cli-, then sdk, client, agents, cli, file-observer, local-mount).

Gate / test

scripts/release/assert-internal-deps.test.mjs runs under npm run test:release (ci.yml "Test release scripts" step, run: npm run test:release, and publish.yml build job). With publish.yml reverted to origin/main, tests 6 and 7 fail; with the fix, 112/112 release tests pass.

Nothing published, no workflow triggered, no version bump.

šŸ¤– Generated with Claude Code

[!NOTE]
Medium Risk
Changes release publishing behavior and can block or delay matrix jobs if upstream packages fail or are slow to appear on npm, but reduces broken partial releases on the registry.

Overview
Fixes a release race where parallel publish-packages jobs could ship dependents (e.g. @relayfile/sdk) while @relayfile/core failed post-publish verification, leaving broken npm install until a manual rerun.

Adds a fail-closed gate (assert-internal-deps.mjs) in both bulk and single publish jobs, run before reconcile/publish: every pinned internal @relayfile/* dependency must already resolve on the registry, orā€”if it is part of the same release versionā€”jobs poll (up to ~20 minutes) until it appears; otherwise the job errors out. Dry runs skip waiting.

The publish matrix order is adjusted so core and platform binary packages run before sdk, client, agents, cli, and related packages, aligning scheduling with the dependency graph. Release script tests cover wait/timeout/dry-run behavior and assert the workflow runs the gate before reconcile and lists packages in dependency order.

Reviewed by Cursor Bugbot for commit 5b28e4229893b586e8beb5ddef0375f592745915. Bugbot is set up for automated code reviews on this repo. Configure here.

Agent Relay sessions

  • claude session af8921f7 Ā· opened via gh pr create Ā· last active 2026-10-06