Fix queued same-day automatic release recovery

Merged
UN
3mo ago
+370-72

Summary

  • detect the current UTC-day immutable tag for scheduled and issue-retry Auto Release events before analyzer provenance or build setup
  • select, wait for, or recover the exact-tag Release workflow and require direct non-draft GitHub Release plus anonymous exact-version npm proof
  • execute the real workflow shell for tag detection, queued schedule recovery, issue retry markers, and missing-npm failure
  • upgrade the managed pm-changelog extension to 2026.8.17 and regenerate the changelog

PM lineage

Verification

  • node scripts/run-tests.mjs coverage — 7,459 tests, exact 100/100/100/100
  • pm test pm-dm2vfz --run --progress — 35 focused workflow tests
  • pnpm lint
  • pnpm typecheck
  • pnpm quality:docs-links
  • pnpm quality:defect-evidence
  • pnpm security:scan
  • pnpm audit --prod
  • pnpm quality:package-artifact
  • pnpm changelog:pm:check

Closes #1045 after merge and live recovery verification.

Summary by Sourcery

Strengthen same-day automatic release recovery by detecting existing daily tags before preparation, selecting or dispatching the corresponding Release workflow, and enforcing publication verification gates for queued schedules and issue-driven retries.

Bug Fixes:

  • Ensure queued daily Auto Release runs recognize and reuse an already-published same-day tag instead of re-evaluating a new candidate.
  • Require successful exact-tag Release workflow completion plus non-draft GitHub Release metadata and matching public npm version before accepting a same-day release as recovered.
  • Handle missing public npm publication for an existing tag as a hard failure so incomplete releases are not treated as successful.

Enhancements:

  • Broaden the immutable same-day tag detection step to cover all non-manual automation events rather than issues only.
  • Add explicit workflow-contract tests around same-day tag detection, queued schedule recovery behavior, and publication verification.
  • Update releasing documentation to describe queued automatic same-day recovery semantics and stricter evidence requirements.
  • Refresh managed pm-changelog extension metadata and move current changes under an Unreleased changelog section.

Documentation:

  • Document how queued schedules recover already-tagged same-day releases, including GitHub Release and npm verification requirements.

Tests:

  • Extend release automation integration tests to cover same-day automatic recovery, queued schedule behavior, Release viewing, and npm publication checks.
  • Update CI workflow contract tests to assert the presence and conditions of the new same-day detection and verification steps.

Chores:

  • Record the pm-dm2vfz production incident lineage in project history and issue tracking artifacts.
  • Regenerate changelog entries aligned with the updated release-recovery behavior.

Summary by cubic

Prevents queued same-day Auto Release runs from opening false blockers after a manual release by verifying the current UTC-day tag’s publication before analyzer. Previously, automatic runs checked analyzer first and failed on the generated release commit; now they select or recover the exact Release workflow, require public GitHub Release and exact npm proof, and emit fail-closed diagnostics when verification fails.

  • Move same-day tag detection ahead of analyzer/build for schedule and issue events; exclude workflow_dispatch.
  • On existing same-day tags: select, wait for, or dispatch the exact-tag Release workflow; then verify non-draft GitHub Release and exact public npm version; capture provider-unavailable and mismatched-version failures as explicit diagnostics.
  • Extend integration tests for queued schedules, issue-retry markers, tag detection, and provider negative controls; update releasing docs to the public contract; bump pm-changelog to 2026.8.17 and regenerate the changelog from full tag history.

Operational notes

  • Manual dispatch behavior is unchanged.
  • Automatic runs may fail closed if npm publication lags or provider metadata is unavailable; monitor the first run and re-dispatch the Release workflow if needed.