Repository navigation
1.9.0: stage the browser sidecar's npm releases, and fail a release whose sidecar changed under a published version - #585
Merged
Conversation
The package is now on npm, and its trusted publisher allows staged publishes: CI stages each version over OIDC, with no NPM_TOKEN, and a maintainer approves it with 2FA before it is public. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CJAKwnkBaCGr5qjCcmc3kh
The sidecar job skips npm when its version is already published, so a sidecar change released without a version bump would silently never reach npm. When the version is on npm, the job now packs the published tarball and browser-sidecar/, compares them file by file, and fails with "bump the version" when they differ (.github/scripts/browser-sidecar-unchanged.sh). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CJAKwnkBaCGr5qjCcmc3kh
TonsOfFun
changed the title
TonsOfFun
marked this pull request as ready for review
October 14, 2026 21:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release: 1.9.0. Part of the 1.9.0 set with #584, #586 and #587.
@activeagents/browser-sidecar@1.9.0is now on npm. Its trusted publisher on npmjs.com is set up for staged publishes, and npm recommends against allowing directnpm publish. This changes the release workflow to match.Changes to
publish-browser-sidecarinrelease.ymlNODE_AUTH_TOKEN/NPM_TOKEN. That secret never existed in this repo, which is why the sidecar had never been published. Provenance comes with OIDC, so--provenanceis gone.npm stage publishinstead ofnpm publish. A staged version stays private until a maintainer approves it with 2FA, on npmjs.com or withnpm stage approve.npm stage listshows what's waiting..github/scripts/browser-sidecar-unchanged.sh): when the version is already on npm, the job packs the published tarball andbrowser-sidecar/, diffs them file by file, and fails with "browser-sidecar changed since @activeagents/browser-sidecar@X was published; bump the version" if they differ. Before this, a sidecar change released under a published version would be skipped silently.ActionAgent::VERSIONand the GHCR image job.Testing
main's and 1.9.0: Scenarios — rename Catalogs, edit in the dashboard, generate from a project's browser, export and import #586'sbrowser-sidecar/match the published 1.9.0 (exit 0). 1.9.1: upload files through the sandbox browser's live view #588's sidecar, labelled 1.9.0, fails with the error and the README/lib diff (exit 1).Sources: npm trusted publishing docs
🤖 Generated with Claude Code
https://claude.ai/code/session_01CJAKwnkBaCGr5qjCcmc3kh