Skip to content

ci(release): the hotcrm downstream smoke resolves hotcrm's latest release tag at run time - #25965

Merged
objectstack-fleet[bot] merged 1 commit into
mainfrom
claude/project-thread-beijtf
Oct 26, 2026
Merged

ci(release): the hotcrm downstream smoke resolves hotcrm's latest release tag at run time#25965
objectstack-fleet[bot] merged 1 commit into
mainfrom
claude/project-thread-beijtf

Conversation

@objectstack-fleet

@objectstack-fleet objectstack-fleet Bot commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

Fixes #25770

Claim: #25770 comment 6409515497 (Branch claude/project-thread-beijtf, the devx seat's in-seat S card).

What

The release lane's Downstream backward-compat smoke (live hotcrm) step no longer hard-codes HOTCRM_REF: v2.1.0, an ObjectStack 14.7-era hotcrm that sits four majors behind. At run time it resolves hotcrm's latest published release (repos/objectstack-ai/hotcrm/releases/latest → tag_name) and runs the smoke against it. This implements the maintainer's ruling D10 = A.

  • Still advisory: BLOCKING: '0' is unchanged. No new gate and no new dispatch lane.
  • Fail-soft: on a network error, a non-200 response, or an empty or malformed tag_name, the step emits ::notice:: and skips. It never fails.
  • The lookup authenticates with the job's GITHUB_TOKEN, so it isn't subject to the anonymous per-IP rate limit. The token is unset before hotcrm's install runs its third-party lifecycle scripts.
  • The "TO RE-ARM" comment is rewritten as a ruling, not a pending to-do. The final warning names @objectstack/downstream-contract as the blocking floor.
  • The Node-floor comment cited "hotcrm@v1.2.0 … engines.node >=22", which was stale. It now cites .nvmrc plus the cloned release's engines.node (v6.0.0: ^22.11 || ^24 || >=26). node-version: '22' is unchanged.

Verified (the step's run: extracted, with the smoke call stubbed)

live:            Resolved hotcrm's latest published release: v6.0.0   (GH_TOKEN cleared before the smoke)   exit 0
missing repo:    ::notice::could not resolve … (HTTP 403, no usable tag_name) — skipping the advisory downstream smoke. The publish continues.   exit 0
unreachable:     ::notice::… https://nonexistent.invalid/… (HTTP 000, no usable tag_name) — skipping …   exit 0
200, no tag:     ::notice::… (HTTP 200, no usable tag_name) — skipping …   exit 0

grep -n "HOTCRM_REF:\|BLOCKING:" .github/workflows/release.yml → only BLOCKING: '0'.

--self-test exited 0 on every script that reads release.yml: scheduled-full-run, check-changeset-no-major, check-self-test-wired, check-skill-compatibility-version, check-stall-guard-budget, release-dist-tags, release-github-releases, release-pending-publish, release-verify-npm, sync-docs-image-tags and sync-release-index-currency. Also exit 0: check-node-version, check:workflow-status-functions, check:workflow-step-name-quoting and check:pm-governed-prose.

Left out (out of the card's scope)

  • .github/workflows/cut-rc.yml:757 still pins HOTCRM_REF: v2.1.0. The card keeps cut-rc out of scope.
  • scripts/downstream-smoke.sh still defaults to v1.2.0 when HOTCRM_REF is unset. release.yml always sets it now, and dispatch-gates.self-test.mjs reads the script byte for byte.

skip-changeset: a root-workflow change that publishes nothing. Clause-②: no. Metadata-protocol: none. Tier H (.github/workflows/release.yml): it lands after a GOVERNED_APPROVERS approval.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LKHDniRQSWjRJyDtacwpEd

@claude
ci(release): the hotcrm downstream smoke resolves hotcrm's latest rel…
e7b12fd 
…ease tag at run time (#25770)

The release lane's "Downstream backward-compat smoke (live hotcrm)" step
hard-coded HOTCRM_REF v2.1.0 (hotcrm on ObjectStack 14.7), four majors
behind hotcrm's latest release, so every publish ran the only real
downstream check against a stale app and emitted a warning that was
certain to appear and meant nothing.

Per the maintainer's ruling D10 = A, the step stays advisory
(BLOCKING '0') and its ref now resolves at run time from hotcrm's
releases/latest tag_name, using the job's GITHUB_TOKEN for the read
only (unset before hotcrm's install runs). The read is fail-soft: a
network error, non-200 or empty/malformed tag_name emits a notice and
skips the smoke. The "TO RE-ARM" to-do comment is rewritten as the
ruling it now is, and the Setup Node.js comment that tied the Node
floor to hotcrm@v1.2.0 now names .nvmrc and the latest release's
engines.node.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LKHDniRQSWjRJyDtacwpEd
@objectstack-fleet objectstack-fleet Bot added ci/cd skip-changeset PR has no user-facing published change; bypasses the changeset gate labels Oct 26, 2026
@objectstack-fleet

objectstack-fleet Bot commented Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

席位核对

Verdict: ACCEPT at head e7b12fddd8b20bb63a36afbe2c190ae750ab59d2.

Checklist

  • PR shape: draft → main, first line Fixes #25770. The card is claimed on this branch (comment 6409515497). No closing keyword sits next to another open card.
  • Scope: one file, .github/workflows/release.yml (+56/−42). Labels are ci/cd and skip-changeset. That is correct: it changes CI wiring only, and no published package or content/docs/releases/ is touched.
  • Contract review: not triggered. There is no packages/spec/src/**, no Clause-②, no narrowing and no governed rule text.
  • Tier H: .github/workflows/** is governed, so landing waits for a GOVERNED_APPROVERS approval (hotlong / os-zhuang requested).

Gate readings pinned to head e7b12fd

  • Lint & Repo Gates success, TypeScript Type Check success, Test Core success, Governed Surface Queue Guard success, Dogfood Regression Gate success, plus the claim/single-writer guards success.
  • Everything else is skipped. These are path-filtered or opt-in jobs (UI lanes, Build Docs, packed-tarball smoke, 18.x upgrade harness). None are failed, cancelled or pending.

Spot checks

  • BLOCKING: '0' is unchanged, so the smoke stays advisory, as ruling D10 = A asks.
  • The resolver reads releases/latest → tag_name. It checks that value against ^[A-Za-z0-9][A-Za-z0-9._/-]*$ before it is used, and it unsets GH_TOKEN before the smoke script runs.
  • A failed resolve emits ::notice:: and exit 0 (fail-soft), so a hotcrm API hiccup cannot redden a release.
  • Live test of the resolver: it returned v6.0.0. The Node-floor comment now cites .nvmrc and v6.0.0's engines.

Deviations / out of scope (named, not fixed here)

Generated by Claude Code

This was referenced Oct 26, 2026
Closed
Open
@os-zhuang
os-zhuang marked this pull request as ready for review October 26, 2026 15:12
@objectstack-fleet
objectstack-fleet Bot enabled auto-merge October 26, 2026 15:13
This was referenced Oct 26, 2026
Closed
Closed
@objectstack-fleet
objectstack-fleet Bot added this pull request to the merge queue Oct 26, 2026
Merged via the queue into main with commit e1aef17 Oct 26, 2026
49 checks passed
@objectstack-fleet
objectstack-fleet Bot deleted the claude/project-thread-beijtf branch October 26, 2026 16:03
@github-actions github-actions Bot mentioned this pull request Oct 26, 2026
Closed
This was referenced Oct 26, 2026
Open
Merged
Closed
Open
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@os-zhuang os-zhuang os-zhuang approved these changes
@hotlong hotlong Awaiting requested review from hotlong hotlong is a code owner

Assignees

@os-elon-musk os-elon-musk

Labels

ci/cd size/s skip-changeset PR has no user-facing published change; bypasses the changeset gate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

release: keep the hotcrm downstream smoke advisory and point it at hotcrm's latest release tag instead of v2.1.0 (maintainer ruling D10 = A)

3 participants

@os-zhuang @os-elon-musk @claude