release: 20.1.0 — publish the scaffold's own CI and the budget accounting fix - #433
Conversation
The lockstep bump that publishes the scaffold's own CI. bda2470 made a generated app carry .github/workflows/ci.yml and corrected the budget accounting, and npm still serves 20.0.0 for all 31 packages, so a customer running bunx create-ultimate today gets an app with no CI. Minor rather than major: the scaffold gained an emitted file and a corrected measurement, and no published API was removed. The repo's history supports a minor here, 19.0.0 through 19.4.0 carried ten of them. Derived files moved with the manifests: framework.manifest.json, bun.lock, docker/helm/Chart.yaml and the wiki footer's version stamp. scripts/release.ts --check 20.1.0 reports 31 packages stamped at 20.1.0 and every file derived from them. bin/check is green first pass, 14 of 20 steps passed and 6 skipped, the app-level steps that have no app in this repo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
On-demand reviews are free for the next 9 days. After that, they cost $0.25 per reviewed file. Or wait 9 minutes for your next included review. View limit detailsLimit details: You’ve used the included review currently available. Your 92 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: ASSERTIVE Plan: Essentials Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (46)
Comment |
🟡 Not reviewed — no model ranno findings — nothing capable of finding any ran · grounded on your code No model reviewed this diff — no model credential reached the server that ran it, so there was nothing to review the code with. What follows is a mechanical summary of which files changed: it reports no findings because nothing capable of finding anything ran, NOT because the changes were found to be clean. 🤖 developerz.ai — automated review, running on your box. No model reviewed this diff. |
![developerz-ai[bot]](https://avatars.githubusercontent.com/in/3783704?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review summary — 46 file(s) changed. No model reviewed them.
Reviewed 46 file(s), +292 / 562 changed line(s).
CHANGELOG.mddocker/helm/Chart.yamldummy/social-media-clone/package.jsondummy/social-media-clone/packages/i18n/package.jsonexamples/dummy/apps/admin/package.jsonexamples/dummy/apps/web/package.jsonexamples/dummy/package.jsonexamples/dummy/packages/core/package.jsonexamples/dummy/packages/db/package.jsonexamples/dummy/packages/domain/package.jsonexamples/dummy/packages/i18n/package.jsonexamples/dummy/packages/mcp/package.jsonexamples/dummy/packages/ui/package.jsonframework.manifest.jsonpackages/action/package.jsonpackages/admin/package.jsonpackages/ai/package.jsonpackages/auth/package.jsonpackages/cache/package.jsonpackages/cli/package.jsonpackages/core/package.jsonpackages/create-ultimate/package.jsonpackages/db/package.jsonpackages/entity/package.jsonpackages/flags/package.jsonpackages/http/package.jsonpackages/i18n/package.jsonpackages/jobs/package.jsonpackages/mail/package.jsonpackages/manifest/package.json- …and 16 more
Review — no model ran
No model reviewed this diff — no model credential reached the server that ran it, so there was nothing to review the code with. What follows is a mechanical summary of which files changed: it reports no findings because nothing capable of finding anything ran, NOT because the changes were found to be clean.
A model-backed review needs a connected provider with a usable key on this account (Account -> Integrations); until there is one, reviews here are a mechanical changed-files summary.
Review pass matrix — incomplete
Mandatory pass(es) missing: Security. Approval is gated in code on the mandatory set, so this review CANNOT post a real GitHub APPROVE even if the diff is clean — the verdict is a quiet advisory comment until the missing pass records completion.
| Pass | Status | Detail |
|---|---|---|
Correctness |
✅ completed (0 findings) | |
Security |
⏭️ skipped (MANDATORY) | not_wired |
Tests |
⏭️ skipped | not_wired |
API/Contract |
⏭️ skipped | not_wired |
Style/nits |
⏭️ skipped | not_wired |
Config notes
- prior review discussion was not shown to the reviewer — this pull request carried no review comments, so nothing settled earlier could inform this pass
- 1 noise file(s) auto-skipped (lockfiles/generated/vendored — re-include with path_filters)
- test files were not shown to the reviewer — this diff touched no path recognised as a test, so no assertion was available to read the change against
🤖 developerz.ai review — automated, running on your box. No model reviewed this diff — see below. What is this?
1 participant
What
The lockstep bump to 20.1.0, which is what actually ships the scaffold's own CI to customers.
Why
bda24709merged the work: a generated app now carries.github/workflows/ci.ymlrunningbin/setup && bin/checkon push and pull request, the framework's ownbin/setupandbin/checkrun first-pass green with no waiver, andframeworkJsBytesis excluded from the app'sjsbudget so prerender registration order no longer changes the measured total.None of that reaches anyone until it is published. Measured before opening this:
20.0.0was tagged beforebda24709landed, sobunx create-ultimatetoday still hands a customer an app with no CI. Merging this and publishing the Release is the step that closes that.Changes
Minor, not major: the scaffold gained an emitted file and a corrected measurement, and no published API was removed. The repository's history supports a minor at this point —
19.0.0through19.4.0carried ten of them, so the cadence is not major-only.47 files, all modified, none added or deleted. 42 manifests (the 31 published packages plus the private
examples/dummyanddummy/social-media-clonetrees), the changelog, and the four derived files:bun.lock,docker/helm/Chart.yaml,framework.manifest.jsonand the wiki footer's version stamp.The changelog's
[Unreleased]section was not a placeholder —bda24709had already written its own entries. The one thing it named nowhere was the budget accounting, so that is added under### Fixed, including whyframeworkJsBytesis optional onRouteStats: a stats file written before this release carries no such key, and absent is not zero.Verification
Branch cut from
mainatbda24709. Gate green:The six skips are app-level steps with no app in this repository, and they skip on a clean run too. Reproduced twice, both exit 0. The unit lane is 17,044 tests across 1,373 files.
That is the question the release workflow asks before it publishes.
bun installand thenbun install --frozen-lockfileboth reported no changes, confirming the bump had already corrected the lock.One thing CI does not cover, and it cost two red runs
This build box runs Bun 1.3.14 and
REQUIRED_BUNis1.4.0(packages/cli/src/app-root.ts, andengines.bun). On the system Bun the gate is red with a different set of failures each run — 27 the first time, 7 the second — most of themX_BUN_VERSIONraised beforecreate-ultimatedoes anything, the rest port-bind and spawn-hook timeouts. Against a 1.4.0 binary it is green first pass in a quarter of the wall time. None of the red was tree-caused; the box is simply below the framework's own floor. Noting it so the next person does not debug a version gap as a regression.Related
Filed while reading the release path end to end: #432 — the
npm-publishenvironment has only a branch policy, no required reviewers, whilerelease.ymlandPUBLISHING.mdboth state that reviewers gate the publish. Publishing is irreversible, so that gap is worth closing or the claim worth deleting. It does not block this bump.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.